What is a consent management platform?
Learn what a consent management platform does on your website, what it does not do, and how to pick one that suits an Australian business.
By the Savira teamPublished Last reviewed 5 min read
Most small business websites run more tracking than their owners realise, from analytics to ad pixels to embedded maps and booking widgets. So what is a consent management platform? It is software that shows visitors a cookie banner, holds back tracking tools until they make a choice, and keeps a record of that choice so you can show what happened.
That makes a consent management platform (CMP) the working part behind your banner, not just the banner itself. This guide covers what a CMP does, what it leaves to you, and what to look for if you run an Australian business.
What is a consent management platform?
A consent management platform is a tool that sits between your website and the tracking scripts on it, and only lets those scripts run once a visitor has made a choice. A script is a small piece of code, like Google Analytics or a Meta pixel, that loads on your page and often sends information about the visitor somewhere else.
Without a CMP, those scripts usually fire the moment someone lands on your site. A banner that says “we use cookies” while the tracking has already started is decoration. The CMP is what connects the visitor’s choice to what actually loads.
What does a consent management platform do?
A good CMP handles the whole consent cycle on your website, from the first visit to a change of mind months later. In practice that means:
Shows a banner. Visitors see a short, plain explanation of what your site uses and get a real choice.
Holds back tracking until a choice is made. Analytics, advertising and other non-essential scripts wait until the visitor says yes.
Sorts tools into groups. Visitors can usually allow some categories, like analytics, and refuse others, like advertising.
Keeps consent records. Each choice is logged with what was shown and when, so you have consent records to point to if a customer or client asks.
Lets people change their mind. A visitor can reopen their settings and withdraw or change consent later.
Keeps track of what is on your site. Many CMPs scan your pages and list the cookies and scripts they find, which is often an eye opener.
What does a consent management platform not do?
A CMP manages consent on your website. It does not take care of your wider privacy obligations, and it is worth being clear about that before you buy one.
It does not write your privacy policy for you. Your policy still has to describe your actual business. Here is what your privacy policy has to include.
It does not cover information collected offline. Forms at your counter, phone calls and paper intake sheets sit outside it.
It cannot control scripts it does not know about. If a tool is hard coded into your site outside the CMP, it may still fire before consent. Test after set-up.
It is not legal advice. A CMP is a tool. Whether your settings suit your business is still your call.
Do Australian businesses need a consent management platform?
There is no Australian rule that says you must use a consent management platform. What matters is whether the Privacy Act 1988 (Cth) covers your business, and if it does, how your website collects and uses personal information, including through tracking tools.
Not every small business is covered, so start by checking whether the Privacy Act applies to your small business. If it does, tracking tools that collect information about identifiable people are part of the picture, and a CMP is one practical way to give visitors a say. For the banner question specifically, see do you need a cookie banner in Australia.
Customer expectations point the same way. In the OAIC’s Australian Community Attitudes to Privacy Survey 2026, 65% of people said sharing their information rarely or never feels like a real choice. A clear banner that actually works is one way to change that on your own site.
Health and allied health businesses should take extra care, because tracking on health pages can touch sensitive information. Read tracking pixels and your privacy obligations before adding any ad pixel to a clinic or pharmacy site.
How to choose a consent management platform in Australia
Choose a CMP that fits Australian privacy law and your actual website, not just the one with the biggest marketing budget. Most well known tools were built for the European GDPR first, which brings settings and wording that may not suit an Australian small business. Check these before you sign up:
Built with Australian law in mind. Look for references to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), not only GDPR.
It really blocks scripts. Ask how tools are held back before consent, then check for yourself. A free website privacy scanner shows what loads on your pages.
Consent records you can get at. You should be able to view and export who consented to what, and when.
Works with your website. If you run WordPress, look for a proper plugin, such as a WordPress cookie consent plugin, rather than a script you paste in and hope for the best.
Plain, editable wording. You should be able to write your banner in language your customers understand.
Where records are stored. Ask which country consent records are kept in. If information goes overseas, your privacy policy needs to say so.
Pricing that matches your size. Check how plans scale as your traffic grows. Compare options on the pricing page of any tool you consider, including ours.
Where Savira fits
Savira is an Australian consent management platform for small and growing businesses: cookie consent, consent records and privacy policies built for the Privacy Act 1988 and the Australian Privacy Principles.
If you want to see how that works in practice, the Savira cookie consent page explains the banner, script blocking and consent records in more detail.
The community attitudes figure in this article comes from the OAIC Australian Community Attitudes to Privacy Survey 2026 infographic.
This is general information, not legal advice. Every business handles information a bit differently, so if you’re not sure how this applies to yours, it’s worth checking with a lawyer or privacy adviser.
What does CMP stand for?
Is a consent management platform the same as a cookie banner?
Is a consent management platform the same as a cookie banner?
Not quite: the banner is the part visitors see, while the consent management platform is what makes their choice count. A banner on its own can display a message while tracking still runs in the background. A CMP connects the choice to what actually loads, and records it.
Does the Privacy Act require a consent management platform?
No, the Privacy Act 1988 (Cth) does not name consent management platforms or require a particular tool. If the Act covers your business, it does care about how you collect and use personal information, which can include tracking on your website. A CMP is one practical way to give visitors a real choice.
Can I build my own cookie banner instead?
You can, but a home made banner often shows a message without actually stopping scripts from loading. You would also need to store consent records and handle people changing their mind. If you go this way, test that tracking stays off until a visitor says yes.
Will a consent management platform cover all my privacy obligations?
No, a consent management platform only manages consent on your website. Your privacy policy, collection notices, information you take in person or by phone, and how you store and secure data all sit outside it. Treat a CMP as one useful tool, not the whole job.