Google Tag Manager and Cookie Consent: How to Wire It Up Correctly

Starting in late 2023, Google introduced Consent Mode v2 (GCM v2), which added ad_user_data and ad_personalization controls into Google Tag Manager (GTM) that strictly limit access to personal data from EEA and UK users for ad personalization and remarketing. As one of digital “gatekeepers” under EU’s Digital Markets Act (DMA), Google updated GCM to meet DMA’s consent requirements, which, in turn, reinforce General Data Protection Regulation (GDPR) compliance requirements.

As of July 2026, the websites that failed to meet the updated GCM v2 requirements risk losing access to personalized ad delivery and accurate conversion measurement in Google Ads and GA4 and face GDPR penalties and fines from EU local authorities for non-compliance with cookie consent rules. In September 2025, France’s data protection authority (CNIL) fined Shein Group EUR 150 million for dropping advertising and tracking cookies before users interacted with their cookie consent banner and notwithstanding their “Reject All” selection.

To avoid enforcement risks for GTM misconfiguration, this guide explains how to wire up Google Tag Manager and cookie consent to configure the tags according to user preferences and achieve privacy compliance.

This article has been reviewed by data protection experts at Cookiebot by Usercentrics and reflects requirements in force as of July 2026.

What Setting Google Tag Manager for Cookie Consent Actually Means

Setting up Google Tag Manager for cookie consent lets tags and triggers respond accurately and compliantly to the consent preferences visitors select in a consent banner. Failure to wire up GTM correctly leads to compliance risks caused by tag governance issues. 

GTM operates with tags, or pieces of code deployed as plugins, and triggers, or conditions under which tags are allowed to fire. However, it expects marketers to manually set consent-gating scenarios to configure the tags and triggers – there is no in-built mechanism to check consent before firing a tag.

This way, cookie consent in Google Tag Manager creates the tag governance problem, shifting the focus from in-built tags and triggers to careful configuration of tag behavior in response to consent choices. It also raises a compliance issue: because Google Tag Manager is a neutral orchestration layer, the behavior of individual tags such as GA4, Meta Pixel, custom HTML, and other third-party scripts must be configured so they comply with GDPR accountability and consent requirements.

To help achieve GDPR compliance, you should implement a cookie consent banner on your website and configure GTM to only fire tags after the visitor has granted cookie consent.

What Is Google Tag Manager

Google Tag Manager (GTM) is a free Google tool for webmasters and marketers that lets them manage tags like Google Analytics, Google Ads, and third-party tracking codes on their websites without coding knowledge. Frequently referred to as container or an orchestration layer, Google Tag Manager provides the configuration framework needed to control when tracking tags and cookies fire so they can align with GDPR cookie consent requirements.

Here are the domains that Google Tag Manager helps you orchestrate:

• Analytics and measurement: Managing GA4 consent mode, firing conversion tracking for Google Ads, form submission tracking
• Advertising and remarketing: Social media plugins deployment, remarketing tags, conversion tracking
• User behavior: Heatmap and session-recording tags, A/B testing functionality
• Governance: HTML tags, server-side tracking

With GTM, website owners can regulate when tags that set tracking cookies are allowed to run and measure visitor behavior on website pages for analytics and marketing purposes. Still, respecting consent rules is key to configure the tool in a compliant manner.

Is Google Tag Manager GDPR-Compliant?

By default, Google Tag Manager doesn’t use cookies, so it doesn’t need consent and is GDPR-compliant. The only exception is when you enable Preview and Debug mode, in which case GTM sets several first-party cookies in your browser that are required for the preview functionality and are not seen by regular site visitors.

In other cases, GTM is a container where website owners configure tags which, in their turn, can set cookies that require consent to comply with data privacy regulations like GDPR.

That’s why, although the GTM container itself doesn’t set tracking cookies or require cookie consent, many of the tracking tags added through GTM (such as analytics and advertising tags) do rely on cookies and therefore must be connected to a consent banner and configured to respect visitors’ choices.

What Is Google Consent Mode

Google Consent Mode v2 is a communication protocol that adjust GTM tags according to visitors' consent choices on a cookie banner. This open API works with Google products like Google Analytics, Floodlight, Conversion Linker, and Google Ads and can signal consent state to third-party tags.

Signaling valid visitor consent to Google via Consent Mode before running personalized ads is a Google requirement, and website owners are required to configure this signaling from their side.

There are two types of Consent Mode implementation available:

• Basic Consent Mode: Blocks all Google tags until the consent is granted, which means receiving no data from the majority of website visitors. Basic implementation may work for small websites that want the simplest compliant setup, as on scale, it means severe data gaps for marketing activities.
• Advanced Consent Mode: Reacts to declined visitor consent by running Google tags in a restricted way and sending cookieless pings to Google servers so that they can fill the gaps by using statistical modeling for Google Ads campaign planning. Advanced implementation is recommended for businesses that invest significantly in Google Ads.

With Consent Mode properly configured, marketers can help confirm that website behavior respects visitor preferences and meets data privacy law requirements.

Four Google Consent Signals and GTM Mechanics That Enforce Them

Used together, Google Consent Mode (GCM) signals and Google Tag Manager (GTM)  consent features help website owners meet two key objectives: comply with regulatory requirements and confirm tags behave according to users’ consent choices.

Google Consent Mode v2 signals tell Google tags what decision the visitor made about consenting to use of their personal data:

• ad_storage: A consent parameter for advertising purposes.
• analytics_storage: A consent parameter for analytics and behavioral measurement.
• ad_user_data: A consent parameter for sending personal data to Google for advertising purposes.
• ad_personalization: A consent parameter for personalized advertising purposes.

The broader set of Consent Mode signals, including four signals required for ad personalization compliance and three granular signals for finer website controls, is in the table below.

In the Google Tag Manager, several features help manage and gate the GCM signals in response to consent settings:

1. Consent initialization trigger: Confirms all consent settings are honored before any other triggers fire.
2. Tag consent settings: Customize consent settings for tags with built-in or additional consent checks.
3. Consent Overview page: Provides a high-level view of all the consent settings for easier governance.
4. CMP template integrations: Certified consent management platforms (CMPs) with built-in integrations for Consent Mode in their products.

How a CMP Configures Google Tag Manager for GDPR Cookie Consent

A consent management platform (CMP) helps support legal compliance with GDPR and other data privacy regulations and facilitate wiring up Google Tag Manager to respect consent preferences from visitors. A Google-certified CMP helps you present a consent banner, collect visitors choices, and communicate consent signals to Google Consent Mode so that tags in Google Tag Manager and Google products can adjust their behavior accordingly. It can also help integrate other marketing tools in a consent-aware way.

In contrast to manually configuring trigger exception features in GTM, a CMP can be a more convenient and reliable option for governing consent-driven tag behavior. 

Cookiebot by Usercentrics is a Google-certified CMP (Golden Badge) and #2 in the rating of best CMPs in 2026 on a peer-review site G2 (as of July 2026). Here’s how to wire Cookiebot by Usercentrics into GTM and configure it to respect visitors’ consent preferences on your website.

Wiring Cookiebot by Usercentrics into Google Tag Manager

Here is how to connect the consent banner with the set of tracking tags in Google Tag Manager and set up Google Consent Mode to connect the two:

1. Set up CMP: Enter your Cookiebot by Usercentrics account, add the domain, and copy the ID number in the Implementation menu. In the dashboard, navigate to Settings > Integrations and enable Google Tag Manager deployment.

2. Set up Google Tag Manager: Create the Google Tag Manager account with your Google account. Select Web for your container while creating a new account. Click Submit > Publish to publish the container and get the code to add to your website.

3. Enable consent overview: Go to your Google Tag Manager and follow Admin > Container Settings > Additional Settings to launch Consent Mode configuration.

4. Create a new tag for Cookiebot CMP: In the Tags menu, press “New” and add Cookiebot CMP from the templates available. On the same page, add Cookiebot ID from your account and choose a firing trigger Consent Initialization – All Pages so that it executes before regular tags.

5. Confirm Google Consent Mode is enabled: Go to the Default Consent State and click “Add region” to set opt-in vs opt-out rules for different jurisdictions.

6. Configure right triggers for GTM tags: Go to Triggers > Custom Events, set New Trigger and put cookie_consent_update for all custom events.

7. Configure Google Tag Manager to respect GDPR requirements: Click Save and put this trigger instead of the All Pages triggers on all the tags that track user behavior or send data to third-party platforms. This way, pixels fire only after the visitor has given consent through the cookie banner.

8. Customize consent settings for social media, Hotjar, Microsoft, and HubSpot pixels for your website: The exact list of tags you’ll need to add manually is shown below.

You can leave Google Tag, Consent Initialization Tags, and GTM configuration tags with All Pages, as Google respects these consent rules there by default.

Testing the Setup Before You Publish

Testing the setup in Google Tag Manager is the essential step before publishing the changes, as you can test how it reacts to user preferences in real time and validate the tags and triggers act in a compliant manner.

Here is how to test the setup in GTM:

1. Enable Google Tag Manager Preview Mode: In GTM, click Preview to enter Debug Mode.

2. Go to your website and run different user choices: In a new tab, confirm the Cookiebot by Usercentrics consent banner appears immediately and offers users three consent options.

3. Confirm the correct tags are firing on user consent: On the pageview event in Tag Assistant’s Consent tab, you can trace how the cookie consent state reacts to interaction with the cookie consent banner on your website: you’ll see G100 if consent is not collected and G111 if consent is collected.

Once ready, click Submit > Publish to make your changes live.

How to Set Up GA4 Consent Mode with Cookiebot

For wiring up GA4 Consent Mode, you need to have a Cookiebot account, installed and published GTM container, and properly installed Google Analytics 4 (GA4):

1. Configure GA4: Go to your Google Analytics account and add your website URL to generate the Measurement ID in the G-XXXXXXX format to use in GTM (you can find it under Data collection and modification > Data streams > Web stream details).

2. Install Cookiebot Script in GTM: Go to Tags menu and install it from the template. Choose Consent Initialization – All Pages as a trigger.

3. Enable consent mode: Add a tick near “Enable consent mode” in Admin > Container Settings > Additional Settings. 

4. Configure new tag for G4 Consent Mode: Paste the Measurement ID into the tag and choose a firing trigger Initialization – All Pages at the Triggering field

5. Confirm legal compliance signal: While configuring and testing tags and triggers in GTM, check the required Consent Mode signals (ad_storage, ad_user_data, ad_personalization, and analytics_storage) and additional consent is triggered accordingly.

To track specific events, you can create a custom GA4 Event Tag in GTM (under Tags > New > Google Analytics) and configure it manually. Confirm the analytics_storage signal respects user consent in the Consent Overview.

Common Mistakes with Setting Up Google Tag Manager and Cookie Consent

Though usinga CMP like Cookiebot by Usercentrics makes wiring up GTM for cookie consent easier, keep these common mistakes in mind to help it work properly:

1. Running on Basic Consent Mode while scaling: Basic Consent Mode implementation is compliant but may hurt your marketing activities. Activating an Advanced Consent Mode lets you respect privacy choices yet runs statistical modeling for more accurate measurement.
2. Relying on manual GTM setup instead of getting a CMP: Manual setup of GTM requires understanding nuance in tags – for example, the _ga cookie may be used both under legitimate interest (do not require consent) and for marketing purposes (that requires consent). A CMP helps automate legal compliance and communicates the correct consent signals to GTM.
3. Disabled Consent Overview in GTM: To facilitate and accelerate configuring Cookiebot by Usercentrics in GTM, confirm it’s enabled in Additional settings under Container setting on your domain in the Admin menu.
4. Placing too many tags: Keep the tag number minimal to avoid complex sequencing and blocking triggers, maintain satisfactory website SEO performance, and support regulatory compliance. Regularly review and audit the tags in the container and remove unnecessary ones.
5. Running new setup without testing it: Use Google Tag Manager’s debugging tools to test and optimize the tags before publishing the changes on your website.

How Google Tag Manager, GDPR, Cookie Consent and Google Consent Mode Benefit Online Businesses

The key advantages of configuring GTM so it respects compliance regulations and cookie consent preferences include:

1. Avoiding penalties and legal risks: Compliance with privacy laws helps businesses avoid fines and warnings from global regulations like GDPR and CCPA.
2. Reinforcing visitors trust: A compliant cookie consent banner enables clear communication with website visitors and respects their preferences, which contributes to building customer loyalty.
3. Better marketing performance: Once enabling Advanced Consent Mode, marketers can maintain balance between data privacy and the need for data-driven initiatives. It lets you collect anonymized data under denied consent that doesn’t disclose personal information yet remains insightful for decision-making.
4. Staying ahead of regulatory change: Businesses that respect consent requirements early gain an advantage as regulations continue to change.

With Cookiebot by Usercentrics, you can get a Google Gold Tier-certified cookie consent solution that already serves over 2.4 million websites across 195 countries and facilitates wiring up GTM for cookie consent. Here is what’s inside it:

• Google Consent Mode v2 integration by default
• Easy set up via Cookiebot CMP template in Google Tag Manager
• TCF-specific features 
• Integrations with analytics platforms like GA4 and content management systems like Shopify and WordPress
• Automatic website scans and updates for cookies and trackers
• Supports privacy compliance with multiple data privacy regulations
• Geolocation settings to display a cookie banner based on visitor’s location and relevant data privacy law in their jurisdiction.

Check out the support options for Cookiebot by Usercentrics to see more information on how it can support your website.

Legal disclaimer: Cookiebot by Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.