What is Consent management?
Consent management is more than the banner on the first visit. It covers three things: collecting consent, storing it in an auditable way including the timestamp and the version of the text shown, and enforcing it technically - meaning a rejected script genuinely does not load. The software for this is called a consent management platform, or CMP. But that is only the tool: deciding which purposes you offer at all is a question of data strategy.
Legally the obligation attaches to access to the device, not to the domain. In Germany that is section 25(1) TDDDG, in Austria section 165(3) TKG 2021, both deriving from Article 5(3) of the ePrivacy Directive. Without consent, only what is strictly necessary for the explicitly requested service is permitted. Your own analytics script on your own domain does not qualify - `first-party` is a description, not a permission.
The second part is purpose limitation under Article 5(1)(b) GDPR: consent applies to the purpose it was collected for. Addresses gathered to fulfil an order are not a newsletter base, and certainly not training material. In practice this means your usable data volume is not the row count in the system, but the share of it covered for exactly the purpose you have in mind.
Why does Consent management matter?
The consent rate is the multiplier every later piece of data work hangs on, and it cannot be derived from benchmarks. Consent platform Didomi reports figures for 2026 ranging from 75.1 per cent (Western Europe) to 89.3 per cent (Eastern Europe). If region alone moves the number by 18 points, industry, banner design and traffic source move it at least as much. The only dependable figure sits in your own consent log, and it belongs per purpose rather than overall.
Consent management in practice
- 01A service firm measures its consent rate per purpose and finds statistics at 71 per cent and marketing at 38 - the personalisation plans for next quarter rested on the wrong number.
- 02After a relaunch an analytics script loads despite rejection, because it sits hard-coded in the template rather than in the tag manager. The banner was correct, the enforcement was not.
- 03A newsletter import from the shop is stopped because the addresses were collected to fulfil orders. Consent for advertising is missing and cannot be assumed retrospectively.
From the journal
- Website privacy: the three points that actually matterThe cookie banner is the visible part and the one with the smaller ceiling. An ordinary page loads a median of 79 third-party requests, 25 European supervisory authorities are checking transparency obligations in a coordinated action through 2026, and the legal basis for US tools rests on a decision now under appeal. The three points that matter, with the provisions you can look up.
- First-party data: what it is actually worthIn 2025 Google called off the cookie deprecation and then retired the replacement project. That removes the reason most companies built first-party data in the first place. The value is still there, but it sits somewhere else: in consent, in resolvability and in recency. Here is the calculation.
