<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-consent-management-platforms
description: >-
  Implement and audit Consent Management Platforms (CMPs) to collect, store,
  and enforce user consent preferences across web and mobile properties in
  compliance with GDPR Art. 7, ePrivacy Directive, and CCPA opt-out requirements.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - consent
  - cmp
  - gdpr
  - ccpa
  - eprivacy
  - tcf
  - iab
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Implementing Consent Management Platforms

## Overview

Consent Management Platforms (CMPs) are the operational backbone of lawful data
processing under consent-based legal bases. A misconfigured CMP — silent failures,
pre-checked boxes, missing granularity — creates regulatory exposure under GDPR
Art. 7 and ePrivacy Art. 5(3). This skill covers CMP implementation, IAB TCF
integration, consent signal propagation, and compliance auditing.

Mode: `[MODE: PRIVACY]` — Consent architecture and compliance.

## Prerequisites

- Python 3.10+ with `requests`, `json` modules
- Access to CMP platform (OneTrust, Cookiebot, Didomi, or custom)
- IAB TCF v2.2 specification familiarity
- Web property access for consent banner deployment
- Tag management system (GTM, Tealium) access

## Key Concepts

### Consent Signal Flow

| Stage | Component | Standard |
|-------|-----------|----------|
| Collection | Consent banner UI | ePrivacy Art. 5(3) |
| Storage | Consent receipt database | GDPR Art. 7(1) |
| Propagation | TC String / USP String | IAB TCF v2.2 / USP |
| Enforcement | Tag firing rules | GDPR Art. 6(1)(a) |
| Audit | Consent log review | GDPR Art. 5(2) |
| Withdrawal | Preference center | GDPR Art. 7(3) |

### TCF Consent Purposes

```python
TCF_PURPOSES = {
    1: "Store and/or access information on a device",
    2: "Select basic ads",
    3: "Create a personalised ads profile",
    4: "Select personalised ads",
    7: "Measure ad performance",
    8: "Measure content performance",
    10: "Develop and improve products",
}
```

### Scanning CLI

```bash
# Audit current CMP configuration
node scripts/agent.js --action audit --url https://example.com \
  --output /tmp/cmp_audit.json

# Validate TCF consent string
node scripts/agent.js --action validate-tcf \
  --tc-string "CPy..." --output /tmp/tcf_validation.json

# Check consent propagation across tags
node scripts/agent.js --action check-propagation \
  --url https://example.com --output /tmp/propagation.json

# Generate consent receipt
node scripts/agent.js --action generate-receipt \
  --subject "user@example.com" --purposes "1,2,7" \
  --output /tmp/consent_receipt.json
```

## Workflow

### Step 1: Audit Existing Consent Mechanisms

```bash
node scripts/agent.js --action audit --url https://example.com \
  --output /tmp/cmp_audit.json
```

### Step 2: Validate TCF String Compliance

```bash
node scripts/agent.js --action validate-tcf \
  --tc-string "CPyxRfAPyxRfAAAAAAENAwCAAAAAAAAAAAAAAAAAAAA"
```

### Step 3: Check Tag Consent Enforcement

```bash
node scripts/agent.js --action check-propagation --url https://example.com
```

### Step 4: Generate Compliance Report

Review findings, verify consent withdrawal mechanisms, and ensure
pre-checked boxes are absent (GDPR Recital 32 — silence is not consent).

## Verification

- [ ] CMP loads before any non-essential cookies fire
- [ ] Consent banner offers granular purpose selection
- [ ] No pre-checked consent boxes present
- [ ] TC String correctly encodes user choices
- [ ] Consent withdrawal is as easy as granting consent (Art. 7(3))
- [ ] Consent receipts stored with timestamp and version
- [ ] Tag firing respects consent state for all vendors

## References

- [GDPR Article 7 — Conditions for Consent](https://gdpr-info.eu/art-7-gdpr/)
- [IAB TCF v2.2 Specification](https://iabeurope.eu/tcf-2-0/)
- [ePrivacy Directive Article 5(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058)
- [EDPB Guidelines 05/2020 on Consent](https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en)
- [CCPA Right to Opt-Out — Cal. Civ. Code §1798.120](https://oag.ca.gov/privacy/ccpa)
