In short
- A consent platform is not judged on its banner. It has to collect the choice, keep proof of it, pass that state to your tools and allow withdrawal.
- The criterion that decides everything is prior blocking. Many installations display a banner while the measurement and advertising scripts are already loading.
- You can check it yourself in ten minutes, with your browser’s Network tab, without buying a single tool.
- The real cost follows traffic. Most vendors bill by visit volume, with threshold effects that trigger at the worst time of year.
A retail site shows us its cookie banner. It is clean, bilingual, with the three expected buttons and a link to the privacy policy. The director is relaxed: the solution was installed by his agency, the subject is closed.
We open the browser’s Network tab and reload the home page without clicking anything. Eleven requests leave towards measurement and advertising domains before the banner even appears. The visitor has not had time to read the first line and their data has already gone.
There is nothing exceptional about this case. The banner is visible, so it reassures, and nobody looks at what happens behind it. Choosing a consent management platform means first knowing what has to happen behind it.
What a consent platform actually does
The banner is the visible part, and the least decisive. A consent management platform, often called a CMP in the documentation, performs four functions. Failing installations handle the first and miss at least one of the other three.
- Collect the visitor’s choice, purpose by purpose, with refusal as accessible as acceptance.
- Keep the proof: timestamp, purposes accepted, version of the banner shown, an identifier that lets you find the record again.
- Pass the consent state to your tools, in real time, so that measurement and advertising behave differently depending on the answer.
- Allow withdrawal at any time, with the relevant trackers actually removed, not just an internal flag changing value.
The third function is the one discovered last. Consent collected but not transmitted is useless: your tags keep behaving as before, and you have simply added a grey window to your home page. That transmission goes through your tag manager and your tagging plan, which is why the two choices cannot be made separately.
The technical point that decides everything: blocking before the choice
A compliant platform stops trackers from loading until the visitor has answered. That behaviour goes by several names depending on the vendor: prior blocking, native blocking, automatic blocking by category. The principle is the same: the third-party script is not executed, it is held.
Many setups do the opposite. The banner appears, the scripts load in parallel, and the platform merely remembers the answer for later visits. Technically it works. Legally, the tracker has already been set.
Three causes recur. The platform offers no native blocking and assumes you will gate each tag yourself. Blocking exists but was never switched on at installation. Or it is active for the declared scripts, and a pixel was hard-coded into the theme six months later, outside its scope.
What to take away A platform that genuinely blocks trackers, even if it looks plain, is worth more than an elegant banner that lets everything through. Prior blocking is the difference between real compliance and compliance for show. It is also the only criterion you can check yourself, for free, before signing.
Seven selection criteria, and the question to ask the vendor
Sales demonstrations all look alike: they show the banner and the dashboard. The differences between solutions lie elsewhere. Here is the grid we use, with, for each criterion, the question that forces the vendor out of general talk.
| Criterion | What it changes for you | The question to ask the vendor |
|---|---|---|
| Effective blocking | Without it, everything else is cosmetic | Do you block scripts before the choice natively, or do I have to gate each tag myself? |
| CMS and tag manager compatibility | A rough integration becomes a permanent maintenance burden | Do you have an official connector for my CMS and my tag manager, and who maintains it? |
| Transmission to advertising tools | Without a correct signal, your ad platforms lose conversions | Which transmission standards do you support, in which versions, since when? |
| Visual customisation | A banner that feels foreign to the site drives the acceptance rate down | Can I change the text and the styling without going through your support team? |
| Proof logging | This is what you will be asked for in an inspection | What does a record contain, how long do you keep it, can I export it on my own? |
| Data location | Determines your exposure on transfers outside the EU | Where are the records hosted, and which non-EU processors are involved? |
| Cost that follows traffic | A seasonal peak can multiply the bill without warning | What does the tier count, what happens if I exceed it, what is the rate above? |
The market includes free and open source solutions, specialist European vendors and modules built into CMS platforms. None of those families is disqualified in advance: a well-configured free extension can be more compliant than an expensive subscription installed in a hurry.
The real cost: volume pricing and the threshold effect
The price shown on the home page almost always corresponds to the lowest tier. The useful question is not what it costs today, but what it will cost once your traffic has doubled.
| Pricing model | What is billed | The threshold effect to anticipate |
|---|---|---|
| Free or open source | Nothing, installation and updates on you | When the framework changes, nobody updates your configuration for you |
| Plan by visit volume | Monthly traffic, bots sometimes included depending on the vendor | A seasonal peak tips you into the tier above, sometimes for the whole year |
| Plan per domain or per site | The number of properties, regardless of traffic | Subdomains and country shops are often counted separately |
| Module included in the CMS | Covered by the licence or sold once | The function is sometimes limited to display, with no real blocking of trackers |
Ask for the price of the two tiers above yours before signing, not only the one you are taking. A vendor who will not share the full grid is telling you something useful about the rest of the relationship.
The mistake not to make The free extension installed on a Friday afternoon and never reconfigured since is the most frequent case we come across. It shows a banner, it reassures, and nobody remembers whether blocking was ever switched on. Two years later the site has changed theme and three tools have been added without being declared in the platform. The feeling of compliance is intact, the compliance is not.
A badly wired banner drags your measurement down
This is the symptom that triggers the call, more often than fear of an inspection. Traffic in the analytics tool drops overnight and the team looks for a commercial cause to a technical problem.
Two opposite mechanisms produce that symptom. Over-blocking: the platform never releases the scripts that were in fact accepted, and you lose data on consenting visitors. Under-blocking: everything fires regardless, your figures look excellent, and your legal exposure is at its maximum.
The remedy starts with the design of the banner, a subject we cover in our article on what makes consent clear and its effect on the acceptance rate. It continues with how your data comes back: when browser-side collection becomes partial, the question of how reliable your measurement really is arises in full. As for the applicable framework, in particular the narrow conditions that allow measurement without a banner, it is set out in our article on audience measurement without consent.
Check your banner in 10 minutes
This procedure needs no paid tool and no developer skills. It is done with the browser you already have.
- Open a private browsing window, show the developer tools (F12), go to the Network tab, then load your home page without clicking anything.
- Filter the requests on the names of your measurement and advertising tools. Any request that left before your click corresponds to a tracker set without consent.
- Switch to the Application tab, Cookies section. Before any choice, only the site’s technical cookies and the consent platform’s own cookie should be there.
- Click Reject, reload, and run both checks again. Then accept and check that the tags finally fire: over-blocking costs you data just as surely.
- Withdraw your consent through the permanent link provided for it, and check that the cookies have genuinely gone, not just that the banner has come back.
- Start again on a product page and on mobile, then export a consent record from the interface and read what it contains.
If step 2 turns up third-party requests before your click, the subject is no longer choosing a platform but reworking the current configuration. If step 6 produces nothing exportable, you have no proof to present in an inspection.
Frequently asked questions
Is a consent management platform compulsory?
No text requires you to buy a tool. What is required is the result: collecting freely given, informed consent before any non-exempt tracker is set, keeping proof of it and allowing withdrawal. A simple site with very few third-party tools can manage without a dedicated platform, but beyond three or four tools, doing it by hand becomes more fragile than a tool designed for the job.
How do I know whether my banner really blocks cookies?
Open your site in a private window with the developer tools Network tab showing, load the page and click nothing. If requests leave towards measurement or advertising domains before your choice, prior blocking is not active. That test takes two minutes and needs no particular access to the site.
Is a free extension enough to be compliant?
It can be, if it genuinely blocks trackers before the choice, if it logs consents in a usable way and if someone maintains it. The risk with free solutions is not that they are free, it is that they have no owner: nobody reconfigures them when the site changes. Ask yourself who, in your organisation, will carry that maintenance.
Does changing consent platform lose the consents already collected?
In most cases yes: the choices are stored in a cookie specific to the platform and in its database, with no universal exchange format. Plan for the banner to come back for all your visitors on the day you switch, and for a temporary dip in your measurement. Export your records before you cancel, they cover the earlier period.
What we look at first
When a company consults us on this subject, we never start by comparing vendors. We open the site, we run the Network tab test, and we list the tools actually present on the pages. In half the cases, the platform already in place would do very well, it is simply badly configured.
The question of choice only becomes relevant after that inventory. It then comes down to four points: blocking, proof, transmission to the tools, and a cost whose trajectory you know. That is the work described in our data, analytics and performance practice, where compliance and measurement reliability are handled together. Useful disclosure: Datafirefly Limited, part of the same group as Dotsland, publishes e-commerce modules for PrestaShop, WooCommerce and Shopware, including a consent module, to which we apply the same grid as to the others.
Unsure what your cookie banner actually blocks? We open your site, we list the requests that leave before the visitor’s choice and the cookies set at that moment, and we tell you in one page whether your current platform needs reconfiguring or replacing. Let’s talk.