Consent Mode25 July 2026·6 min read

Google-certified doesn't mean compliant: how to actually choose a CMP

Certification tests whether a CMP product can pass consent signals — not whether your installation does. The published research says almost nobody's does.

DeBy Denis · Perfmetrix

Short answer: the CMP you choose matters far less than how it's configured, and no certification tests configuration. Google's CMP Partner Programme certifies that a product is capable of passing Consent Mode v2 signals correctly. It does not audit your live site. Pick on integration fit and support, then verify behaviour yourself — because the published research shows the overwhelming majority of installations don't enforce what the banner promises.

If you're comparing CMPs on feature tables right now, you're optimising the variable that matters least.

What certification actually certifies

Google maintains a public directory of certified CMP partners at cmppartnerprogram.withgoogle.com, tiered Gold / Silver / Bronze. As of July 2026 it lists roughly 61 partners. Gold tier includes Cookiebot, Usercentrics, OneTrust, Didomi, CookieYes, iubenda, Complianz, Axeptio, Termly, CookieHub, Cookie Information, Enzuzo and TrustArc. Silver includes Osano, Sourcepoint, Ketch and Crownpeak.

Being on that list means the vendor has attested that their product supports the required consent signals — including ad_user_data and ad_personalization — and integrates with Google's tag ecosystem.

What it does not mean:

That your specific installation passes those signals.
That tags on your site actually wait for consent.
That the CMP was ever connected to your GTM container.
That anyone has loaded your site and checked.

Certification is a specification test, not a runtime audit. That distinction is the entire gap between "we bought a compliant CMP" and "we are compliant."

The research is brutal about the difference

Two independent academic studies published recently make the size of that gap measurable.

ConsentChk (arXiv 2506.08996) analysed 1,793 websites across eight jurisdictions including the UK and Ireland. It found that 96.18% of EU-facing sites had at least one consent violation — and that only 3.82% correctly enforced user preferences. The paper names OneTrust, Cookiebot and CookiePro among the platforms observed, but reports no per-CMP breakdown, which is itself telling: the failures weren't concentrated in one vendor.

A larger longitudinal study (arXiv 2606.31485) looked at 11,364 sites across 30 EEA countries from 2018 to 2024, covering 18 CMPs. It does break results out by vendor, and found compliance rates in 2024 of 55.16% for Cookiebot and 49.19% for OneTrust — the two largest platforms by market share. Read that carefully before treating it as a league table, though: this study measured whether a reject-all button was present, which is a much weaker test than whether tags actually blocked.

So the strongest per-vendor data available measures the easiest possible criterion, and even on that criterion the market leaders sit around a coin flip.

There is no published study measuring, per CMP, whether tags actually stay blocked before consent and whether Consent Mode v2 signals fire correctly. Everyone comparing CMPs is comparing feature lists and pricing, because the behavioural data doesn't exist publicly. Treat any vendor claim about real-world enforcement rates as marketing until someone shows you the method.

Our own data says the same thing

When we scanned private UK clinic sites for our consent benchmark, the finding wasn't that non-compliant businesses lacked a CMP. It was the opposite:

37%fired Google trackers before consent 100%of violators already had a CMP

0had Consent Mode v2 configured

Every single site leaking data pre-consent had already bought a Consent Management Platform. The banner was installed. It rendered. It just wasn't wired to anything. Not one site in the sample had Consent Mode v2 signals in place, regardless of which vendor they'd chosen.

That's the pattern in miniature: the purchase decision was made, the box was ticked, and the actual enforcement was never verified by anyone.

What we've seen

We ran a pilot in July 2026 that scanned twenty of the certified vendors' own websites, on the theory that if certification predicted behaviour anywhere, it would predict it there. Seven came back red.

We're not publishing that as a headline number, because when we looked at the seven, four were cases where our scanner couldn't detect the consent layer at all — its fingerprint list didn't cover those vendors, so it reported "no CMP" for sites that plainly had one. The true figure is lower than seven and we don't yet know by how much.

We're telling you this partly because it's the same failure we find on client sites every week: a tool reports a clean result because it can't see the thing it's measuring. That's the argument for reading the method section of any consent study, including ours.

Why the CMP is rarely the failure point

The common failure mode is architectural, not a product defect.

Most CMPs block cookies by rewriting script tags in the page. But if your tags load through Google Tag Manager, GTM injects them dynamically after the CMP has already scanned the DOM. The CMP never sees them, so it never blocks them. The banner appears, the user declines, and Google Analytics fires anyway — with a fully functioning, correctly installed, certified CMP on the page.

We wrote up that specific failure in detail for one vendor in Cookiebot is installed but tags still fire before consent, but it is not a Cookiebot problem. It's what happens whenever auto-blocking meets a tag manager, on any platform.

The other frequent cause is simply that Consent Mode was never configured. The CMP has a toggle for it. Somebody had to turn it on and wire the default state. Often nobody did.

What to actually evaluate

Since certification and feature tables won't tell you what you need, here's what does. These are the questions we ask when scoping a consent build:

Does it integrate with your tag manager properly? If tags fire via GTM, you need a CMP with a real GTM template and consent-state integration — not just script-tag rewriting. This single question eliminates more candidates than any pricing comparison.
Does it set Consent Mode v2 defaults before any tag loads? The gtag('consent','default', …) call must run before the GTM container, with ad_user_data and ad_personalization included. Ask to see it in a live implementation, not a docs page.
Does it handle your actual regulatory scope? UK-only, EEA, US state laws and TCF requirements are genuinely different problems. A CMP that's excellent for a UK SMB may be the wrong tool for a multi-jurisdiction publisher, and vice versa.
What happens when the user declines? Load the site, decline, and watch the network tab. This is the test that matters and it takes two minutes.
Who will own the configuration? The most expensive CMP configured by nobody performs worse than the cheapest one configured properly.

Notice that only one of those is about the product. The rest are about your stack and your team.

Whatever CMP you're on or considering, the fastest way to know where you stand is to measure it. The Consent Mode v2 detector reports whether the v2 signals are actually present on your live site, and the cookie & tracker scanner shows exactly what fires before anyone clicks Accept.

The honest recommendation

For most UK SMBs and mid-market advertisers, the mainstream certified CMPs are all capable of doing the job. Choose on integration fit with your tag manager, on support quality, and on whether the pricing model survives your traffic. Then spend the money you saved arguing about vendors on making sure the thing is wired correctly.

Because the failure mode in this market isn't buying the wrong CMP. It's buying a perfectly good one and never checking whether it does anything. If you want that checked properly — and the tag-manager integration built so auto-blocking actually works — that's what we do.

Sources

1.Google — CMP Partner Programme directory · Checked 2026-07-25
2.Google — Consent Mode for CMP providers (technical requirements) · Checked 2026-07-25
3.ConsentChk: 1,793 sites across eight jurisdictions — 3.82% correctly enforce user preferences · 2025
4.Longitudinal CMP study: 11,364 sites, 30 EEA countries, 18 CMPs, 2018–2024 (reject-all button presence) · 2026
5.Perfmetrix — UK private clinic consent benchmark (our own scan data) · 2026-07-08