What is Consent management?
Consent management is more than the banner on the first visit. It covers three things: collecting consent, storing it in an auditable way including the timestamp and the version of the text shown, and enforcing it technically - meaning a rejected script genuinely does not load. The software for this is called a consent management platform, or CMP. But that is only the tool: deciding which purposes you offer at all is a question of data strategy.
Legally the obligation attaches to access to the device, not to the domain. In Germany that is section 25(1) TDDDG, in Austria section 165(3) TKG 2021, both deriving from Article 5(3) of the ePrivacy Directive. Without consent, only what is strictly necessary for the explicitly requested service is permitted. Your own analytics script on your own domain does not qualify - `first-party` is a description, not a permission.
The second part is purpose limitation under Article 5(1)(b) GDPR: consent applies to the purpose it was collected for. Addresses gathered to fulfil an order are not a newsletter base, and certainly not training material. In practice this means your usable data volume is not the row count in the system, but the share of it covered for exactly the purpose you have in mind.
Why does Consent management matter?
The consent rate is the multiplier every later piece of data work hangs on, and it cannot be derived from benchmarks. Consent platform Didomi reports figures for 2026 ranging from 75.1 per cent (Western Europe) to 89.3 per cent (Eastern Europe). If region alone moves the number by 18 points, industry, banner design and traffic source move it at least as much. The only dependable figure sits in your own consent log, and it belongs per purpose rather than overall.
Consent management in practice
- 01A service firm measures its consent rate per purpose and finds statistics at 71 per cent and marketing at 38 - the personalisation plans for next quarter rested on the wrong number.
- 02After a relaunch an analytics script loads despite rejection, because it sits hard-coded in the template rather than in the tag manager. The banner was correct, the enforcement was not.
- 03A newsletter import from the shop is stopped because the addresses were collected to fulfil orders. Consent for advertising is missing and cannot be assumed retrospectively.
