Google-certified CMPs: which ones pass consent signals to Google's tags, and how to test yours
When a consent platform says it's Google-certified, it means one of two lists. They answer different questions, and neither one checks your own site.
The short answer
Google keeps two lists. The certified CMP list is for sites that show Google ads through AdSense, Ad Manager or AdMob to visitors in Europe, the UK and Switzerland, and it's built around the IAB's Transparency and Consent Framework. The Consent Mode CMP Partner Program is for advertisers, and it lists platforms that work with consent mode and Google Tag Manager, sorted into Gold, Silver and Bronze. Neither list tells you whether your own banner sends the right signals. Testing your site does.
On this page
Two lists with the same label
The two lists cover different products and different rules. If you only advertise with Google Ads and measure with GA4, the second list is the one that matters to you. For the price, features and fit of each platform, see the comparison of nine platforms.
The publisher list: certified CMPs for the TCF
Sites that use Google's publisher products, AdSense, Ad Manager or AdMob, must use a CMP that Google has certified and that integrates with the IAB's Transparency and Consent Framework (TCF) when they serve personalized ads to some visitors. The TCF is an industry standard for passing a visitor's choices to ad technology companies. The rule has applied since January 16, 2024 for visitors in the European Economic Area and the UK, and since July 31, 2024 for Switzerland. Without a certified CMP, those visitors may only get non-personalized or limited ads.
Google describes certification narrowly. It says it assesses certified CMPs against criteria focused on TCF compliance, and that it "does not check CMPs for full compliance with the TCF." It says nothing about whether your site meets a privacy law. That's a question for your counsel.
If your site doesn't show Google ads, this requirement doesn't apply to you.
The Consent Mode CMP Partner Program
The Consent Mode CMP Partner Program is Google's directory for advertisers looking for a consent platform that works with consent mode and Google Tag Manager. Google sorts the partners into Gold, Silver and Bronze using criteria it describes as including customer support and how easy the technical integration is. It doesn't publish what each tier requires.
Google also says nothing stops an advertiser from using a CMP that isn't a partner. A partner listing tells you Google has vetted the integration. It doesn't tell you your container is set up correctly.
Where the platforms I work with stand
These are the platforms I've set up for clients, plus Osano, which I've administered. Every cell comes from Google's own lists.
| Platform | On Google's certified CMP list (TCF) | Consent Mode partner tier | Notes |
|---|---|---|---|
| OneTrust | Yes, as "Onetrust / Cookiepro CMP" | Gold | |
| CookieYes | Yes, as "CookieYes CMP" | Gold | |
| Cookiebot | Yes, as "Cookiebot CMP" | Gold | Owned by Usercentrics |
| Usercentrics | Yes, as "UserCentrics CMP" | Gold | |
| Ketch | Yes, as "Ketch CMP" | Silver | |
| Kukie | Not listed when checked | Not listed when checked | I use it on this website |
| iubenda | Yes, as "Iubenda CMP" | Gold | |
| consentmanager.net | Yes, as "Consentmanager CMP" | Gold | |
| Termly | Yes, as "Termly CMP" | Gold | |
| Osano | Yes, as "Osano CMP" | Silver | I've administered it but haven't set it up |
Checked November 2026 on Google's lists: the certified CMP list and the Consent Mode CMP Partner Program. Both change, so check them before you choose.
Kukie, which I use on this website, wasn't on either list when I checked. That matters if you show Google ads to visitors in Europe, or if you want a platform Google has vetted for consent mode. A platform off the partner list can still send all four signals correctly, and a test is how you'd know.
Comparing the two most configurable platforms on this list? See OneTrust vs Usercentrics.
What a certified CMP still leaves to you
A certified platform can still be connected badly. These four things depend on your setup:
- Defaults set before any tag runs. The consent defaults have to be in place before Google's tags fire on the first page.
- All four signals updating after a choice. ad_storage, analytics_storage, ad_user_data and ad_personalization should all change when a visitor accepts or declines.
- Region defaults that match what you decided. A rule meant for Europe shouldn't apply to every visitor.
- Tags that aren't Google's. Consent mode only tells Google's tags. Meta, LinkedIn and other pixels need their own controls.
How the signals reach Google's tags, and what each one does, is in Google Consent Mode and your CMP. If a platform needs setting up or fixing, that's my consent management work.
How to test that your CMP passes the signals
Google's consent debugging guide uses Tag Assistant. The short version:
- Open the site fresh in Tag Assistant and don't touch the banner. Select the first Consent event and note the default for each of the four signals.
- Accept all. Select the latest Consent event and check that all four changed to granted.
- Reject all in a new session and check that the advertising signals stay denied.
- Turn on Global Privacy Control and load the site again in a new session. Note what the defaults are now.
Write down the default and the update for each signal in each state. The full banner test adds the network checks. The Measurement & Consent Audit runs it on every key action in all four states.
How CMPs pass choices to other tools
Google's tags get the choice through consent mode. Other tools get it in one of three ways:
- The TCF string, for ad technology vendors. Under the TCF, the platform stores the visitor's choices as a TC String and makes them available to the vendors on the page.
- Tag Manager checks, for other tags. The platform announces each choice in the data layer, and triggers in Tag Manager hold each tag until its category is allowed. Some platforms can also block scripts themselves.
- Server-side forwarding, where it's used. If events go to Meta or Google through a server, the consent state has to travel with each event, and the server has to check it.
Questions about certified CMPs
Does my CMP need to be Google-certified if I only use GA4 and Google Ads?
Not for Google's publisher requirement, which covers sites that show ads through AdSense, Ad Manager or AdMob. For GA4 and Google Ads, what matters is that your CMP sends the four consent mode signals correctly. A Consent Mode partner is a sensible place to start, and Google says you can use a CMP that isn't a partner.
Does certification make my site compliant?
No. Google says it assesses certified CMPs against criteria focused on the TCF and doesn't check them for full compliance with it. Whether your setup meets a privacy law is a question for your counsel. I test what your tags do with each choice.
How often does Google update the lists?
Google says it updates the certified CMP list weekly, and certified CMPs must recertify at least every twelve months. The partner directory doesn't say how often it changes, so check both lists when you choose a platform.
