5 Red Flags in a CMP Implementation

No matter how thorough your evaluation process is, deciding on a given software solution can be like taking a leap of faith. There’s just no way to really know what it’ll be like until you actually get your hands on the solution and start implementing it. 

Ostensibly sleek and modern solutions can, in reality, be a jumbled mess once you start putting them to work. And “jumbled mess” isn’t something you ever want to associate with your consent management platform (CMP). Software in this category is meant to keep you compliant with the law—and obeying the law shouldn’t be hard or complex. 

Still, there are plenty of CMPs that are difficult to implement, leaving users frustrated with the time and cost and uncertain about their compliance. We’ve identified 5 red flags that businesses can look out for to avoid the CMPs that make compliance harder than it has to be. 

Red flags to watch out for in a CMP implementation 

1. You need to outsource implementation to third-party shops 

Once you’ve purchased a solution, you shouldn’t have to pay more for the privilege of having it actually function. 

There are numerous CMPs out there that are so complex, a small ecosystem of third-party vendors exists solely to implement it. This raises several questions that should have you scrutinizing the CMP vendor more thoroughly: 

• If the product is so complex that it requires third-party implementation specialists, is it delivering commensurate value for your business? For most organizations, privacy compliance is part of the cost of doing business, and the additional fees incurred by a product of this complexity far outweigh any benefits. 

• If the CMP vendor can’t put the effort in to ensuring that customers can actually use their product with minimal effort, then how likely are they to have put in the effort elsewhere? Will the product’s core capabilities be equally complex to use? What about their dedication to supporting your business when technical issues inevitably arise? 
• When the regulatory environment, your business, your tech stack, or your website changes, who is going to make the corresponding changes to your CMP? Is it so complex that you’ll need to hire that third-party implementation vendor again? If so, then you can expect to be paying for this product in numerous ways above and beyond the subscription fee. 
  

2. The CMP requires you to get into the weeds with your codebase and/or tag manager 

This sort of implementation work is part of the reasons why third-party specialists exist. CMPs that require you to mess around with your website code or tag manager directly needlessly increase complexity. With this approach, you’ll need to carry out tasks like: 

• Identifying tracking scripts or tags. 

• Individually wrapping code around them.  
• Identifying the right order for tags to fire or not fire without breaking your site.  
• Classifying different scripts and tags so they can comply with different mechanics of different laws (e.g., identifying essential, marketing, personalization, or analytics tags). 
• Doing this every time a new script or tag is added to your codebase. 

Considering that many businesses have dozens or hundreds of different data tracking scripts on their website, this work can become prohibitively tedious very quickly. Even businesses with full-time privacy professionals on staff are better served by having those privacy professionals work on internal compliance education, developing a well-designed privacy program, and delivering on other compliance requirements than spending all of their time fiddling with Google Tag Manager. 

3. It forces you to DIY your banners 

CMPs are meant to keep you in compliance with cookie consent laws—one would think that would include the consent banner requirements described by those laws. Many CMPs, however, are still leaving cookie banner design and management up to the end user. 

While CMPs will often include template banners, they leave the actual implementation of those banners up to you. That means you need to understand the different requirements of the different jurisdictions in which your business operates, keep tabs on whether those requirements have changed, and evaluate whether your banner design is actually compliant. 

For instance, many jurisdictions have prohibitions against the use of dark patterns (i.e., manipulative design practices) in consent banners. This can be as subtle as using a different color for the “reject cookies” button than the “accept cookies” button.  

In an ideal world, your CMP will automatically deploy compliant banners based on jurisdiction, and they’ll own the process of updating those banners. Some CMPs even give you the ability to design and customize your banner but put guardrails in place so you don’t accidentally become noncompliant.  

4. It scans for data trackers in an opaque fashion 

If somebody were to ask you how many data trackers are active on your website, would you be able to tell them immediately? Even the most privacy-savvy professional would struggle to do so. But they wouldn’t struggle with explaining why being able to find the answer quickly is important. 

When you don’t know what’s collecting data on your website, what’s happening to that data after collection, and where it’s going, you can’t be in compliance with data privacy regulations. You also can’t pinpoint problematic vendors whose data trackers are collecting in excess, and you can’t be certain whether the rest of the organization is adding whatever they want to the website or whether they’re adhering to data privacy best practices. 

Some CMPs fail to acknowledge this awareness gap and lack transparency into their data tracker scanning process. They may not alert you when new data trackers are discovered on the website, and they may only scan for data trackers once every few weeks or once a month, allowing potentially noncompliant data trackers to be introduced on the website in the interim. 

5. It charges for support 

Support should be baked into the price tag of your subscription. If it costs extra to get better support, or if support is billed on a usage basis, then the CMP vendor is incentivized to keep their product complex and to address problems with brittle solutions. 

It also signals a lack of concern for you as a customer. Usage-based billing for support is a tactic to discourage excessive support requests—which is exactly what a company that sells a troublesome CMP might experience. 

But it's not all bad 

While there are some CMP vendors out there with unnecessarily challenging implementations, the technology in this space is getting better and better as regulations standardize and consumer needs are better understood. There is still a great deal of variety in CMPs, however, and the subscription price isn’t always commensurate with quality. 

Armed with the red flags identified in this article, you’ll be in a good position to find a solution that truly solves your compliance problems—without introducing a whole new set of problems. 

If you’re in the process of evaluating CMPs, you’ll also benefit from reviewing Osano’s CMP Scorecard. This template provides a place for you to score different CMPs you’re considering and points you in the direction of key questions to asks in order to effectively evaluate the quality of a given CMP.  

We hope it helps! Once you’re ready, feel free to schedule a demo of the Osano CMP—we’re excited to see how we can help you resolve your compliance pains (without introducing any new pains during the implementation process).