CCPA Compliance Implementation: Consent Management Platform (CMP) loads on every page

Overview

This check confirms your CMP script loads and initializes on every page of the property. The CMP is the control surface for every downstream consent decision, so its own coverage has to be validated before any consent-behavior check downstream can be trusted.

Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific CCPA/CPRA compliance obligations.

Why it is important

If the CMP fails to load, even on a small percentage of pages, opt-out signals are never captured on those pages, unapproved tags fire unchecked, and consent records are incomplete for any visitor who lands there first. A CMP present on 99% of pages is still treated as a compliance gap because regulators evaluate coverage per-page, not in aggregate, and the missing 1% is exactly where a class-action screenshot tends to come from.

Implementation

Use detect_cmp to confirm which CMP is deployed, then run a full-site Web Audit.
Check the pre-built ObservePoint report for CMP Vendor Coverage by Page.
Any page missing the CMP tag in the report above is a coverage gap. Check whether it clusters around a specific template or subdomain before fixing each page individually.

Exception to watch for: this check assumes your CMP is a recognizable third-party vendor script (OneTrust, Cookiebot, TrustArc, Didomi, and similar). If your banner is self-hosted or custom-built (served from your own domain, bundled into your own JS rather than loaded as a separate tag, or a CMP white-labeled onto a first-party subdomain to dodge ad-blockers) there's no distinct third-party tag ID for a vendor-based report to key off of.

A page can have a fully functional first-party banner and still show up as "missing the CMP" under the default approach, which is a false positive on the exact thing this check exists to catch.

Remediation

For remediation, check the following steps:

For pages missing the CMP, check first whether the gap is template-specific (a landing-page builder, a microsite, or a legacy page outside the main CMS) since CMP deployment gaps are almost always caused by a page type that sits outside the standard tag-manager container.
Add the CMP script/container to the missing template or migrate the affected pages into the governed tag-management container so future coverage is automatic rather than manually maintained.
Where a subdomain or acquired property runs a separate CMS entirely, deploy the CMP independently there and add it to the audit scope as its own tracked domain.
Re-run the full-site audit after the fix and confirm 100% CMP coverage before considering the issue closed.

Conclusion

Every other check in this framework assumes the CMP is present and functioning, so closing CMP coverage gaps first is the highest-leverage fix available — a single missing template can otherwise silently invalidate consent evidence across an entire site section.