What is a consent manager ... and do I need one? September 14, 2026 | From the Studio

One thing to get out of the way first: We’re a web design and development studio, not a law firm and not a privacy consultancy. Nothing below is legal advice, and it isn’t a substitute for talking to your counsel about what actually applies to your organization. We also don’t set up consent platforms or configure tracking tags. What we can tell you is what’s running on your site today and what implementation looks like from the build side, which is usually the piece missing when these questions come up. Take the rest as context for a better conversation with the people who do own this.

Some version of this email lands in our inbox every few months:

“We’re going through a security audit. They’re asking whether we honor Global Privacy Control and whether users can manage their cookie preferences. Can you help us answer?”

It usually arrives from a marketing director who has just been handed a vendor questionnaire by their legal, IT, or partnership team, and who has a week to respond. The questions sound technical. The honest answer is usually “no, and here’s what it would take to change that.”

So here is the plain-language version of what a consent manager is, how to tell whether your organization needs one, and what it actually takes to put one in place.

First: your cookie banner is probably not a consent manager

Most of the sites we inherit have a banner along the bottom of the page that says something like “We use cookies to improve your experience” with a single OK button.

That is a notice. It tells visitors something is happening. It does not give them any way to change it.

Here is the part that surprises people: on a site like that, your Google Analytics, Meta pixel, LinkedIn Insight tag, and any ad platform pixels are all firing the instant the page loads, before anyone clicks anything. The banner sits on top of tracking that has already happened. Clicking OK does nothing except make the banner go away.

A consent manager is the thing that closes that gap.

What a consent manager actually does

A consent management platform, or CMP, does four jobs that a plain banner does not:

1. It inventories what’s running. Most CMPs scan your site and produce a list of every cookie and tracking script, sorted into categories: strictly necessary, analytics, marketing, preferences. This alone is worth the exercise. Clients are routinely surprised by what they find. That Hotjar trial from 2022 is still on every page.

2. It blocks trackers until someone agrees. This is the functional heart of it. Non-essential scripts are held back until the visitor makes a choice. If they decline marketing cookies, the ad pixels never load for that person.

3. It records the choice. Each consent gets logged with a timestamp and a record of exactly what the person agreed to. If someone ever asks you to prove that a given visitor consented, that log is the proof. It also gives visitors a way to come back and change their mind, usually through a small persistent link or icon.

4. It detects and honors Global Privacy Control. More on this next.

What’s Global Privacy Control?

GPC is a browser-level setting that broadcasts a standing “do not sell or share my personal information” signal to every site the visitor lands on. Instead of clicking “reject” on banner after banner, the person flips one switch and the signal travels with them.

Two things make GPC worth paying attention to:

• First, it is not optional in the way its predecessor, Do Not Track, was. As of January 2026, twelve states legally require covered businesses to treat a GPC signal as a valid opt-out request: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas.
• Second, you are almost certainly receiving these signals already. Firefox, Brave, and DuckDuckGo send GPC by default or with one setting enabled. A site with no CMP does not detect the header, so it does nothing with it. That is exactly the gap a security questionnaire is designed to catch.

So do you need one?

We are designers and developers, not attorneys, and this is genuinely a legal question rather than a technical one. But after fielding this a lot, here is how we’d think about it.

You very likely need one if:

• You run ad pixels or retargeting tags (Meta, LinkedIn, Trade Desk, Google Ads)
• You have visitors or customers in the EU or UK, where consent must be collected before non-essential cookies load, full stop
• You’re a for-profit business selling into enterprise, healthcare, or financial services, where your customers’ vendor reviews will ask
• Your traffic includes residents of the twelve GPC states, which in practice means any US-facing site

You may have more room than you think if:

• You’re a nonprofit. This is the nuance most compliance blogs skip. Many state privacy laws exempt nonprofits, often keyed to 501(c)(3) status, and California’s CCPA applies only to for-profit “businesses,” so most standalone nonprofits sit outside it. But the exemption is nowhere near universal. Colorado and New Jersey have no nonprofit exemption at all. Oregon, Delaware, Maryland, and Minnesota exempt only narrow categories. And a nonprofit that shares branding and data with a for-profit affiliate can get pulled back in.

The practical takeaway: being a 501(c)(3) is a reason to ask your counsel where you stand, not a reason to skip the question.

You probably don’t need a full CMP if:

• Your site is genuinely tracker-free. No analytics beyond a privacy-first tool like Fathom or Plausible, no embedded video, no ad pixels, no third-party fonts or maps. Those sites exist. They are rarer than people assume, which is why the scan in step one is so useful.

The ones you’ll run into most often

There are dozens of these. In practice, most of our clients end up looking at one of these six:

• Complianz. A WordPress plugin with a free core version, self-hosted, so consent records stay in your own database. Good fit for a small nonprofit site with a handful of tags and no budget line for compliance software.
• CookieYes. The most common starting point we see. Lightweight WordPress plugin, fast to configure, roughly $10 to $55 per month depending on traffic. Popular with small teams that want something running this week.
• Cookiebot. Strong automated scanning, which matters if nobody is entirely sure what’s on the site. Plans run roughly $34 to $96 per month. Note that it bills each subdomain separately, which catches people off guard.
• Osano. Sits between the simple plugins and the enterprise suites. Built around US multi-state coverage specifically, so it handles the GPC and state-law patchwork well. Free tier covers one domain and a small visitor count; above that it moves to a quote.
• Termly and iubenda. Both bundle the banner with generated legal documents (privacy policy, cookie policy, terms). Worth a look if you’re building the privacy policy at the same time and don’t have counsel drafting it.
• OneTrust. The enterprise answer. If your legal or security team already licenses it for the rest of the organization, use it. It’s quote-only, and contracts commonly start around $10,000 a year, so it’s rarely the right call for a single marketing site.

If your legal team or IT department already has a preferred vendor, that decision is made. Go with theirs.

Who does what

The question we get right after “do we need one” is always “how long would it take?” The answer depends a lot on how the work splits up, so here’s how we usually divide it.

Your team owns the tags and the account. This mirrors how we handle analytics generally. We’ll place a Google Analytics tag, but we don’t set up your goals, build your pixel audiences, or decide what gets measured. Consent works the same way. Choosing the platform, setting up the account, running the cookie scan, sorting each tracker into the right category, writing the category descriptions, and wiring your tags to fire on consent states inside Google Tag Manager all sit with whoever owns your marketing stack. That’s frequently your in-house marketing team or your analytics and paid media agency, since they’re the ones who know which pixels are load-bearing for which campaign.

There’s a good reason to keep it there beyond scope. Categorizing a tracker is a compliance judgment, not a technical one. Whether your CRM chat widget counts as strictly necessary or as marketing is a question for the people who own your privacy policy, and it shouldn’t be answered by your web developer guessing.

We own the placement and the front end. Getting the CMP script loading correctly and early enough site-wide, making sure it doesn’t collide with caching or your existing plugins, styling the banner and preference center so they look like your brand instead of a default gray box, keeping the persistent “manage preferences” link in the footer, and checking that the whole thing is accessible and keyboard-navigable. That last part gets skipped more often than it should. A consent modal that traps focus or can’t be dismissed by keyboard is its own problem.

Then somebody has to test it. Load the site with GPC enabled in Firefox or Brave and confirm the signal actually suppresses what it’s supposed to. Decline marketing cookies and watch the network tab to confirm the pixels really don’t fire. This is a shared step, and it’s the one most likely to surface a tag nobody knew about.

For a marketing site whose tags are already consolidated in Tag Manager, the placement and styling side is typically a few days of our time. The calendar timeline depends almost entirely on your side: how fast the tag inventory gets sorted and how long legal takes with the category language. Two to four weeks end to end is a reasonable planning assumption. If your tags are hard-coded into the theme across a dozen templates rather than managed in GTM, there’s a consolidation project to do first, and we can help scope that separately.

One thing to prepare your marketing team for

When trackers are genuinely blocked until consent, some percentage of visitors will decline. Analytics traffic numbers drop. Retargeting audiences shrink. Nothing is broken, you are simply seeing the subset of people who agreed to be measured.

Decide in advance how you’ll handle that comparison so nobody panics at the next reporting meeting. Consent Mode can recover some modeled data for Google properties, and it’s worth configuring on day one rather than after the first alarmed Slack message.

Where we come in

We don’t advise on compliance strategy, and we don’t configure your tracking. We’re not the right people to tell you which state laws apply to your organization, what your risk tolerance should be, or whether a given pixel is essential to your business. Those conversations belong with your counsel and with whoever runs your marketing stack.

What we do is the web side: placing the consent code so it loads correctly and early, making the banner and preference center look like your brand, keeping it accessible, and making sure it plays nicely with the rest of the site.

If you’ve just been handed a security questionnaire and you’re not sure how to answer the cookie questions, send it over. We can usually tell you within a day what your site is doing today, which is the first thing you need before you can decide what to do next.