A customer rejects advertising cookies on a retailer’s website in the morning. At lunch she opens the app, checks “email me weekly” and unchecks SMS. Later that evening, she replies STOP to a text she should not have received.
The customer makes three choices across three systems, but there’s no single place where the retailer can see what she actually agreed to.
That is the gap between consent management and preference management as most enterprises run them. Consent and preference management exists to close it, and the argument for holding both in one record has never been stronger.
What Is Consent Management?
Consent management is the practice of obtaining, recording, and enforcing a person’s legal permission to collect or use their data for a specific purpose.
On the web, that means a consent management platform (CMP):
- Controlling which trackers load
- Honoring signals such as Global Privacy Control (GPC)
- Keeping proof of each choice
Regulators test a CMP by watching what the site does after the choice is made. In September 2025, the French data protection authority fined a global fast-fashion retailer 150 million euros partly for placing cookies before visitors had chosen to “accept” or “reject” them, and for continuing to place cookies after visitors clicked “Refuse all.”
What Is Preference Management?
Preference management is the practice of letting people set how an organization communicates with them and uses their data beyond the legal minimum:
- Which channels
- Which topics
- How often
- For which purposes
A preference center is the customer-facing surface where those settings live and can be changed.
Where consent is a gate, a preference is a relationship setting. The two also overlap in law: under the GDPR, withdrawing consent must be as easy as giving it, and a preference center is often where people expect to do that.
Why the Two Are Usually Built Apart
Consent and preference management are usually treated as two systems that do not share an owner, a data model, or an identifier, so the same person exists as a cookie ID in one system and an email address in another.
That’s because consent tooling was bought by legal or web teams to answer cookie law, while preference tooling grew up inside marketing platforms to manage unsubscribes.
That split can work fine, until a choice made in one place has to be honored in the other. A person who withdraws consent for profiling has also, in substance, changed their marketing preferences, and a person who opts down to monthly emails has expressed something the CMP will never hear about.
What One Record Means in Practice
Having one unified record means a single, timestamped entry per person that holds their tracker consents, their purpose-level permissions, their channel and frequency preferences, and their privacy rights requests, with every downstream system reading from it rather than keeping its own copy.
Building that record is an architecture decision, not an integration project. This is how the Syrenis Platform, an enterprise-grade consent and preference management platform, is built:
- Tracker consent, the preference center, and the Privacy Rights Portal write to the same identity
- A cookie rejection, an opt-down, and a deletion request are three entries in one history
- Changes propagate to the CRM, marketing automation, and customer data platforms through integrations
- Confirmation flows back, and an audit trail shows when each choice arrived and where it was applied
This enables companies to answer a regulator at once: What did this person agree to, when, and did every system respond? It also means the customer sees her choices reflected consistently wherever she meets the brand, which is the foundation of good Privacy UX.
The Stakes for 2026
Recent enforcement, including the French fine above, has targeted the same failure: a choice that was recorded and then not honored across every system that touched the data.
Additionally:
- The maximum fine for cookie and direct marketing violations in the UK has risen from £500,000 to £17.5 million or 4% of global turnover
- More US states are requiring websites to recognize browser-level opt-out signals
- Half a million Californians have signed up for the state’s Delete Request and Opt-out Platform (DROP), which sends deletion requests to every registered data broker
All these factors raise the volume of choices arriving, and fragmented stacks tend to fail faster under volume.
Consent tells you what you are allowed to do with someone’s data, and preferences tell you what they want you to do with it.
Keep these systems apart, and each answers half the question a regulator, or a customer, will eventually ask. Bring them together in one record every system reads from, and they offer a clean, unified picture of what your customers actually want.
See One Record in Action
If your consent and preference data still lives in separate systems, the Syrenis Platform can bring it together in a single record that every system reads from, so each choice your customers make is honored everywhere it matters.
Book a demo to see how tracker consent, preference management, and privacy rights requests work from one identity, or talk to our team about where your current stack is falling short.