What is a CMP and Why Do You Need it?
Websites use a consent management platform – or “CMP” – to obtain users' consent to process their personal data, which is obtained through cookies and trackers on the domain. Managing director of It Works Media, Steve Pritchard, explained how a consent management platform works in the case of a corporate website. “A CMP is used to inform visitors about the types of data they’ll collect and what they will use it for. They store visitor consent data and deal with visitors’ requests to make alterations about the data the website has collected about them, including requests to access and erase this data. It is a necessary platform for websites to meet EU regulations for data collection”.
The reason why a CMP is so useful is that it makes consent management processes smoother, easier, and more efficient. An effective and privacy-compliant CMP must have the following features:
Enable Notification of Consent Capture
In principle, all privacy regulations agree that consent must be freely given, specific, informed, and unambiguous. This implies that the data subject must at least be aware of the controller’s identity, what kind of data will be collected and processed, how it will be used, and the purpose of the processing operations. While businesses are building new capabilities into their forms, mobile apps, and websites to enable consent capture, having a solution for notification and consent capture immensely simplifies this requirement.
Proliferating and Sharing Data
Websites and businesses collect and store identifiers such as IP addresses, device IDs, location data, and cookies, which are now considered personal data. This information is shared or leaked to various advertising and marketing platforms to provide value-added services. Therefore, it is essential that platforms involved in this process notify and obtain consent from their users before collecting and processing their data. Consent propagation must be supported and managed.
Associating Given Consent to a Specific User or Identity
This is easier said than done since most businesses have personal data scattered around multiple systems or silos, with different identities for the same user in different processes and environments. An enterprise-wide view of data and identity is essential for effective consent management.
Governance
Most businesses undertook a flurry of consent capture and re-consent efforts to meet GDPR deadlines but ended up with solutions that act as static databases for consent frameworks and preferences. Without the ability to link consent to identities, consent is once again scattered around silos with multiple instances of consent for a single user. This makes opt-out and consent withdrawal decisions very difficult to implement across the organization. Therefore, operationalizing consent management is a critical requirement for consent management solutions.
While an effective CMP makes it easier for an organization to comply with its regulatory obligations, it’s important to understand that different organizations have different methodologies and by extension, different attitudes towards consent. Hence, most organizations’ needs from their CMP will be different from others in the market.
As a result, there are different CMP software solutions available in the market that cater to various specific and often, unique needs of organizations. Differences between the various options may include ease of use, price, functionalities, and overall support.
However, most CMP solutions will most likely operate in the same way. This includes:
- Consent: Secondly, the most important reason for a CMP to be deployed. Each visiting user is presented with a consent banner that informs them about the data processing activities and requests their consent;
- Integration: The first step is appropriately integrating the CMP solution within an organization’s website, mobile app, or other digital platforms where personal data is collected;
- Consent Options: An extension of the aforementioned step, users are given the choice of what type of data processing they consent to. These include different purposes such as analytics, marketing, or personalized advertising;
- Consent Management: Each user’s preference is recorded, stored, and maintained. The user can then modify their consent preferences at any time or withdraw it entirely;
- Compliance: The documentation and maintenance of users’ consent allow for compliance with data obligations by establishing an auditable trail of consent-related activities.
