Consent Management Platform (CMP)
The tool behind the cookie banner: it collects consent choices, stores the proof, and stops tagged scripts firing until someone says yes.
See it
What it is
A CMP does three jobs the banner alone cannot. It collects the choice (the UI). It records it as proof: who, when, from which policy version, for which purposes, kept for as long as you rely on that consent. And it enforces the choice, blocking tagged scripts until the matching purpose is granted and broadcasting the state to everything downstream. Common ones are OneTrust, Cookiebot, Usercentrics, Osano, and the open-source Klaro; ad tech adds the IAB TCF consent string, and Google's stack listens for Consent Mode signals.
Reach for one as soon as you have more than a couple of third-party tags or you sell into the EU. Below that bar a hand-rolled banner writing a versioned consent object to storage is genuinely enough, and a lot lighter than a 90KB vendor script on your critical path.
Gotcha: buying a CMP is not compliance. If your tags are miscategorized, or a script is hardcoded in the page head where the CMP never sees it, the dashboard cheerfully reports consent while the pixel fires anyway. Audit with the network tab in a fresh incognito window after clicking 'Reject all': anything that still calls out is your real answer. And remember the CMP itself processes personal data, so it belongs in your subprocessor list with a signed DPA.
Ask AI for it
Wire a consent management layer into this app. Define four purpose categories (strictly necessary, functional, analytics, marketing) and a typed consent state object holding the granted purposes, a timestamp, and the policy version. Load every non-essential script through a single gated loader that checks the state first, so nothing tagged analytics or marketing can execute before its purpose is granted, and audit the page head for hardcoded tags that bypass the loader. Persist the choice in a first-party cookie plus a server-side consent record for proof, expose a subscribe API so components react when consent changes mid-session, and re-prompt automatically when the policy version increments. Add an integration test that rejects all, reloads, and asserts that no request goes to any analytics or ad host.