GDPR actually requires consent to be recorded for every vendor with whom user data will be shared. That list can run into hundreds, so most consent management platforms have instead decided to club them into broad categories. Users typically have the option to dive deeper and opt out on a micro-level, but it’s difficult to say how many top CMP vendors that follow IAB consent framework are actually GDPR-compliant if you go by the book.