If you have asked “can I build my own CMP?”, the honest answer is that the banner is the cheap part. Here is what the rest costs, why the number is almost never a licence-fee comparison, and the two thresholds that decide it for you.
The engineering figures below are estimates with the reasoning shown, not measured data — your team’s numbers will differ. The structure is what matters: it is the line items people leave out that change the decision, not the precision of any one of them.
What “a CMP” actually contains
A banner with an Accept button is an afternoon. What makes it a consent management platform is everything underneath, and each of these is a real piece of work:
- The banner and preference centre. Categories, per-vendor toggles, accessible keyboard handling, focus management, and a re-open path. Call it 3-5 days if you take accessibility seriously, and you should — a consent dialog with a keyboard trap fails WCAG 2.1.1 and is now the kind of thing that draws complaints in its own right.
- Consent storage and versioning. Not just “save a cookie”. You need a version field so that changing your categories or your policy invalidates old choices and re-prompts, otherwise you are relying on consent that was given to a different question. 2-3 days.
- Script gating. The mechanism itself is a day. Applying it to every tag, on every template, and keeping it applied is not a one-off cost at all — see below.
- Google Consent Mode v2 wiring. All seven signals, defaults denied before anything loads, and an update on decision. Budget for the parameters most implementations miss:
wait_for_update,ads_data_redactionandurl_passthrough. If you set onlyad_storageandanalytics_storageyou have built v1, and the omission ofad_user_dataandad_personalizationdegrades remarketing audiences silently. 3-5 days including verification. - Regional logic. Opt-in for the EEA and UK, opt-out for most US states, and a defensible way to decide which a visitor gets. This needs geolocation you trust and a policy decision per region. 3-5 days, plus an ongoing conversation with whoever owns legal.
- A cookie and vendor inventory. Every cookie your site sets, categorised. This is the item teams underestimate most, because it is not engineering — it is investigation, and it goes stale the moment marketing adds a tag.
Somewhere between four and eight engineering weeks for a first version that you would be comfortable defending. Which, at any realistic loaded cost, is already more than several years of most CMP licences.
The costs that recur
The build is a one-off. These are not:
- Keeping the inventory current. Every new tag, plugin, embed or A/B tool is a new entry, and nobody tells you. Without a hosted vendor database this lands on someone’s desk permanently.
- Following the frameworks. Consent Mode moved from v1 to v2 and broke measurement for people who did not follow. The TCF has moved through 2.2 to 2.3. Something will move again.
- Cookie lifetime erosion. ITP and ETP cap script-written first-party cookies, so consent cookies vanish more often than teams expect. Your re-prompt logic has to tell “refused” apart from “never asked” when the cookie is simply gone — and most implementations cannot.
- Regression risk on every deploy. A blocking attribute dropped during a refactor produces no error, no warning and no visible change. It just quietly starts firing a tracker before consent.
The IAB and Google surcharge, if you need it
If you monetise with Google ads in the EEA or the UK, add a second budget entirely, because a banner you wrote is not enough on its own.
On the IAB Europe side, participating in the TCF as a CMP means annual membership through the CMP Portal plus a validation process that covers your user interfaces and technical operation, assessed separately for each environment — web, mobile and CTV — followed by ongoing monitoring of your live implementation. The membership carries an annual fee in the four figures, so it is a recurring line item rather than a one-time gate.
On the Google side, certification is a separate assessment against Google’s own criteria. Passing IAB validation does not make you certified with Google; they are two gates with two gatekeepers.
For almost every publisher this is the point where building stops making sense, and it is why the certified-CMP requirement deserves reading before you commit to anything.
The two thresholds that actually decide it
Threshold one: do you monetise with Google ads in Europe? If yes, build is almost certainly wrong, because certification dominates every other line item. If no, this whole section disappears and building gets a lot more attractive.
Threshold two: how many domains? Per-domain SaaS pricing is what makes building rational. On one site you are comparing a licence against several engineering weeks and losing. Across thirty sites — an agency, a franchise group, a multi-brand publisher — you are amortising one build across thirty licences, and the arithmetic inverts.
Between those two, most single-site teams should buy, and most large multi-domain operators should at least model building. We work through that comparison in build your own CMP vs pay for one.
The cheaper middle path
Building from scratch is rarely the right version of “build”. Starting from a maintained open-source project removes the banner, the preference centre and the gating mechanism from your estimate and leaves you the integration work, which is the part that is specific to you anyway.
Which project you start from changes the remaining bill substantially — some hand you Consent Mode v2 and the TCF, others hand you a blocking primitive and wish you luck. We compare all five in open-source and self-hosted CMP options compared.
The line item nobody budgets
Built or bought, a CMP only states intent. The expensive failure is not choosing wrong — it is a correct implementation that quietly stops working, because that cost arrives as a complaint or a claim rather than an invoice.
Whatever you decide, budget for verification as an ongoing cost rather than a launch checklist item. Run a scan with CookieInspector to see exactly what fires before and after consent, and keep it running so the deploy that breaks a blocking attribute does not go unnoticed until someone else finds it.