# When Your CMP Vendor Changes Subprocessors, Your Consent Records Move Too

Source: https://cookiecitadel.com/blog/2026-11-06-cmp-subprocessor-change-records.html

[Home](../index.md) / [Blog](index.md) / When Your CMP Vendor Changes Subprocessors, Your Consent Records Move Too


Published 2026-11-06

Your CMP vendor sends an email: we have updated our subprocessor list. It reads like housekeeping, and most teams file it without reading past the first paragraph. It is not housekeeping. A subprocessor change means a new company is now processing your visitors' consent data, and your records of processing, your data processing agreement, and the notice your banner shows all describe a world that no longer exists until you update them.

The GDPR puts this on you, not on the vendor. Article 28 requires the processor to inform you of intended subprocessor changes and give you a chance to object, and Article 30 requires your records of processing to name the processors you use. A stale record is not a paperwork problem. It is the document a regulator reads first.

## What actually moves when a subprocessor changes

Consent data is more sensitive than it looks. A CMP stores the visitor's choices per purpose and vendor, the consent string, the timestamp, and often an identifier that ties the record to a browser or device. When a vendor adds a hosting subprocessor or a support tooling subprocessor, some or all of that moves to infrastructure you never evaluated. The vendor's email usually names the company and the service, and sometimes the country. Read it for the country first, because a move outside the EEA changes the transfer analysis, not just the name on the list.

Check your DPA for the objection window. Most DPAs give you a set period, commonly 14 or 30 days, to object to a new subprocessor, and silence counts as acceptance. Calendar the window the day the email arrives, not the day someone gets around to reading it. An objection filed after the window closes is a complaint, not an objection.

## The three documents to update

Your records of processing under Article 30: the processor list has to name the current subprocessors, not the ones from last year's audit. Your data processing agreement: if the DPA lists subprocessors by name, it needs the new name added, and if it authorizes them by category, confirm the new one fits the category. And your privacy notice: if it names the CMP or describes where consent data is stored, a hosting move to a new region makes that description wrong.

Then check the banner itself. Most banners do not name subprocessors, and that is fine. But if your banner or your preference center links to a vendor list that the CMP maintains, confirm the list updated on the same schedule as the email. A preference center showing last quarter's vendors while the CMP processes data through this quarter's is a transparency gap, and the TCF framework's whole point is that the vendor list is accurate.

## The check to run every quarter

Put subprocessor review on a quarterly schedule, not an email-driven one. Open the vendor's subprocessor page, compare it against your records of processing, and note any company that appears in one and not the other. The vendors that publish a dated change log make this easy. The ones that do not are telling you something about how they handle transparency, and it is worth weighing at renewal.

While you are there, check the TCF version at the same time. The v2.4 deadline for web CMPs passed on October 23, 2026, and a vendor that is behind on versions is often behind on paperwork too. One check, two answers, and both belong in the same quarterly note.

Keep reading: [Consent Evidence Is a Timeline. Keep the Versions.](https://cookiecitadel.com/blog/2026-11-05-consent-version-history-evidence.md), [The Video Loads Before Anyone Presses Play. Use a Facade.](https://cookiecitadel.com/blog/2026-11-05-embedded-video-consent-facade.md), and [Single Page Apps Break Consent in a Specific Place: The Route Change](https://cookiecitadel.com/blog/2026-11-04-spa-route-change-consent-recheck.md) cover the nearby cases in this series.

## Frequently asked questions

### What is a CMP subprocessor?

A company the CMP vendor uses to process data on its behalf, such as a hosting provider, a support tool, or an analytics service. Your visitors' consent records may pass through that company's systems.

### How long do I have to object to a new subprocessor?

It depends on your data processing agreement. Most DPAs give 14 or 30 days from notice, and silence counts as acceptance. Calendar the window the day the vendor's email arrives.

### Does a subprocessor change affect my privacy notice?

It can. If your notice names the CMP or describes where consent data is stored, a hosting move to a new company or region makes that description wrong. Update the notice alongside the records of processing.

### Where do I find my CMP's current subprocessor list?

On the vendor's trust center or legal page, usually under subprocessors. Compare it against your Article 30 records of processing every quarter and note any company that appears in one list and not the other.