Yep, you probably need a CMP (consent management platform)

Blame Europe if you like. But the need to have a CMP or consent management platform is likely going to be obvious in multiple geos all over the world in the next few years, including the United States. I was recently wondering what a CMP is and why Google is now requiring mobile publishers to implement a consent management platform.

So I chatted with Achraff-Nour Meski and Gabe Morazan from Sourcepoint in a recent Growth Masterminds podcast.

Hit play and keep scrolling …

So what is a CMP?

Sourcepoint product director Gabe Morazan answered that pretty quickly:

“A CMP is ultimately a way where you can configure and set up signals that your downstream partners, your advertising partners can look for to see if we have the appropriate consent, has the user opted out?” he says. “ And so CMPs basically help you to configure … provide templates … and support some industry frameworks like the IAB TCF.”

(TCF, by the way, is the Transparency and Consent Framework created by the IAB. Do note that the TCF has been controversial among privacy groups, resulting in lawsuits that are not fully complete but will likely require changes in what data you collect and how it is used.)

Long story short:

It’s a way to ensure you’re privacy-compliant when deploying apps and websites. And a way to structure how you ask users for consent, manage their privacy preferences, and communicate those preferences to ad partners … while you just focus on running your app or site.

Usually, they’ll come as an SDK for your product people to implement.

And, like most platforms that handle important but non-core parts of your mobile experience, CMPs will update as the laws and regulations change so that you are the most compliant you can be, generally speaking.

What’s this about Google? Google is requiring a CMP now?

You heard that right. 

If you’re running AdSense, Ad Manager, or AdMob, you’ll need to use a Google-certified CMP. That was actually required as of January of this year, so it’s been around for a while, but there’s still some confusion about exactly what to do and who needs to do it.

It’s required, of course, only if you’re going to be serving ads in the EU and the UK. And without it, most ads won’t run on your properties.

So this is only an EU thing, right? Well …

While Google is requiring consent management platforms as a requirement to serve ads in the EU and the UK, there are definitely other places where having a CMP makes sense.

From Sourcepoint client services leader Achraff-Nour Meski:

“The short answer is wherever the law framework exists to regulate the use of personal information you would need to have a CMP regardless of which industry standard you’re using,” he says. “Could be TCF in Europe, could be non-TCF in Europe, could be … CCP in California, GPP across different states,  whatever there is a framework protecting the user of personal data.”

(GPP is Global Privacy Platform, another IAB protocol.)

Consent fatigue (CMPs are working on it)

One question I asked: what about consent fatigue? 

We’re all tired — I assume — of endlessly making choices on millions of websites for which cookies to eat: all, none, or just essential ones. GDPR has blessed us with that one, and the kind of in-app consent that Google is now requiring is yet another burden.

At some point, there has to be some way of setting up your own global preferences for what you’ll allow and what you won’t, communicating those to your computing devices (of all sizes and form factors) and automating the process.

CMPs are working on that, apparently.

“Brands are starting to look. consistently across all of our apps or websites, how do we streamline this experience so that if you as a user say yes or no, then next time you log in, we’re not gonna ask you,” Morazan says. “We call this authenticated consent. You see this with a lot of CMP platforms out there where they’re tying a consent record to the known user. And so if I log into your website and then I go to my connected TV to look at your content, they already know, well, hey, Gabe is registered … you know their preference.”

I can’t help but think this will require a platform presence, however, from an Apple or a Google, a global personal privacy policy that your computer or phone enforces across all your apps and browsers. Truly smart ones would also indicate things that would change, over time, indicating what types of products or services I’m in the market for … essentially an ecosystem-level Privacy Sandbox-like implementation of Topics API.

But that’s probably just a pipe dream.

Check out the full show …

Check out the full show for much more, including:

• 00:00 Introduction to Privacy and Consent Management 
• 00:36 Understanding Google’s New Consent Management Platform Requirement 
• 00:51 Expert Insights: The Role and Functionality of CMPs 
• 04:53 Customizing Consent Messages for User Experience 
• 09:09 Global Privacy Control: Simplifying Consent Across Platforms 
• 15:16 The Future of Privacy and Consent Management 
• 18:37 Closing Thoughts and Acknowledgements

Find Growth Masterminds wherever podcasts are distributed, or on YouTube.