Should a store use a Google-certified CMP or build a custom consent banner?
Most stores should use a Google-certified CMP. You get maintained Consent Mode wiring, correct TCF mapping, and regional rules out of the box. Build custom only if you have a real reason: unusual design requirements, a team that can maintain the compliance logic, and traffic simple enough to wire by hand.
What certification actually buys you
Google maintains a list of certified consent management platforms, and the certification is not a badge for marketing. Certified CMPs integrate with Google's consent APIs correctly, support the Transparency and Consent Framework where it applies, and keep up with platform changes. When Google changes how Consent Mode interacts with its tags, the certified vendors update their code. A custom banner updates when your developer gets around to it.
Certification also matters for Google Ads. Serving personalized ads in the EEA requires a certified CMP implementing the TCF. A custom banner, however carefully built, does not satisfy that requirement. If a meaningful share of your traffic is European, this alone settles the question.
The honest case for custom
Custom banners have two genuine advantages: design control and cost. A CMP banner is a third-party widget with limited styling, and some brands cannot stomach a generic popup on a carefully designed storefront. The vendor fee is also real, and for a small store with simple needs it can feel disproportionate.
Custom can work when the situation is simple: one region with one rule set, a small tag footprint, and a developer who understands consent state timing. The failure mode is complexity. The moment you add a second region, a TCF requirement, or a dozen marketing tags, the custom banner becomes a compliance project that never ends, and the savings evaporate into maintenance.
The maintenance nobody budgets for
A consent banner is not a one-time build. Consent frameworks change: new purposes, new vendor lists, new platform requirements. Tags get added by marketing without telling engineering. Theme updates break the banner's timing. Every one of these needs a fix, and a custom banner has no vendor doing it for you.
Ask the uncomfortable question before building: who owns this banner in 18 months? If the answer is a specific person with consent expertise who will still be here, custom is defensible. If the answer is whoever inherits the theme, buy the CMP. The cost of a vendor is predictable. The cost of a broken consent implementation discovered during an audit is not.
How to evaluate a certified CMP
Not all certified CMPs are equal for your store. Check that it sets the default consent state before any tag loads, updates state correctly when the user chooses, supports the regions you sell in, and integrates with your tag manager without timing races. Run the accept, decline, and preference paths on a staging store and watch the consent state in the browser console at each step.
Also check the consent rate. Some CMP designs produce materially higher opt-in rates than others, through clarity rather than dark patterns. A few points of consent rate is a few points of measurable traffic in GA4 and Google Ads, which is worth more than the vendor fee.
The decision rule
Default to a certified CMP unless you have a specific, written reason not to. The reason should name the design requirement or cost constraint, the person who will maintain the custom implementation, and the regions and tags in scope. Review that decision annually, because traffic, regions, and regulations all grow, and the custom banner that made sense at one region gets less sensible at five.
Either way, verify the implementation the same way: default state before tags, correct updates on choice, TCF mapping where required, and consent state surviving the full customer journey. The banner is just the visible part. The consent state underneath is what Google, your analytics, and your auditors actually read.