Your self-hosted CMP is legal — and still cannot serve Google’s ads in the EEA

There is a question we get in some form every few weeks, and it is always framed as a legal question when it is actually a contractual one: “we built our own consent banner and it is compliant — why is our EEA ad revenue down?”

The answer is that you are being measured against two different rulebooks, and passing one tells you nothing about the other.

Two requirements that get collapsed into one

The first is legality. Can you lawfully store or read information on a user’s device? That comes from ePrivacy, as transposed nationally, with the GDPR governing what you then do with the resulting personal data. A well-built in-house banner can satisfy this completely. Nothing in either instrument says your consent tool has to come from a vendor, be on anyone’s list, or speak any particular protocol.

The second is commercial eligibility. Will Google pay you to show personalised ads to that user? That is governed by Google’s publisher policies, and since 16 January 2024 the answer is only yes if your consent signal arrives through a CMP that is both certified by Google and integrated with the IAB’s Transparency and Consent Framework.

You can pass the first and fail the second. Most self-hosted setups do exactly that. The banner is fine; the plumbing that would tell Google’s ad stack what the user chose simply is not there, because the TCF is a specific technical framework with a consent string format, a vendor list and a registered CMP ID, not a general idea about asking permission.

What actually happens when you fail it

This is worth being precise about, because the failure mode is routinely overstated — including, until recently, by us.

Traffic arriving without a certified CMP is not cut off. Google’s publisher documentation says it “may be eligible for non-personalized ads or limited ads”, and that publishers “may see a decrease in their EEA and UK revenue”. So you keep serving; you serve worse-paying inventory to the share of your audience that sits in the EEA and the UK.

There is one genuine hard stop worth knowing: for Search Ads publisher products, if neither a certified CMP nor the alternative parameters are in place, Google will not serve any ads at all.

So the correct way to size this is not “compliance emergency”, it is a revenue calculation. Work out what share of your traffic is EEA/UK, and what non-personalised inventory pays against personalised in your vertical. For a site whose audience is mostly US, the answer may well be that this can wait. For a site whose readers are mostly European, it is the single biggest lever on RPM you have.

Your three routes out

1. Adopt a CMP from Google’s certified list

Google publishes and regularly updates the list, and it runs well past a hundred entries, so whatever you are already paying for may be on it. If you use a commercial CMP that is not listed, the question for your vendor is simply whether they intend to certify — and if they have no answer, that is your answer.

2. Use Google’s own CMP

This is the route most publishers should take and the one most of them do not know exists. “Google LLC CMP” is itself certified, for web and app, and the European regulations message is available to Ad Manager, AdSense and AdMob publishers in the Privacy & messaging tab of the account. There is no integration project: you configure the message where you already manage your ads.

The trade-off is control. You are accepting Google’s UI and Google’s flow, on the domain where you have opinions about both — which for a site that writes about consent design is a real cost, not a rhetorical one.

3. Certify the one you built

This is allowed, and it is where people underestimate the work by roughly an order of magnitude, because it is two separate processes with two separate gatekeepers.

On the IAB Europe side, you apply for annual CMP membership through the CMP Portal and then pass a validation process before you are issued a CMP ID and listed. Validation is not a form: IAB Europe verifies the user interfaces and the technical operation of your CMP, per environment — web, mobile and CTV are validated separately. Compliance then continues after launch, with a post-implementation enforcement stage that monitors live implementations. Membership carries a four-figure annual fee, so this is a recurring line item, not a one-off.

On the Google side, certification is a separate assessment against Google’s own criteria, focused on TCF compliance, entered through its CMP certification intake form. Passing IAB validation does not automatically make you certified with Google.

Add it up before you commit: an annual fee, two validation processes, per-environment UI review, ongoing monitoring, and a consent string implementation you now have to keep current as the framework versions move. Against that, the licence cost of a listed CMP usually stops looking expensive — which is the same arithmetic we ran in what it actually costs to build your own CMP, arriving from a different direction.

What this does not mean

It does not mean open-source CMPs are dead, and it does not mean you were wrong to self-host.

If you do not monetise with Google ads, none of this applies to you at all. Klaro and the other self-hosted options remain a legitimate, often better-engineered answer for a SaaS product, an internal tool, a documentation site, or anything where the point of the banner is to be lawful and unobtrusive rather than to feed an ad auction. Self-hosting also keeps giving you the things it always gave you: no third-party script in the critical path, no vendor outage taking your banner down, and full control over the copy.

What it does mean is that “should we build or buy” has a variable in it that most comparisons leave out. If ad revenue is part of the answer, the build side of that ledger has to include certification — and once it does, the comparison changes shape. Our build vs buy breakdown holds up on the engineering economics; treat this as the clause it did not price.

How to check where you actually stand

Three things, in order:

1. Is a TCF string being produced at all? If your CMP does not implement the TCF, there is no __tcfapi on the page and no consent string in the ad requests. That is the fastest tell, and it takes ten seconds in the console.
2. Is your CMP on Google’s certified list? Check the vendor by name. A CMP can implement the TCF perfectly and still not be certified by Google — these are genuinely two lists.
3. What share of your traffic is EEA/UK? This is what turns an abstract policy problem into a number you can act on, or defer.

And separately from all of it: verify what your banner is actually doing before consent, because a certified CMP wired up incorrectly still lets tags fire early, and no certification protects you from that. That is a different failure, with different consequences, and it is the more common one. Check what your Consent Mode setup really signals — the gap between what a CMP is configured to do and what the browser actually does is where most implementations come apart.

The short version

Lawful and monetisable are two different tests. Your in-house banner may well pass the first. Google’s certified-CMP requirement is the second, it has been in force since January 2024, and failing it costs you the difference between personalised and non-personalised inventory on your European traffic — not your ad serving outright. If that difference matters to your revenue, Google’s own CMP is sitting in your account already. If it does not, carry on self-hosting with a clear conscience.