Frequently asked questions

Gravito CMP is a consent management platform (CMP) that serves IAB TCF, IAB GPP (Global Privacy Protocol) and the Google, Microsoft and Amazon consent signals from a single script.

It loads first on the page, runs on websites and, through a WebView, in apps, and we set it up with you.

Gravito CMP →

The operating model: our team does the wiring with you, and stays on after launch to help keep your stack right.

How we work →

Your scripts read the current consent state from the CMP and listen for its events when it changes.

Where consent needs to reach systems outside the page, such as access management, CRM or a data platform, we build that bridge, server-side.

Yes: an automated cookie scan finds the cookies on your domains.

You review the result, add what a scan cannot see, translate it and publish.

Yes: visitors can reopen their choices at any time, for example from a link in your footer.

When your policy changes, a new configuration version asks every visitor again.

Yes: consent preferences can be connected to a signed-in account, and are restored when the visitor signs in again, for example after their cookies were cleared.

It works with whichever identity or access management system you run.

Yes, as one example of what can be built with the CMP, working with your own subscription system. Which model fits your sites is your decision, with your legal team.

Gravito CMP →

For 364 days by default: in that time the CMP remembers the choice and does not show the banner again, and then it asks for a new decision.

You can set a shorter period, for example on legal advice. The secure server-side copy of the choice, kept in your first-party context, follows the same default and can be kept longer where a strong legal reason applies.

More on consent memory →

Yes: layout, colours, fonts, logo and texts are yours to set, and we deploy the banner in whatever language your audience needs.

Not on its own. A CMP signals the visitor's choice and orchestrates the consent gates: tags act on the choice through Consent Mode, the TCF and GPP strings, and the tag manager triggers we set up with you.

What Gravito CMP does: the visitor makes one choice; the CMP keeps it and passes it to each system in the form that system reads. For each framework, and the laws it serves, see Frameworks and the documentation. How Gravito itself handles personal data is described in our privacy notice.

No CMP on its own makes a site compliant: every system that receives the consent signal has to respect the visitor's choice too. We do not give compliance guarantees or legal advice.

Gravito CMP supports TCF 2.4 on the web, from release 6.6.1 in September 2026.

TCF 2.4 changed what the banner shows about Features; it added no new purposes or consent signals, and existing TCF setups kept working without migration.

Yes: Gravito is registered with IAB Europe as a TCF CMP, ID 302, and Gravito CMP is a Google-certified CMP, for web and app.

That depends on the framework: under IAB TCF, visitors make consent choices and can object to legitimate interest for ad tech vendors; with the Standard CMP, they choose by consent categories you define.

Gravito CMP supports IAB GPP, which carries visitors' US state privacy choices in one standard string, through the standard __gpp interface.

It runs on the web and in apps through the WebView, from release 6.6.0 in August 2026. Which state sections your deployment uses is confirmed with you during implementation, against the current product. If you have signed the IAB Multi-State Privacy Agreement (MSPA), Gravito CMP also supports the US national section across the United States. We still recommend running consent with the state-specific sections: it is the better setup.

Yes: Google Consent Mode v2, Microsoft UET Consent Mode and the Amazon Consent Signal (ACS) are switched on in the same configuration, not added as separate tags. Each has its own page with the detail:

Google Consent Mode · Microsoft Consent Mode · Amazon Consent Signal

Yes: for each region, the decisioning layer applies whichever framework or configuration fits: TCF, GPP, the Standard CMP with your own consent categories, or no banner where none is needed.

Your site supplies the visitor's region, typically from your CDN.

How the decisioning layer works →

Yes: consent can be bridged across your domain network; bridging consent is a feature of the Gravito CMP configurator, and we set it up.

Many domains sit under one account.

Yes, through a WebView: apps show the same CMP in a WebView, with platform bridges for iOS, Android, React Native and Flutter.

The app stores the choice under the standard IAB keys, so the other SDKs in the app can read it, and it loads the same published configuration as your websites.

You configure the CMP in the Gravito Configurator and publish; the same published configuration is then available as a deployment script for websites, a URL for apps that show the CMP in a WebView, a token for the Google Tag Manager template and a token for the WordPress plugin.

Every channel serves the same published version, from a stable address.

Each new version goes live at the same address, so nothing changes on the site itself.

Earlier versions can be restored from the version history.

Gravito Data Platform is a persistent first-party ID and key-value store that other systems can read from the dataLayer. It is not sold as a separate identity resolution product, but it does part of that work: it connects several deterministic IDs to one profile across your domains, and bridges profiles across devices, so the profile carries the ID graph.

It keeps a persistent first-party profile for your visitors, scores how they engage, and builds audiences from it, kept server-side in your own first-party context.

Gravito Data Platform →

As long as your configuration says: retention is set for each use case.

In the browser, the profile is set to renew after 364 days by default. A profile connected to a known visitor becomes a customer profile with retention settings of its own.

On your own pages, live: audience membership and scored preferences are available on the page, for personalisation and for any tool on the page that reads them.

Audiences are also delivered from the server in batches, pull or push.

No: it works with Gravito CMP, or alongside another consent platform.

Consent state travels with the profile.

Yes: Publisher Network IDs gives a publisher one persistent ID across the sites in its network, built from capabilities the platform already has.

The ID reaches header bidding through Gravito's Prebid User ID module, gravitoIdSystem (configured as gravitompId), which is part of Prebid.js.

Gravito Quality Signal gives each visit a verdict, human, bot or uncertain, and never blocks anything itself: your rules decide what happens.

Tags in Google Tag Manager can wait for the verdict and fire only for the visits you choose, acting on the verdict available at that moment. Visitors see nothing: there is no challenge and no puzzle to solve.

Gravito Quality Signal → · The full story at qualitysignal.gravito.fi

Yes: it can also be deployed on its own, next to another CMP.

Yes: the self-service configurator is fully equipped, and on WordPress you can start on your own. Most customers start with onboarding by our team.

Beyond a basic installation, we do not recommend running a CMP as self-service: the setup benefits from experience of how consent travels through a stack, and from discussing the regulations and how local authorities read them.

Over the lifetime of the service you choose who maintains the settings: your own team, our team, or a service provider you choose. Consulting after launch is part of every plan built with our team.

How we work →

In four steps: needs assessment, custom configuration, deployment, and ongoing support and consulting.

How we work →

Because we need to understand your stack, and whether we can run it well, and you need to get to know us.

How we work →

Yes: white-label is available for every Gravito product, and partner and reseller models are available on the same basis as our own delivery.

Partner and reseller models are set up with each partner.

Networks & platforms →

Yes: we deliver consent management in the way the customer requests, from dedicated servers to minute-level SLAs.

How we work →

Security and hosting →

We have built and deployed a Privacy Center for a customer and can discuss requirements.

Gravito CMP licence fees are on the Pricing page; Gravito Quality Signal is included in the plans built with our team. Gravito Data Platform, and Quality Signal on its own, are priced per engagement.

Implementation is a one-time fee, scoped per engagement. Consulting after launch is part of every plan built with our team, at the listed prices.

Custom infrastructure, SLAs, integrations, network setups and white-label are scoped with you in the same way, and Networks & platforms describes the white-label and partner models.

The prices on the Pricing page are indicative. Your price is set in your offer: if something about your sites should affect it, tell us, and we take it into account.

See pricing →

A session is one visit: a visitor arrives on your site and browses, until they have been away for a while, usually 30 minutes. Analytics tools count sessions in slightly different ways, so we agree the figure with you, usually from your own analytics. Gravito CMP does not record sessions itself: that would make it a visitor analytics tool. Visits by bots count too: the CMP runs on every visit, and the Quality Signal verdict can change what the CMP does on a visit, not whether it runs.

Pricing →

Not when the domains share one configuration. If your sites each run a configuration of their own, we price that with you.

Pricing →