Consent Management Platform (CMP)

A consent management platform (CMP) is software that asks people for permission to use their personal data, stores the choices they make and passes those choices on to the systems that use the data. The best-known CMPs are the cookie banners on websites, which let visitors accept or refuse tracking for analytics and advertising. In financial services the term also covers the tools banks and fintechs use to manage permissions for data sharing, such as consent for a third party to read account data under open banking.

CMPs exist because data protection and privacy laws, led by the EU's General Data Protection Regulation (GDPR) and the ePrivacy Directive (2002/58/EC), require many kinds of processing to rest on valid consent that is freely given, specific, informed and as easy to withdraw as to give. A CMP is a means of meeting those duties, not a legal basis in itself, and a badly designed one can create rather than reduce legal risk.

Think of the guest list kept by a doorman at a private event. The host decides who may come in, and the doorman writes down each decision, checks the list at the door and crosses names off if the host changes their mind. Anyone who later asks "who said this person could enter?" can see the record.

A CMP is that doorman for personal data. When you visit a website or connect an app to your bank account, it asks what you are willing to share and with whom. It writes down your answer, tells the other systems, such as advertisers or a budgeting app, what they may and may not do, and updates the record if you change your mind. If a regulator later asks whether you agreed, the record is there to show it.

• Collects choices. It shows a notice or dashboard explaining each purpose and lets the person accept, refuse or choose per purpose.
• Records evidence. It stores who agreed to what, when, through which wording and version, so the firm can demonstrate consent as GDPR requires.
• Signals downstream. It passes choices to tags, analytics tools, advertising partners or internal systems, which should act only within them.
• Handles withdrawal and expiry. It lets people change their minds and enforces time limits, after which consent must be renewed.
• Supports audits. It produces reports for data protection officers, auditors and regulators.

In online advertising, many CMPs follow IAB Europe's Transparency and Consent Framework (TCF), which encodes a user's choices in a "TC string" that is passed to ad-tech vendors. The framework has faced legal challenge. In a judgment of 7 March 2024 (Case C-604/22, IAB Europe), the Court of Justice of the EU held that a TC string can be personal data when it can be linked to an identifier such as an IP address, and that IAB Europe can be a joint controller for that processing. European data protection authorities have also criticised banners that make refusing harder than accepting, so many now require a "reject all" option on the first screen. Banks and payment firms use these CMPs on their public websites like any other business.

Financial data sharing adds a second, sector-specific layer. Under PSD2, an account information service provider (AISP) needs the customer's explicit consent, and the customer then authenticates with their bank, which issues access tokens through its open banking API. Banks and providers keep consent records and often offer dashboards where customers can see and revoke access; the UK open banking standards include such access dashboards for banks and third parties. Similar consent journeys apply to payment initiation and to wider open finance schemes.

India has built consent management into its infrastructure. Under the Reserve Bank of India's Account Aggregator framework, licensed account aggregators act as consent managers that pass encrypted financial data between institutions only on the customer's electronic consent, without being able to read it themselves. India's Digital Personal Data Protection Act, 2023 also creates registered "consent managers" as a category of intermediary. In the United States, the Consumer Financial Protection Bureau's personal financial data rights rule under section 1033 of the Dodd-Frank Act sets authorisation and revocation requirements for third parties, though its timing has been subject to litigation and reconsideration.

Consent records in finance often have to be kept alongside other evidence, so firms align their CMP with their data retention schedule. Aggregators that pull data from many accounts, a practice known as financial data aggregation, rely heavily on clean consent records to show each data pull was authorised.

• Consent fatigue. People click "accept" to get rid of banners, which weakens the idea of informed choice.
• Dark patterns. Colour, wording and layout can push people towards sharing, which regulators treat as invalid consent.
• Consent is not always the right basis. Much processing in banking rests on legal obligation or contract, such as KYC checks; asking for consent where it is not needed, or cannot be freely refused, confuses customers.
• Enforcement gaps. A CMP records a choice, but it cannot by itself stop a downstream partner from ignoring it; contracts, audits and technical controls such as access control are still needed.

• European Data Protection Board
• IAB Europe
• Consumer Financial Protection Bureau