A CMP automates this process by offering visitors choices for different cookie categories, storing these preferences, and managing all cookie placement based on these choices. Without a CMP, an organization would have to perform this complex process manually. For small Web sites with only functional cookies, a CMP is not necessary. However, once analytics, marketing or other tracking technologies are used, a CMP becomes practically unavoidable to remain compliant. Fines for noncompliance can be substantial, justifying the investment in a good CMP for most organizations.
In addition to European legislation, Google also has strict requirements on how websites collect consent. With the introduction of Consent Mode v2 in 2024, Google required websites to correctly record and transmit user consent to their platforms such as Google Analytics and Google Ads. This is not only a legal requirement, but also a technical requirement to continue using Google services effectively. Google's Consent Mode v2 ensures that data is only collected when the user gives consent. Without a properly set up CMP that works with Consent Mode v2, you risk not only fines, but also that your marketing tools won't work as well and you may lose advertising revenue because Google Ads performs worse.
If your Web site uses cookies for analytics or marketing, you must have a cookie banner. Privacy laws say you must ask visitors for permission before collecting their data. If you only use cookies that are really necessary for your website (such as for a shopping cart or login), then you don't have to. However, your banner must clearly explain what cookies you use and give visitors a real choice. They should be able to refuse cookies without compromising their ability to use your site.
As a website visitor, you are not obliged to give permission for cookies. The cookie banner asks for your permission, because according to privacy laws (AVG/ePrivacy) websites are not allowed to just collect your data. Websites are required to ask your permission before placing non-essential cookies that track your online behavior. You have the right to reject these cookies without restricting your access to the website. The law thus protects your privacy and gives you control over what personal information you want to share.
Step 1: Choose a CMP that fits your needs and budget, such as Cookiebot or Cookiecode.
Step 2: Create an account with your chosen CMP.
Step 3: Configure your CMP by adding a cookie policy and choosing the appropriate visual settings.
Step 4: Add the CMP to your Google Tag Manager setup.
Step 5: Test the performance of your CMP and your cookie banner and adjust the order of your GTM triggers if necessary.
For a comprehensive guide, check out our article "Successfully Implementing Consent Management."
Yes and no. The AVG (General Data Protection Regulation) deals with the processing of personal data in a broad sense, while the cookie banner is specifically required by the ePrivacy Directive. The ePrivacy Directive is more specific to electronic communications and states that websites must seek explicit consent before setting nonessential cookies. The AVG comes into play because cookies often process personal data. Together, these rules create an obligation for websites to be transparent about their cookie use and seek consent. So formally, the cookie banner requirement comes from the ePrivacy Directive, but the AVG strengthens and broadens this requirement with additional privacy obligations.