Every day, hundreds of millions of Europeans express privacy preferences online. Behind every one of those choices is a piece of infrastructure most users never see: a Consent Management Platform interpreting the request, enforcing purposes against specific controllers, and producing the auditable record that GDPR compliance depends on.
That infrastructure didn’t exist a decade ago. Europe built it, in direct response to the GDPR, and a specialised ecosystem of European privacy technology companies emerged to operate it. Usercentrics is one of them.
Today, as Europe modernises its privacy framework, the people who run that infrastructure need a shared voice in Brussels. That’s why, in March, Usercentrics co-founded the European CMP Association (ECMPA) alongside Axeptio, Didomi, and iubenda.
What the ECMPA is for
The ECMPA is a Brussels-based non-profit, open to the wider CMP ecosystem. Its members represent the companies that build and operate the systems through which European users express their privacy preferences every day.
The association exists to bring that operational expertise into the regulatory conversation, directly, collectively, and on the record. It engages with EU institutions, standardisation bodies, and data protection authorities on three priorities:
- GDPR-compatible consent at every layer. New signalling mechanisms can reduce friction, but they cannot replace the contextual, purpose-specific consent the GDPR requires. CMPs and global signals should operate as complementary layers, not competing ones.
- Open, interoperable, technology-neutral standards. No single vendor, European or otherwise, should control Europe’s consent architecture.
- European digital sovereignty. As AI assistants, the EUDI Wallet, and consent agents reshape how users interact with their data, the standards governing those interactions must remain accountable to a broad European ecosystem.
Why this matters now
The European Commission’s Digital Omnibus proposal is the most significant rewrite of EU consent rules since the GDPR. We welcomed the proposal when it was published in November, and we still support its core goals: less consent fatigue, clearer obligations, a better digital experience for users and businesses alike.
But one provision, Article 88b, which would let browser-level consent signals override website-level consent flows, raises serious questions. As currently drafted, it conflicts with the GDPR’s specificity requirement, risks serious economic consequences to European publishers and SMEs, and would concentrate control of Europe’s consent infrastructure in a small number of global, non European platform gatekeepers. Europe spent a decade building an independent privacy technology ecosystem with global credibility. The Digital Omnibus should strengthen that ecosystem, not inadvertently hand its governance to platforms whose primary interests lie elsewhere..
These are exactly the kinds of implementation questions that need input from the people who operate consent infrastructure at scale. The ECMPA has submitted a joint position paper setting out the concerns and proposing a workable alternative: an interoperable, layered architecture in which browsers, wallets, and CMPs each play their proper role.
“Regulation that looks simple on paper can create serious complexity in practice when it is designed without input from those who implement it. The European CMP Association gives us a credible, collective platform to contribute that expertise constructively, not to resist simplification, but to make sure it actually works for users and businesses,” Eike Paulat, VP Product, Usercentrics.
Usercentrics’ commitment to the association
Usercentrics brings to the ECMPA more than a decade of experience operating consent infrastructure for customers ranging from SMEs to global enterprises, across web, app, and connected environments. That includes formal responses to the European Commission’s Digital Omnibus call for evidence, participation in multi-CMP industry coalitions, and ongoing engagement with technical standards development processes.
We have submitted detailed positions to the Commission on the Digital Omnibus proposals, covering Articles 88a and 88b, pseudonymisation, media exemptions, compliance cost implications, and the role of CMPs in standardisation governance. These positions inform the association’s collective engagement with the legislative process.
The ECMPA has already submitted a joint response to the Commission’s public consultation in March 2026. Further engagement with the European Parliament, the Council, and standardisation bodies including ETSI and CEN-CENELEC is planned throughout 2026 and into the legislative process.
“Browser-level signals can reduce friction, but they can’t replace specific, informed consent – that’s not a CMP defending its turf, that’s what the GDPR actually requires. The ECMPA exists to make sure that distinction stays in the conversation as the Omnibus moves forward,” Donna Dror, CEO, Usercentrics.
What this means for our customers
Nothing changes today. The Omnibus is still a proposal, and any binding requirements will come with significant lead time.
Your CMP remains essential. Whatever the final shape of Article 88b, the need for contextual, auditable, purpose-specific consent isn’t going anywhere, and neither is the infrastructure that delivers it.
We will keep you ahead of every change. We are tracking the legislative process closely and contributing to it directly, both through Usercentrics’ own submissions and through the ECMPA. As updates land, we will guide you through them long before they take effect.
That’s why we co-founded the European CMP Association: to make sure the operational realities of consent infrastructure stay part of the regulatory conversation, on behalf of every business that depends on it.
Join our growing community of data privacy enthusiasts now. Subscribe to the Usercentrics newsletter and get the latest updates right in your inbox.
