Consent Management Template for Product Managers

Re-obtain consent when the purpose of processing changes, when you add new third-party processors, or when your consent text is materially updated. There is no fixed interval, but annual renewal is a common practice for marketing consent.

Not per cookie, but per purpose. Group cookies by their processing purpose (analytics, marketing, advertising) and obtain consent per category. Users do not need to see individual cookie names.

You cannot retroactively assume consent. For existing users, implement a "soft re-consent" flow: show the consent banner on their next visit and treat all non-essential processing as denied until they make a choice.

Consent requires the user to actively opt in. Legitimate interest allows processing without consent if you can demonstrate a legitimate business need that does not override the user's rights. Legitimate interest requires a documented assessment (LIA). Analytics is often handled via legitimate interest in some jurisdictions, but GDPR and ePrivacy typically require consent for tracking cookies regardless.

For most teams, yes. Building a fully compliant CMP in-house is significant engineering effort. Platforms like OneTrust, Cookiebot, or Osano handle geo-detection, consent storage, and cookie scanning. Evaluate build vs. buy using the [build vs. buy assessment](/tools). Even with a CMP, you still need to configure it correctly using a template like this one.