Consent tools

Consent Management Platform (CMP) for WordPress

A consent management platform asks visitors what they allow, holds back trackers until they answer, keeps a record, and passes the choice on to the tools that need it. Here’s what that means on WordPress, and when you need a Google-certified one.

Get GoConsent free Audit your site free

At a glance

  • A CMP asks, blocks, records and passes on the visitor’s choice
  • Google requires a certified, TCF-based CMP only to show personalized Google ads to visitors in the EEA, UK and Switzerland
  • Google Analytics and Google Ads work with any banner that sends Consent Mode v2

What a CMP does

IAB Europe describes a consent management platform as a software or solution provider that develops the notices people see and collects their choices. On a WordPress site, that comes down to four jobs:

  • Ask: show a banner and a place to change choices later.
  • Block: hold back analytics and advertising scripts until the visitor allows them, where the law requires it.
  • Record: keep proof of what each visitor chose.
  • Signal: pass the choice to Google’s tags, ad vendors and other plugins.

When Google requires a certified CMP

If you publish Google ads on your site through AdSense, Ad Manager or AdMob, Google requires a Google-certified CMP that integrates with the IAB Transparency and Consent Framework (TCF) for ads served to visitors in the EEA and UK (since January 16, 2024) and Switzerland (since July 31, 2024). Without one, Google says you won’t be eligible to serve personalized ads to them. Google keeps a list of certified CMPs and updates it weekly.

TCF is IAB Europe’s standard for passing consent to ad vendors. CMPs register through IAB Europe’s CMP Portal for a yearly fee; the current version is TCF v2.3, which Google required from March 1, 2026.

When you don’t need one

If you advertise with Google Ads or measure with Google Analytics, but don’t show Google ads on your own site, certification isn’t the rule. Google says you can use a consent banner or another custom consent solution, as long as it sends the consent state to Google through Consent Mode v2. Since March 2024, Google Analytics leaves EEA visitors out of ad audiences unless those consent signals are sent.

For US visitors, Google says neither a CMP nor the IAB Global Privacy Protocol (GPP) is required for state privacy laws. It does recommend the GPP string over the older US Privacy string for publishers that send one.

What regulators expect from the banner

  • The EDPB’s cookie banner taskforce criticized banners with no reject option on any layer that has a consent button, and said pre-ticked boxes don’t give valid consent.
  • The UK ICO’s checklist: make it as easy to refuse consent as to accept, with optional switches off by default.
  • France’s CNIL: refusing cookies should be as easy as accepting them.
  • Let people change their mind easily, for example from a link or button on every page.

How GoConsent handles it

  • Equal Accept All and Reject All, with category switches right on the banner
  • Trackers held until consent, including scripts other plugins add later
  • Google Consent Mode v2, Global Privacy Control, an IAB GPP US National signal and the WP Consent API
  • A Your Privacy Choices dialog and a privacy button on every page, so visitors can change their mind
  • A daily scanner that finds trackers, including those inside Google Tag Manager
  • Not a Google-certified TCF CMP: if you publish Google ads to visitors in the EEA, UK or Switzerland, you’ll need one

See every GoConsent feature

A plain-English guide, last reviewed October 26, 2026. It isn’t legal advice. Read the sources below and talk to a lawyer about your situation.

FAQ

Questions, answered

What is a consent management platform?

Software that asks visitors for consent, holds back trackers until they answer, records their choice and passes it on to tools such as Google’s tags.

Do I need a Google-certified CMP?

Only if you serve Google ads through AdSense, Ad Manager or AdMob to visitors in the EEA, UK or Switzerland and want them to be personalized.

Is GoConsent a Google-certified CMP?

No. It sends Google Consent Mode v2, which Google Analytics and Google Ads accept from any consent banner.

Does a US site need a CMP?

Google doesn’t require one for US state laws, but those laws do require honoring opt-outs, and several require honoring Global Privacy Control.

Sources

Set up privacy the right way today

Install GoConsent free from WordPress.org. No account, no visit limits, and nothing about your visitors leaves your site.

Get GoConsent free See Pro plans