A frequency toggle. That's all one retailer added to their preference center. The result: over an 80% reduction in folks opting out completely and entirely. The world of C&P has the potential for massive wins just by doing the basics well.
Most organizations we work with believe they've achieved baseline consent compliance. They have cookie banners. They read GPC signals. They offer some form of preference management. But when we map their actual capabilities against a structured maturity model, the gaps become apparent quickly.
The important thing about this maturity model: it's not a judgment. It's about figuring out where you are, where you want to get to, and what's actually right for your business. Sometimes Level 1 is the end goal, and that's perfectly appropriate.
Level 1: Baseline Compliance
A baseline implementation needs to cover a few key items:
- Cookie banner presence: Either displaying prominently or, at minimum, accessible from the footer so users can modify their cookie settings
- GPC signal reading: Generally done in an anonymous state, dropping a GUID as a first-party cookie to store consent
- Manual categorization: All tracking technologies categorized with blocking rules for different geographies
- Centralized consent capture: Every point where individuals can sign up for communications feeds the same system, whether that's OneTrust, a CDP, or a homegrown solution
- Consumer access request process: Clear pathways for access, deletion, and do-not-sell requests
Why is this baseline and not advanced? At this level, the systems aren't necessarily connected to each other. Your CMP identifiers don't map to your login identifiers or to your email marketing identifiers. You're compliant, but you're not delivering a unified experience.
The primary value at this level is compliance risk reduction. There's not really a ton of net benefit being gained out of these tools beyond that. You're checking boxes, building consumer trust, mitigating risk. But those are intangible variables, and things that are hard to tie numbers around. For a lot of organizations, this is the goal and the objective, and that's appropriate.
Level 2: Marketing System Integration
Where we start to see customers move out of the baseline level is when they start to take the same set of tools and try to measure real marketing value.
Level 2 builds on baseline with these additional capabilities:
- Full marketing system integration: Your consent platform talks to your CDP, marketing automation, CRM, and analytics tools
- Universal consent and identity: Recognizing customers across all business units with unified identifiers
- Expanded preference centers: Moving beyond binary opt-in/opt-out for known users to granular channel, topic, and frequency preferences
- Decentralized management with centralized governance: Business units can customize their specific offerings while following the same consent structure
- Marketing impact measurement: Tracking user retention, email deliverability, opt-down rates, and unsubscribe patterns
- API-first infrastructure: Real-time bidirectional sync so customer changes reflect instantly across systems
What's still separate at this level: your CMP, consumer access requests, and preference center may still operate as distinct experiences. They're more sophisticated individually, but not yet unified into a single customer journey.
Sports leagues can provide a good example at this level. They keep their consumer access requests and CMP off to the side, but they expand on their preference center capabilities. Each team within the league has different communication options and different offerings. This gives them a structure where all teams follow the same consent architecture, but each can customize their specific channels.
The key shift: these projects go from being focused on privacy to being focused on a larger marketing initiative. For some sports leagues, they're measuring potential revenue streams from collecting consent in GDPR countries.
This is where the shift starts to happen from a compliance project to a revenue enabling project.
Level 3: Unified Orchestration
For our most mature customers, everything is unified together and orchestrated cohesively. This is the key distinction from Level 2: instead of three sophisticated but separate experiences, you have a single integrated journey.
Level 3 combines all components into one experience:
- Unified privacy profile: CMP settings, consumer access requests, and preference center all accessible from a single location within the customer's account
- Dual-path architecture: Maintains baseline experience for anonymous visitors while delivering the unified experience for authenticated users
- Automatic identity verification: Authenticated users skip the verification step in access/deletion requests, enabling immediate processing
- Integrated retention mechanisms: Ability to show customers exactly what they'll lose before they opt out or delete
- Cross-component data flow: Cookie preferences, do-not-track settings, GPC recognition, communication preferences, and access requests all share the same customer record
- Privacy-driven personalization: First-party and zero-party data collection replaces reliance on third-party tracking technologies
The difference in practice: at Level 2, a customer might manage cookie settings in one place, email preferences in another, and submit a deletion request through a third form. At Level 3, they log in and see everything in their profile, unified.
If you're not an account holder, your privacy selections flow through a baseline pathway that looks exactly like Level 1. But if you are an account holder, they've taken communication settings, CMP settings (cookie preferences, do-not-track, GPC recognition), and consumer access requests and unified them into a completely optimized experience in a single place within your profile.
You might think this would lead to massive increases in deletion requests and opt-outs. That's actually typically not what we find, because this allows you to build in additional mechanisms. When someone goes to delete, you can let them know exactly what happens: "If you delete this, then this happens and that’s how it affects the value you get from us."
The efficiency gains compound. Authenticated users are automatically verified, eliminating a step in the access request process so that processing can start immediately. The privacy team has a significant impact on digital experiences and marketing bottom lines, shifting marketing teams away from third-party tracking technologies into soliciting first-party data.
What's Right for Your Business
The reason Level 3 works for certain organizations where everybody who's a customer creates an account. It works for subscription-based models. People are logged in on mobile devices, home computers, and/or work computers. Passing settings across those experiences matters.
Compare that to CPG products. Nobody has an account for toilet paper. They sell through third parties and stores. For their business, putting all functions together in a single Your Privacy Choices banner accessible from the footer is actually perfect. You'd be hard-pressed to find a reason to have them invest more money to do what sports leagues or subscription-based models are doing.
The most important takeaway: evaluate what's the right place for your business to get to. Where are your biggest risk areas? What customer relationships require unified consent experiences? What's the authentication pattern of your actual user base?
Ready to assess where your consent program sits on the maturity curve? Our team can map your current capabilities against the maturity model and identify the highest-value improvements for your specific situation.
Get in touch today for a quick conversation with our experts on what works for your organization.
