Consent Management Platform Choice and Data Signal Preservation
Most consent banners fail to enforce user choices across downstream data systems.
Clicking it feels like the end of a transaction. It is actually the start of one, and whether that transaction completes depends on infrastructure the user never sees. A cookie banner is one visible piece of a consent management platform, but the platform itself is supposed to be the whole system: the banner, the scanner that finds tracking technology on a site, the repository that stores what each user chose, the mechanism that carries that choice to every other system, and the ongoing management of that choice over time. The compliance question that actually matters is whether a notice produces any enforcement effect once the click happens, not merely whether it appears on screen.
A University of Michigan team tested 1,793 popular sites running banners from three major consent platforms, and found at least one consent violation on the vast majority of them. Some of those violations traced back to the platform itself (templates not calibrated for every region, crawlers that missed cookies). Others traced back to the site running the platform (hard-coded pixels, scripts that were never categorized, gaps in the tag manager). Either way, the banner displayed correctly and the enforcement still failed.
Regulators have started saying this directly. After fining the apparel brand Todd Snyder, the California Privacy Protection Agency's head of enforcement said that using a consent management platform doesn't get a company off the hook for compliance. Owning the tool is not the same as the tool operating correctly across every downstream system it is supposed to govern. That distinction, between having a CMP and having a CMP that enforces, is the foundation everything else in this piece builds on.
Where the consent signal stops traveling
Follow a single opt-out click from the moment it happens. A user lands on a site, sees the banner, and declines tracking. At that instant, the only thing that has definitely happened is that a preference got recorded somewhere near the browser. Whether it goes anywhere else is a separate question, and for most organizations, the answer is: not very far.
Analytics platforms ingesting behavioral data routinely never see that signal. Customer data platforms building user profiles don't see it. Data warehouses storing event streams, mobile SDKs collecting device identifiers, backend APIs processing transactions, email platforms segmenting audiences, and ad pipelines firing pixels, none of these systems are guaranteed to receive what the user just decided. The opt-out exists in one place and the data keeps moving everywhere else.
This is not theoretical. Jam City paid a seven-figure fine because consent collection existed on the front end, but enforcement into the ad pipeline did not. Solocal Marketing Services paid a substantial fine to France's CNIL because its consent program was never connected to partner data flows. Orange paid €50 million to the CNIL, primarily for displaying unsolicited ads in users' email inboxes without consent, with a second violation layered on top: continuing to read cookies after consumers had already withdrawn consent. That second violation is the sharper one. It shows a real-time enforcement failure at scale occurring repeatedly, over time. In every one of these cases, the organization had a banner and a written policy. The signal simply stopped at the browser and never reached the systems the policy claimed to govern.
The structural reason this keeps happening comes down to where the consent record lives. Browser cookies and local storage can be cleared, blocked by the user's own browser settings, or simply fail to reach the systems downstream that need to check them. A platform like Cookiebot works by blocking scripts until it sees a valid consent signal, but that only works if the receiving system checks for the signal first: if Google Analytics fires before checking consent status, it loads regardless of what the user chose, and the burden of catching that falls on whichever engineering team built the site, not on the platform itself.
The newest version of this problem involves AI. Large language model crawlers do not read a consent banner and negotiate with it. They copy content at scale, and once that content has been absorbed into a model's training weights, there is no practical way to delete it afterward. For that one category, prevention is the only strategy that works, because enforcement after the fact is not realistically possible.
What Regulators Are Now Checking
What regulators check has changed. It used to be: did you show a consent notice. Now it is: can the organization demonstrate how that consent was actually applied across every system that touched the data. A run of 2026 enforcement actions makes the shift concrete.
PlayOn Sports was hit with a seven-figure fine from the California Privacy Protection Agency because its banner required users to agree in order to continue, with no meaningful option to decline, and because its phone and email opt-out channels did nothing to stop tracking on the web. Ford Motor Company was fined by the CPPA in March 2026 for requiring email verification before it would process an opt-out request, then treating unverified requests as expired, during which time the data kept being sold or shared. Tractor Supply was fined by California's CPPA in September 2025 because its opt-out form did not actually stop data sharing through its trackers, and because a browser-level opt-out signal was not honored at all until July 2024. None of these companies lacked a consent banner. Each was fined because the banner did not function as a real consent system.
GPC became legally enforceable in California in January 2023, in Colorado in July 2024, and in Connecticut in January 2025, with California, Colorado, and Connecticut launching a coordinated enforcement sweep in September 2025 targeting retailers whose analytics platforms did not honor GPC headers. Starting January 1, 2026, CCPA requires companies to visibly confirm that they processed a user's opt-out preference, GPC included. Regulators now treat detecting a GPC signal at the edge, failing to pass it to the tag manager, and failing to pass it to the server-side event pipeline and the CDP, as three separate, independently testable failures. A company can catch the signal and still fail twice more downstream.
Enforcement is also widening who gets checked, not just how deeply. Oregon issued 38 cure letters in 2025 targeting denied deletion requests, and Connecticut ran five privacy notice sweeps and two cookie banner sweeps. Smaller organizations that assumed they were below the radar are now inside systematic review processes. India finalized its Digital Personal Data Protection Rules on November 14, 2025, requiring data fiduciaries to give clear notice of purpose, data categories, retention periods, and withdrawal mechanisms.
Google's and Amazon's Enforcement Changes as a Performance Problem
A mid-sized UK e-commerce brand lost roughly nine-tenths of its measured Google Ads conversions overnight in July 2025. The banner on the site looked compliant. It simply failed to transmit Google Consent Mode v2 signals correctly, and a substantial portion of the lost attribution data was eventually recovered through behavioral modeling, but the rest was gone for good. Nobody filed a complaint and no regulator was involved. The collapse in measurable performance occurred without any complaint being filed or regulator involvement.
This is the mechanism now driving urgency for marketing teams, independent of any fine. Without a certified CMP correctly implementing Consent Mode v2, Google treats every user as having declined, which quietly degrades GA4 data and ad performance without throwing any obvious error. Starting June 15, 2026, the ad_storage parameter alone governs whether advertising data flows into Google Ads, with Google Signals excluded from that decision entirely. Any EMEA advertiser running GA4 without a CMP aligned to that change is looking at compounding signal loss from that date forward.
Amazon is applying comparable pressure on a parallel track. Its updated EU consent policy, driven by the Digital Markets Act, takes effect June 30, 2026. The Amazon Consent Signal has already been mandatory since February 2025, using two parameters, amzn_user_data and amzn_ad_storage, to communicate what a user has agreed to. If a CMP fails to pass a valid ACS or IAB TCF signal, campaigns run into disrupted targeting, broken attribution, and limited measurement. Amazon will accept either signal format, so a platform already listed as a TCF vendor may already satisfy the requirement. Microsoft runs its own version of this with UET Consent Mode, and between these three, Google Consent Mode, Microsoft UET Consent Mode, and Amazon Consent Signal, each uses different parameters and different enforcement logic, so a fragmented setup can break measurement across all three systems at once.
The upside of getting this right is just as measurable as the downside of getting it wrong. Consent Mode v2 combined with server-side tracking can substantially reduce the data loss that happens without proper implementation. Every percentage point gained in consent rate translates directly into more attribution data, larger remarketing audiences, and more accurate smart bidding. Consent rate has effectively become a marketing performance metric, and the design choices that raise it, equal-prominence accept and reject buttons, purpose-level granularity, plain-language descriptions, are the same choices regulators require. Compliance and performance optimization point to the same set of implementation decisions.
What CMP evaluation criteria follow from enforcement depth as the primary requirement
Both the regulatory risk and the commercial risk trace back to the same gap, between collecting consent and enforcing it, so the criteria that actually matter when evaluating a CMP are the ones that measure how far enforcement reaches, not how configurable the banner is or how many jurisdictions are listed in a brochure.
The first and most decisive question is architectural: does the platform store consent server-side in an authoritative database, or browser-side in cookies and local storage that can be cleared, blocked, or simply never arrive where they're needed. This single distinction separates platforms more sharply than any other factor on this list. The second question asks whether enforcement actually reaches the martech stack, the CDPs, CRMs, email platforms, and ad tech systems that do the real work, or whether it stops at the browser the way it did in the Jam City and Solocal cases described earlier. A third question asks whether a single consumer opt-out enforces across both the CMP layer, meaning cookies, tags, and pixels, and the data subject rights layer, meaning backend records and known identities, or whether a consumer has to go act in two separate systems to get one decision honored.
Identity resolution is its own line of inquiry: is consent tied to the actual person, persisting across their devices, browsers, and sessions, or does it reset every time the context changes. Disney's enforcement action turned on exactly this failure, with GPC signals applying only to the device where they were detected. For any organization running programmatic advertising, the next question is how deeply the platform supports IAB TCF, GPC, and Google Consent Mode v2, and the word "deeply" matters here, because self-reported support is not the same as verified integration. Cookiebot and CookieYes, for instance, document no GPP support, which limits them to cookie-banner-style opt-outs rather than genuine signal-based compliance for US programmatic advertising.
Microsoft UET certification is worth checking specifically, because the market has a real disparity most buyers don't know about: UniConsent holds formal Microsoft certification for UET and Clarity consent, while Usercentrics, Cookiebot, CookieYes, and Didomi offer self-documented support rather than certified support, and OneTrust supports UET consent mode integration. For organizations building or touching AI systems, another question has become unavoidable: does the platform govern whether and how consented data flows into AI model training or LLM interactions, given that EU AI Act enforcement is now active and GDPR investigations into AI training practices are accelerating. A further question asks whether the platform can capture declared preferences beyond a binary opt-in or opt-out and actually put that zero-party data to use in marketing systems. And a final, more mundane but consequential question is technical: does the CMP script load asynchronously and defer non-critical execution, or does it block page rendering and slow the site down for every visitor regardless of their consent choice.
One regulatory detail sharpens all of this. IAB TCF v2.3, mandated from March 1, 2026, added a requirement that CMPs confirm in the consent string that every disclosed vendor was actually verified, not merely listed. Platforms that haven't updated their implementation to meet that standard are already out of conformance. The natural objection to building an evaluation framework around enforcement depth is that banner display is what regulators check first in a casual audit. But the enforcement actions against Disney, Ford, and PlayOn Sports all show regulators now auditing enforcement depth directly, not banner presence. The criteria above follow from where the actual exposure sits.
How the Major Platforms Compare on Enforcement Depth
Judged purely on feature lists, most enterprise consent platforms look similar. Judged on consent storage architecture, downstream propagation, and verified signal support, some platforms close the enforcement gap while others merely manage the banner.
Ketch is built server-side from the ground up, with real-time propagation into CDPs, ad pipelines, and AI infrastructure. It names AI Sentry and Data Sentry as enforcement layers for AI pipelines and website data collection and downstream consent monitoring, plus a server-side consent record called Permission Vault that anchors enforcement across those downstream systems. That architecture makes it the strongest enterprise case for organizations that need enforcement to reach all the way into the data warehouse and the AI training layer, and it is positioned for complex, developer-led environments rather than simpler marketing setups.
OneTrust operates as a broad enterprise privacy platform rather than a consent-first tool, covering a wide regulatory surface area that includes data subject access requests and vendor management alongside consent. It supports UET consent mode integration for Microsoft advertising. That makes it a strong fit for organizations that need privacy program breadth across DSAR, vendor management, and consent all in one platform, rather than organizations whose central concern is signal propagation depth.
Usercentrics grew out of the EU market with deep GDPR and IAB TCF implementation behind it, and it covers Google Consent Mode v2, IAB TCF, and Amazon Consent Signal.
The meaningful split in this market is which platform's architecture was built to make enforcement reach every system that touches the data, versus which platform is still asking the banner to do a job that belongs to the infrastructure behind it.
