Consent management platform (CMP)

The GDPR defines consent in Article 4(11) as "any freely given, specific, informed and unambiguous indication of the data subject's wishes" given "by a statement or by a clear affirmative action". Article 7 adds four conditions. The controller must be able to prove that consent was given. A consent request mixed with other matters must be clearly separate from them. The user may withdraw at any time, and withdrawing must be as easy as giving consent. Under Article 7(4), tying a service to consent for processing it does not need weighs heavily against consent being freely given.

The ePrivacy Directive (2002/58/EC) adds a second rule. Article 5(3) allows storing information on a user's device, or reading information already stored there, only with consent, unless it is strictly necessary to transmit a communication or to provide a service the user explicitly requested. The European Data Protection Board says in Guidelines 2/2023 that this applies whether or not the information is personal data, and that client-side code which instructs the device to send information counts as gaining access. Analytics, crash reporting and attribution SDKs in a mobile app fall into that category.

A consent management platform sits between these rules and the code. It shows the choice, stores the decision for each purpose or tool, and exposes the decision to the app, which starts a tool only when it is allowed to run. A lending app usually holds two more kinds of permission. Marketing consents per channel (e-mail, SMS, phone calls, push) live in the lender's own system, next to the customer record. Operating system permissions, such as push notifications or Apple's App Tracking Transparency prompt on iOS, are granted on the phone and are separate from consent in the legal sense.

Most SDKs start collecting the moment the app launches. Analytics libraries send automatic events, such as the first open of the app or the start of a session, before any screen appears. Showing a banner is not enough: automatic collection has to be switched off in the native configuration of each platform and switched on in code only after the app has read the decision. Check each platform separately, because a configuration file that works on Android may be ignored on iOS, where the same flags go into the app's property list file.

According to the EDPB, once consent is withdrawn the controller must stop the processing based on it, and delete the data if no other legal basis remains. In the app a consent change should therefore stop the SDK in the current session, not at the next launch.

No answer means no consent. If the CMP fails to load or never reports a decision, every tool that depends on consent stays off. Treat that branch as a normal path and test it.

Defaults must be empty. Guidelines 05/2020 state that pre-ticked opt-in boxes are invalid under the GDPR. A checkbox that ticks itself because of a state bug makes the consent invalid, so it deserves a regression test.

Proving consent under Article 7(1) takes a record for each consent: its name, the version of its text, its status and the time of each change. Keep information notices out of the consent list: an information clause only informs the customer and needs no agreement.

The GDPR has applied since May 25, 2018. Article 5(3) of the ePrivacy Directive is applied through national law, so a lender in Poland follows the Electronic Communications Law (Prawo komunikacji elektronicznej, PKE) of July 12, 2024, in force since November 10, 2024. Article 399 transposes Article 5(3): storing or reading information on the user's device requires prior information and consent, except where it is necessary for transmission or for a service the user requested. Article 398 bans the use of automated calling systems and telecommunications terminal equipment, in particular through interpersonal communication services, to send commercial information, including direct marketing, unless the user has consented beforehand. Consent may be given by providing an e-mail address for receiving commercial information at that address. Article 400 applies the data protection rules to obtaining that consent.

The EDPB's Guidelines 05/2020 on consent, adopted on May 4, 2020, explain granularity per purpose, pre-ticked boxes, cookie walls and withdrawal. Its Guidelines 2/2023, adopted in final form on October 7, 2024, set out which techniques fall under Article 5(3). They build on Opinion 9/2014 of the Article 29 Working Party, which had already placed device fingerprinting within Article 5(3), and they cover unique identifiers, tracking pixels and code that runs on the device. In November 2025 the European Commission proposed a Digital Omnibus that would, among other things, change the GDPR and the consent rules for storing and reading information on devices. As of October 2026 the proposal is still being negotiated, so the rules above apply.

The app we have built for AvaFin Poland since January 2026 handles App Tracking Transparency on iOS, a CMP that decides about each SDK separately, and the consents stored in AvaFin's system. In September 2026, following requirements from AvaFin's legal team, we switched Firebase Analytics and Crashlytics off natively on both platforms. They are switched on only after the app reads the CMP decision. Because the crash reporting setting persists, crashes at startup are reported for consenting users from the second launch. On iOS the flags went into the app's property list file, because the shared configuration file was not read there. When the customer withdraws consent, the AppsFlyer attribution SDK stops sending data in the same session and resumes when consent is given again. If the CMP never reports a decision, everything that depends on consent stays off.

The consents in AvaFin's system are versioned records grouped into marketing consents (e-mail, SMS, phone and the customer panel) and app consents (analytics and push marketing). A separate consent for marketing push notifications was added in August 2026, and switching push on now triggers the system permission dialog. The same month the information clause was removed from the list of consents.

In Aasa24, the lending app we have developed for Aasa Polska since May 2023, analytics starts only after consent. In November 2024 the single phone marketing consent was split into separate SMS and phone call consents. In August 2026 the app got new marketing consents for partners on the last step of the application, and customers can now manage their marketing consents in the customer profile.