What Is a CMP? And When a Free One Is Enough

The four jobs a consent management platform does.

A CMP — consent management platform — is the machinery between privacy law and your website: it asks visitors for consent, blocks non-essential cookies and scripts until they answer, remembers the choice, and keeps evidence. Free tiers, ours included, genuinely cover the simplest cases — one site, one exact domain, the default banner — and stop exactly where business needs begin.

CMP is one of those acronyms that gets used long before it gets explained. This is the explainer — what the category of software actually does — followed by the question everyone researching it is really asking, answered more honestly than category vendors usually manage: do you need to pay for one?

What a CMP actually does

Four jobs, and all four matter. It asks: the banner, presenting a real choice with rejecting as easy as accepting. It enforces: holding non-essential cookies and scripts until the visitor consents. This is the part visitors never see and the part regulators test, because a banner that doesn't block trackers isn't compliant, however it looks. It remembers: the choice persists (in our case in a first-party cookie) so the visitor is not re-prompted every page. And it proves: consent records that let you demonstrate, later, who consented to what and when — the accountability half of consent law. Tools that only do the first job are banner generators, not CMPs; the legal weight is carried by the other three.

Do you need one at all?

If your site sets only strictly necessary cookies — a genuinely static site, no analytics, no embeds — you may need nothing. Almost nobody is actually in that category once a scan runs: an embedded video, a font service, one marketing pixel, and you are in consent territory. The way to know is not to guess but to scan and look, knowing what a scanner can and cannot find. Our guide to whether you need a banner at all walks through the UK rules; from there the question becomes which CMP, and whether free is enough.

What our free tier actually includes, and its real limits

Cookie Control Community is free and it is a real CMP: the banner, consent-gated loading of your scripts through category callbacks, the consent choice remembered, the GDPR (UK and EU) and CCPA compliance modes, and the same WCAG 2.2 AA accessibility standard as the paid tiers. The limits are equally real, and stated on the pricing page rather than discovered at checkout. It covers a single domain matched exactly as registered — www and bare are different registrations — with no subdomain coverage. And the business-grade capabilities sit above it: the cookie scanner, custom branding of the banner, geolocation, multilingual banners, and the consent-record dashboard are paid features.

What the free Cookie Control tier includes and where the paid tiers begin.

So when is free genuinely enough?

• A personal site, portfolio or small brochure site on one domain, happy with the default banner appearance, whose owner will check what it sets manually — Community was built for exactly this, and using it costs you nothing.
• A hobby project with analytics: still fine — configure the category honestly and the free tier enforces it.
• The dividing line is capability, and it tends to arrive all at once: a scanner because manual checking stopped being realistic, branding because the default banner sits oddly on a designed site, subdomains because the shop moved to shop.example.com, a dashboard because someone asked you to prove your consent rate.

That boundary is why our paid tiers are a flat per-domain price — from £45 + VAT a year for PRO on the current edition, and from £75 + VAT a year for Premium — with unlimited page views on every tier. We would rather state the free tier’s limits plainly and let the upgrade happen when it is genuinely due than blur the line and harvest surprise upgrades.

Choosing beyond free: three questions

1. Does it enforce, or just display? Ask any vendor how blocking works pre-consent, and test it in devtools. Check too what it does about the third-party cookies it cannot delete — an honest vendor tells you.
2. What does proving consent look like? If the answer is vague, the fourth job is not being done. Ask for the list of fields in a consent record.
3. What does the price do as you grow? Flat per-domain and traffic-based models age very differently: a flat price per domain does not change when a campaign triples your visits.