Consent Management Platforms (CMPs) and CIAM: Where the Lines Fall

Key takeaways

• CMPs handle consent capture, banner UX, and downstream propagation; CIAM handles the user record and preference center.
• The two systems integrate via webhooks or API, CMP writes consent state, CIAM stores it on the user record.
• CMP choice is mostly orthogonal to CIAM choice, both can be selected independently and integrated.
• CIAM that ship native consent management (SAP Customer Data Cloud, Akamai Identity Cloud, MojoAuth, Rownd, Transmit Security) reduce the need for a separate CMP for in-product consent.
• Cookie consent and account consent are different problems, CMPs lead on cookie consent; CIAM leads on account/profile preferences.

What is consent management in CIAM?

The two main regimes pull in different directions, so the consent model has to handle both:

	GDPR (EU, UK)	CCPA / CPRA (California)
Default	Opt-in where consent is the legal basis	Opt-out of sale and sharing
What valid consent needs	Freely given, specific, informed, unambiguous; provable; as easy to withdraw as to give	Clear notice; a "Do Not Sell or Share" choice; honor Global Privacy Control
Minors	Parental consent under the national age (13 to 16)	Opt-in for sale of data from consumers under 16
CIAM job	Record each purpose-level grant and withdrawal	Record opt-out status and propagate it to every data recipient

A consent workflow in CIAM has five steps:

1. Capture. Purpose-level checkboxes at the point of collection, never pre-ticked. See consent capture best practices.
2. Record. Store purpose, decision, timestamp, source, and policy version on the identity record.
3. Propagate. Push changes to downstream systems by webhook or event stream, so marketing tools never act on stale consent.
4. Change and withdraw. Give customers a preference center in their profile, and make withdrawal one step.
5. Re-consent. When the policy or purpose changes, prompt at next login and keep the old record for audit.

Progressive profiling pairs naturally with this: ask for data and its consent together, at the moment it becomes useful. For regime detail, see GDPR and CIAM and CCPA and CIAM.

Two systems, one consent surface

The clean architectural seam is at user authentication. Pre-auth, the user is anonymous, the CMP captures consent without a stable user identity. Post-auth, the consent record needs to attach to the user; the CIAM is the system of record.

What CMPs do that CIAM doesn't

CMPs specialize in:

• Cookie consent banner UX with regulatory updates as new privacy laws emerge.
• Cookie / tag scanning that audits the site's third-party trackers.
• Geographic detection that surfaces the right banner per jurisdiction (GDPR for EU, CCPA for California, LGPD for Brazil).
• IAB TCF compatibility for advertising-tech consent signaling.
• Compliance reporting with audit-grade records for data protection authorities.

These are full-time products in their own right. Building them inside a CIAM is rarely worth the engineering investment unless the CIAM is consent-heavy by design (SAP Customer Data Cloud, Akamai Identity Cloud).

What CIAM does that CMPs don't

CIAM specializes in:

• Authenticated user records with consent attached to a stable identity.
• Preference centers for managing opt-ins, communication preferences, and data-use permissions per user.
• Consent on account creation and at sensitive-action moments.
• Account-scoped audit with consent records part of the user's auth event history.
• Subject rights tooling (data export, deletion, correction) that operates on the authenticated user record.

For B2B SaaS or apps where the consent surface is mostly authenticated, the CIAM's native consent often covers most needs. For B2C with significant anonymous traffic or ad-tech complexity, the CMP is required.

Integration patterns

The standard CMP-plus-CIAM integration:

1. Anonymous user lands on site.
2. CMP banner appears; user makes choices.
3. CMP stores consent in browser-local cookie + CMP server.
4. User registers / logs in.
5. CMP fires webhook to CIAM with consent state, attaching to the user_id.
6. CIAM stores consent on user record.
7. User updates preferences in account preference center (CIAM).
8. CIAM fires webhook to CMP to update CMP profile.
9. Bidirectional consistency maintained via webhooks on both sides.

The webhook-based integration works because consent state changes are infrequent, every change fires a webhook; the systems stay in sync without per-request coordination.

CIAM with native consent

For deployments where the consent surface is primarily authenticated, several CIAM ship native consent management:

• SAP Customer Data Cloud, twenty years of B2C heritage; consent management at the design center via the former Gigya CDP heritage.
• Akamai Identity Cloud, Janrain-derived consent depth; first-class purpose-specific consent.
• Transmit Security, Mosaic platform includes consent at enterprise tier.
• Strivacity, modern enterprise CIAM with consent and preference center.
• MojoAuth, consent management included at standard tier; competitive for mid-market B2C.
• Rownd, embedded preference center as core product; suits consent-heavy B2C consumer apps.

For these, a separate CMP may not be required if the application doesn't have meaningful anonymous-traffic consent needs. Most apps still benefit from a CMP for cookie consent specifically.

CMP choices in 2026

The major CMPs:

• OneTrust, enterprise dominant, broadest regulatory coverage, deepest compliance reporting. Highest price tier.
• TrustArc, enterprise, strong EU presence, mature audit features.
• Cookiebot, mid-market, strong cookie scanning, widely deployed at SaaS startups.
• Didomi, EU-focused, strong IAB TCF compliance for ad-tech.
• Iubenda, SMB-friendly, lightweight integration.
• Klaro!, open-source, self-hostable.

For most B2B SaaS and consumer apps, Cookiebot or OneTrust covers the requirements. Larger enterprise deployments standardize on OneTrust. EU-only deployments often pick Didomi for IAB TCF compatibility.

When the CMP and CIAM disagree

Edge case: the CMP says the user opted out of marketing, the CIAM's preference center says they opted in. Which wins?

The architectural answer: pick one as authoritative and have the other reflect it. Most teams pick the CIAM as authoritative for authenticated users (CIAM is the user record; CMP feeds in changes). For anonymous traffic, CMP is authoritative (no user record exists yet). Webhooks reconcile when the user authenticates.