Consent Management Platform (CMP) Integration
When you require advanced consent capabilities—such as multi-region compliance, dynamic cookie scanning, or external audit logging—Liferay provides integration points to connect with third-party Consent Management Platforms (CMPs). This lets you delegate cookie consent handling to specialized providers while maintaining a seamless user experience.
Leverage Liferay’s CMP integration capabilities if you need to
- Centralize consent across multiple sites, domains, or web applications.
- Comply with regional regulations using automated, location-based consent logic.
- Manage granular cookie categories outside Liferay’s native settings.
- Maintain external audit logs for centralized reporting and compliance tracking.
For CMP-specific behavior and compliance guarantees, refer to your CMP provider’s documentation.
Configure a Third-Party CMP
-
Open the Global Menu (
) and navigate to Control Panel → Instance Settings. -
Go to Privacy → Third-party Consent Management Platform.
-
Add the Provider Name and paste the Script Tag provided by your CMP vendor.
-
Check Enabled and click Save.
Open a page and verify that the consent banner appears.
Map Consent to Liferay’s Backend
Your CMP’s client-side script tag renders the consent banner for visitors, but it does not automatically communicate with Liferay DXP’s backend. For Liferay’s server to honor consent decisions—such as setting the REMEMBER_ME cookie during user sign-in—the backend must be notified of the user’s choice. The Consent Mapping Script field defines a script that synchronizes consent states between your third-party CMP and Liferay DXP.
Write a script that reads your CMP’s consent decision and writes it into a cookie named CONSENT_STATE, as a URL-encoded JSON object with four boolean keys, one for each consent type documented in Managing Third-Party Cookies:
CONSENT_TYPE_FUNCTIONALCONSENT_TYPE_NECESSARYCONSENT_TYPE_PERFORMANCECONSENT_TYPE_PERSONALIZATION
A decoded CONSENT_STATE cookie value looks like this:
{"CONSENT_TYPE_FUNCTIONAL": true, "CONSENT_TYPE_NECESSARY": true, "CONSENT_TYPE_PERFORMANCE": false, "CONSENT_TYPE_PERSONALIZATION": false}
Liferay DXP renders your CMP’s Script Tag first, then your Consent Mapping Script immediately after it, both in the page’s <head> element. Your Consent Mapping Script’s <script> element is guaranteed to appear after your CMP’s, so you can register a listener against the CMP’s global objects without a race, even though those objects may not exist yet when your script first runs.
If the CONSENT_STATE cookie is missing, cannot be parsed, or omits a key, Liferay DXP treats that consent type as granted. Liferay DXP always honors necessary consent, regardless of the cookie’s content. If your CMP already blocks non-essential scripts and cookies until the visitor consents (auto-blocking), you do not need a Consent Mapping Script: Liferay DXP’s default-allow behavior matches what your CMP already enforces client-side.
This mapping controls real backend behavior. For example, functional consent gates the REMEMBER_ME cookie at sign-in: if your Consent Mapping Script’s CONSENT_STATE cookie reports CONSENT_TYPE_FUNCTIONAL: false, Liferay DXP does not set the REMEMBER_ME cookie when the visitor signs in, even if the visitor selects Remember Me.
Enable either Liferay DXP’s built-in Consent Manager or a third-party CMP, not both. Liferay DXP does not block enabling both at the same time. If you do, both your third party CMP and Liferay DXP’s consent banners render, with the third-party CMP’s CONSENT_STATE cookie determining backend cookie decisions.
If you switch from one third-party CMP to another, returning visitors must interact with the new CMP’s banner again, and you must update your Consent Mapping Script to match the new CMP’s category names.
For example scripts written against specific CMP providers, see Consent Mapping Script Examples.
To confirm your Consent Mapping Script works, open your browser’s developer tools, inspect the CONSENT_STATE cookie’s value after interacting with your CMP’s banner, and confirm it decodes to the consent choices you made.