Many advertising platforms are still not providing the clear and unambiguous consumer consent required by regulations such as the GDPR. As the Cornell study showed, cookie banners, for example, do not carry consent signals consistently to downstream vendors or maintain the audit trail you need to certify compliance.
A fascinating study by Fou Analytics tracked what happened when someone visited the New York Times website. On August 24, 2021, a visitor to the home page launched 254 ad server requests, which triggered a downstream flow of 127 tracking requests and 92 additional requests across more than 50 different third-party providers.
As a publisher, you have the ultimate responsibility to comply with legislation. If a third-party provider fails to do so, you are liable. By using a CMP instead of relying on vendors, you are better protected.