Google-certified CMPs

The certified list, as Google publishes it

Google’s list has three columns: the CMP’s name, its TCF CMP ID (in Google’s words, “the unique identifier assigned to a TCF-validated CMP by the IAB”) and the platform, meaning “the environments in which the CMP offers support and in which Google has certified the CMP.” We copied all 143 rows in Google’s order and spelling. Names marked “(Private)” are a publisher’s own CMP: the IAB’s framework rules define a private CMP as “a Publisher that implements its own CMP for its own purposes”, so you cannot sign up for one.

If you are choosing a banner rather than checking one, our consent management platform comparison measures several of the listed platforms against the consent and opt-out rules row by row.

Every “Open the record” link goes to Google’s own list, the only record of certification. We do not link to the vendors from this table.

What certification means, in Google’s words

The list exists because of one ads rule. Publishers using Google AdSense, Ad Manager or AdMob must use a Google-certified CMP integrated with the IAB’s Transparency and Consent Framework (TCF) to serve personalised ads to users in the EEA and UK from 16 January 2024, and in Switzerland from 31 July 2024.

So a listing answers one narrow question: did this CMP meet Google’s certification criteria, which Google says focus on TCF compliance, in the environments named in the platform column? Google adds that its assessments check that CMPs supporting its Additional Consent specification (for ad tech providers not registered with the TCF) do so correctly. It does not say the banner’s wording is fair, that its reject button is as easy as its accept button, or that your site’s consent is valid. Those are the questions our cookie banner checklist walks through.

What happens to traffic without one

In short: without a certified CMP you can still earn from those visitors, but only on non-personalised or limited ads where Google supports them. Google’s page also tells publishers to “review the list of certified CMPs and decide which CMP is most suitable for them taking into account the location of their traffic and the functionality offered by each CMP.” Google does not recommend one.

The duties a certified CMP does not take off you

Certification sits under Google’s EU user consent policy, and that policy’s duties sit with the publisher whose Google agreement includes it. For users in the EEA, the UK and Switzerland it requires you to:

• obtain “legally valid consent” to cookies or other local storage where legally required, and to the use of personal data for ad personalisation;
• “retain records of consent given by end users”;
• give “clear instructions for revocation of consent”;
• identify each party that may collect, receive or use users’ personal data through your use of a Google product.

A CMP is the tool you meet those duties with; picking a listed one does not meet them for you. Whether the GDPR reaches a site run from outside the EU at all is a separate question, covered in does GDPR apply to US companies.

Checking a CMP against the list

1. Find the exact entry on Google’s list, not a badge on the vendor’s site. Some entries carry a company name and some a product name (“Onetrust / Cookiepro CMP”, “Real Cookie Banner CMP”), so search for both.
2. Match the TCF CMP ID. Ask the vendor which CMP ID your banner will send and check it is the ID on the list. Under the IAB’s rules, a publisher that customises a commercial CMP in ways that may affect compliance must register a private CMP ID of its own; if that is you, ask your vendor and your Google contact how that ID is treated.
3. Read the platform column against where you show ads. A CMP certified for web only does not cover your app; for connected TV, look for CTV in the column.
4. Check again before you renew. Google updates the list weekly, so a CMP can be added after you read this page. The list does not say why an entry is missing; ask the CMP whether it intends to be certified, as Google suggests.
5. Then check the banner itself. The listing does not check wording, button parity or region rules. The cookie banner examples show what regulators accept and object to.

Weighing a switch from one of the two most common banners? Our Cookiebot alternatives and CookieYes alternatives pages compare only platforms on this list, and Termly vs iubenda sets two listed ones head to head.

Questions