Termly's consent management overview covers the basics. This article goes one level deeper: consent management in 2026 is an architectural commitment, not a banner you bolt on at the end. Three components that need to work together.
The three layers of a consent architecture
1. Capture layer
The visible banner or modal where the user makes the choice. CMP tools (OneTrust, Cookiebot, Termly) handle this. The choice categories must match what your product actually does.
2. Storage layer
The record of what the user consented to, with timestamp, version of the policy they saw, and exact categories. This is the evidence layer when a complaint arrives.
3. Propagation layer
The mechanism that prevents non-consented trackers from firing. If your CMP captures "reject analytics" but Google Analytics still loads, you have a propagation failure regardless of the capture.
| Layer | What good looks like | Common failure |
|---|---|---|
| Capture | Symmetric Accept/Reject, granular categories | Pre-ticked boxes, dark patterns |
| Storage | Versioned, timestamped, queryable | Just a cookie flag, no audit log |
| Propagation | Trackers gated by consent state | Capture says reject, scripts still fire |
What the 2026 audits check
Authorities increasingly inspect all three layers. A clean banner with broken propagation fails as badly as a missing banner. Top findings in 2025:
- Analytics fires before consent decision (40% of audited sites)
- Storage missing version of the policy seen at consent time (30%)
- Withdrawal of consent does not propagate to sub-processors (25%)
The biggest gap is the propagation layer. CMPs sell the capture and storage well; very few enforce propagation across all categories. Test by setting your browser to reject all, then check the network tab. If you see Google Analytics, you have work.
What to add to your privacy policy
- Description of the CMP used and the categories offered
- Where the consent record is stored and for how long
- How users can revoke consent after granting it (must be as easy as granting)
- What happens to derived data if consent is withdrawn (deletion vs anonymisation)
Conclusion
A consent banner is an artifact. Consent management is an architecture. SaaS that ships only the banner passes the surface inspection and fails the technical one. Invest in propagation; it is the gap most competitors have.
To structure your privacy policy with a consent section that maps to a real three-layer architecture, try Termerly free.