Setting up cookie consent in Google Tag Manager (GTM) means gating every tracking tag behind a visitor's consent choice, not blocking GTM itself. Consently does this in seven steps: install a Custom HTML tag, sequence your trackers, and let Consently drive Google Consent Mode v2 automatically.
Below: whether GTM itself needs consent, what to prepare in Consently first, the full step-by-step setup, and how Consent Mode compares to older blocking-trigger methods.
Does Google Tag Manager Need Cookie Consent?
Google Tag Manager itself sets no cookies and needs no consent to load. The tags it fires, including GA4, Google Ads, and Meta Pixel, do set cookies and process personal data. You must gate those tags on consent before they fire.
GTM's only exception is Preview and Debug mode, which sets a few first-party cookies required for the debugging session itself. Some regulators and courts in the EU have argued that loading GTM itself can count as processing personal data. Their reasoning: the container script can transmit a visitor's IP address and execute JavaScript before any tag fires. Treat that as an emerging legal position, not a settled rule everywhere, and gate GTM's own load behind consent where your legal counsel recommends it.
Either way, the practical fix is the same: sequence every tracking tag behind consent and let Consent Mode carry the signal. Here's how to do it in Consently.
What You Need Before You Start in Consently
You need a Consently account on any plan, a Consently site added under Sites, and a GTM container already installed on your site. Cookie consent, GTM install, and Consent Mode v2 are included on every Consently plan.
Plan required: GTM installation, Consent Mode v2, script and iframe blocking, and IAB TCF 2.3 support are on Basic ($8.25/month), Premium ($16.50/month), and Enterprise ($41.50/month). The multi-site dashboard for managing many client containers from one account is Premium and Enterprise only.
Features you'll use in this guide:
- Consently's embed script for the banner and blocking logic
- Google Consent Mode v2, enabled automatically once the script loads
- Script and iframe auto-blocking, active on every plan by default
Where to start: In Consently, open Sites and confirm your website is added. In GTM, open the container already installed on your site, or install GTM first if you have not yet. If you are not running GTM at all, the general guide to add a cookie banner to your site covers direct-install routes instead.
Not using Consently yet? Start a free trial and follow this guide as you add your first site. No credit card required.
For the deeper legal question of whether GTM is GDPR compliant on its own, that guide covers the current case law. Gating GTM tags is one piece of complying with cookie laws across your whole site.
How to Set Up Cookie Consent in Google Tag Manager With Consently: Step by Step
Here is the full setup, from copying your banner script to publishing the container.
Step 1: Copy Your Consently Banner Script
Copying your script is the only step outside GTM. In Consently, go to Sites, click the three-dot menu next to your website, and select Embed Script, then Copy.
The script loads Consently from its CDN and carries a unique data-bannerid attribute tied to your banner configuration. It is wrapped in <!-- Start Consently Banner --> and <!-- End Consently Banner --> comments. Leave those comments in place when you paste the script in Step 2.
Done: the script is on your clipboard, ready to paste into a GTM tag.
[Screenshot: the Embed Script modal in Consently with the Copy button] Alt: Consently Sites dashboard showing the Embed Script modal for a website. The banner script is visible with a Copy button in the top right corner.
Step 2: Create a Custom HTML Tag in GTM
In GTM, go to Tags, click New, and name it "Consently Consent Banner". Under Tag Configuration, select Custom HTML, then paste the script you copied in Step 1 into the HTML field.
Do not click Triggering yet. Save the tag as a Custom HTML tag first so GTM recognizes the script correctly.
Done: a saved Custom HTML tag holds the Consently script, with no trigger attached yet.
[Screenshot: the Custom HTML tag with the script pasted] Alt: Google Tag Manager tag configuration screen showing Custom HTML selected as the tag type. The Consently embed script is pasted into the HTML code field.
For platform-specific install notes beyond GTM, see Consently's Google Tag Manager installation guide.
Step 3: Fire the Consently Tag on All Pages, Before Everything Else
Open the tag's Triggering box and select All Pages. This makes Consently the first thing that runs on every page load, before any tracking tag has a chance to fire.
Firing first matters because Consently needs to set the default (denied) consent state before a tracking tag reads any consent signal. It also needs to start blocking non-essential scripts at that point. A tracking tag that fires even one request before Consently loads can set a cookie or send data with no consent decision recorded.
The one rule that matters most here: never let a marketing or analytics tag fire before this one.
Done: the Consently tag triggers on All Pages and loads ahead of every other tag in the container.
[Screenshot: Triggering panel showing the All Pages trigger selected for the Consently tag] Alt: Google Tag Manager triggering configuration panel. The All Pages trigger is selected for the Consently Consent Banner Custom HTML tag.
Step 4: Sequence Your Tracking Tags to Wait for Consent
Every tracking tag in your container, GA4, Google Ads, Meta Pixel, and any others, needs to wait for Consently before it fires. Two paths get you there, and most setups use both.
| Approach | How you set it up | Best for |
|---|---|---|
| Tag Sequencing (Setup Tag) | On each tracking tag, open Advanced Settings, then Tag Sequencing, and set the Consently tag as the Setup Tag that must fire first | Any tag, Google or third-party |
| Consent Mode (Step 5) | Consently sets the consent state automatically; Google tags read it natively through their built-in consent checks | Google tags: GA4, Google Ads, Floodlight |
Google tags check consent state on their own once Consent Mode is active. Tag Sequencing is most useful for non-Google tags instead, like Meta Pixel, LinkedIn Insight Tag, or a custom analytics script with no native consent awareness.
Do not just switch on a page-wide "auto-block everything" setting in a CMP and walk away. Done bluntly, that kind of blanket blocking can stop GTM itself from firing any tag, even ones a visitor already allowed. Sequencing plus Consent Mode is the controlled way to gate tags without breaking the container.
Done: no marketing or analytics tag in the container can fire before consent is resolved, one way or the other.
[Screenshot: Tag Sequencing with Consently set as the Setup Tag] Alt: Google Tag Manager Advanced Settings panel showing the Tag Sequencing section. Consently Consent Banner is selected as the Setup Tag that must fire before the current tag.
To confirm you actually block cookies before consent, follow the dedicated testing walkthrough after you finish this setup.
Step 5: Let Consently Handle Google Consent Mode v2
Consently enables Google Consent Mode v2 automatically. There is no gtag('consent', ...) code to write and no extra GTM tag to configure for the signal itself.
Once your script loads, Consently sends the default state as denied, then updates four consent types the moment a visitor chooses: ad_storage, analytics_storage, ad_user_data, and ad_personalization. Accepting the Advertising category in the banner grants all three ad-related signals at once; accepting the Analytics category grants analytics_storage. Rejecting a category denies its matching signals the same way.
Done: Google tags in your container read consent state without any manual gtag code from you.
For the deeper setup, including the basic-versus-advanced distinction and how to fix a broken manual configuration, see the dedicated Consent Mode guide.
[Screenshot: Consent Mode v2 status shown as active in Consently] Alt: Consently site dashboard showing Google Consent Mode v2 status as active. The Advertising and Analytics categories are mapped to their consent signals.
Step 6: Test the Setup in GTM Preview and Tag Assistant
Open an incognito window, start GTM Preview, and load your site. Confirm in Preview that the Consently tag fires first, before any other tag.
Turn on GTM's built-in audit view first. Go to Admin, then Container Settings, expand Additional Settings, and check Enable consent overview. Back in your workspace, click the shield icon at the top of the Tags list to open the Consent Overview. It separates tags that have consent checks from those that do not. That view is how you spot a tracking tag that slipped through ungated.
Next, open Google Tag Assistant and enter your site's URL. Let the banner load without accepting anything yet.
In Tag Assistant's Summary, select the earliest Consent event. Check the API Call section: ad_storage, ad_user_data, ad_personalization, and analytics_storage should all show as denied. Accept the banner, then select the most recent Consent event. Confirm those same four parameters updated to granted.
In your browser's developer tools, filter the Network tab for consently.js and confirm it returns a 200 status. Check Application, then Cookies, and confirm no non-essential cookies (analytics, advertising, social) are present before you accept the banner.
Finally, return to your Consently dashboard's Consent Log and confirm your test action appears with the correct timestamp, location, and consent status.
Done: tags stay withheld until consent, then fire correctly once granted.
[Screenshot: Tag Assistant showing consent state as denied before acceptance and granted afterward] Alt: Google Tag Assistant Consent tab showing the four consent parameters. Denied in the earliest Consent event. Granted in the most recent Consent event.
To verify GA4 specifically receives the signal, see how to collect consent for Google Analytics.
Step 7: Submit and Publish Your Container
In GTM, click Submit, add a version name and description, and click Publish. Your consent setup is now live on the site.
Re-test on the live site after publishing, using the same Tag Assistant steps from Step 6. Preview mode and the live container can occasionally behave differently under real network conditions.
Done: the consent-gated container is published and running for every visitor.
Two Ways to Gate Tags in GTM: Consent Mode vs Blocking Triggers
GTM offers two fundamentally different ways to stop a tag from firing before consent. Mixing them without understanding both causes most of the "my tags stopped working" problems.
| Approach | How it gates tags | Effort | When to use |
|---|---|---|---|
| Consent Mode + built-in consent checks | Google tags read the consent state Consently sets and adjust automatically; no trigger changes needed | Low, once Consently is installed | Google tags: GA4, Google Ads, Floodlight |
| Blocking or exception triggers + custom event trigger | A trigger fires only after a data layer event confirms consent, physically preventing the tag from executing | Higher, manual trigger and variable setup per tag | Non-Google or legacy tags with no native consent awareness |
Consent Mode is the current, Google-recommended path for Google's own tags. Their built-in consent checks read the signal Consently sends and hold the tag until the right consent type is granted. Blocking and exception triggers are the older method, built before Consent Mode existed. They still matter for non-Google scripts that have no consent awareness of their own.
Mixing both on the same Google tag causes timing conflicts. Google's guidance names exception triggers and additional consent checks as the two most common causes of a tag that stays blocked. Even after a visitor grants consent, the tag may fire too early, then refuse to re-fire.
If a Google tag will not fire after consent is granted, check its Consent Settings dropdown under Advanced Settings on the tag. It offers three values: Not set (default, no extra checks), No additional consent required, or Require additional consent for tag to fire. The last option only lets the tag run once every listed consent type shows granted.
To see which method each tag uses at a glance, open GTM's Consent Overview. It is the shield icon on the Tags list, once you enable it in Container Settings. The view flags any tag with no consent checks configured, which is exactly where an ungated tracker hides.
Consently Features That Make GTM Consent Airtight
Beyond the seven-step setup, Consently ships four capabilities that close the gaps a basic GTM install leaves open.
- Automatic Consent Mode v2, zero code. No
gtag('consent')calls to write or maintain as Google updates the spec. - Script and iframe auto-blocking. Consently blocks non-essential scripts and embeds site-wide before consent, including hardcoded scripts sitting outside GTM entirely, so a forgotten inline script cannot bypass your GTM gating.
- IAB TCF 2.3 support. For ad-tech and publisher sites running programmatic advertising, Consently signals standardized consent to the full vendor list, not just Google.
- Multi-site dashboard for agencies. Premium and Enterprise plans manage GTM consent setups across every client container from one Consently account, using the same script pattern per site.
[Screenshot: Consently dashboard showing script and iframe blocking status alongside the multi-site selector] Alt: Consently multi-site dashboard showing the site selector for managing client websites. Script and iframe blocking status indicators are visible for the active site.
See how Consently works with Google Tag Manager, from install to Consent Mode, for the full feature walkthrough.
Consently Tips for a Clean GTM Consent Setup
The single most impactful habit is loading Consently first on every page, every time you edit the container. A new tag added later can silently jump ahead of it if you are not careful.
- Load Consently first, always. Every time you add a new tag to the container, re-check that its trigger cannot fire before the Consently tag's All Pages trigger. Sequencing beats a page-wide auto-block for keeping this true as the container grows.
- Do not double-block. If Consently already governs script and iframe blocking, do not also switch on a separate CMP's page-wide auto-block. Running both at once is what kills GTM's own tags, not just the ones you meant to gate.
- Let Consent Mode handle the Google tags. Reserve Tag Sequencing and exception triggers for non-Google scripts. Adding manual triggers on top of a Google tag that already reads Consent Mode natively is what causes the timing conflicts Google warns about.
- Understand the Consent Settings dropdown before you touch it. "Not set" still respects a tag's built-in consent checks. Switching to "Require additional consent for tag to fire" without listing every relevant consent type can block a tag that should have fired.
- Re-scan after publishing. Consently scans your site weekly by default, but a new tag added in GTM after your last scan still needs to be caught and categorized. Run a manual scan right after any container change that adds tracking.
FAQs
Does Google Tag Manager set cookies?
No. GTM itself sets no cookies except a few first-party ones during Preview and Debug mode. The tags it fires, like GA4 and Google Ads, are what set cookies and need consent gating.
Do I need a separate consent tag for every tracking tag in GTM?
No. With Consently and Consent Mode v2, Google tags read the consent signal natively through their built-in consent checks. You only need Tag Sequencing or an exception trigger for non-Google scripts that have no native consent awareness.
Is Google Consent Mode v2 included on the Consently free trial and all plans?
Yes. Consent Mode v2, IAB TCF 2.3 support, and GTM installation are included on Basic, Premium, and Enterprise. The 14-day free trial includes full feature access and requires no credit card.
Why do all my GTM tags stop firing after I turn on cookie blocking?
This usually happens when a page-wide auto-block setting in a CMP blocks GTM's own execution, not just the tags you meant to gate. Use Tag Sequencing plus Consent Mode instead of a blanket auto-block so only the tags that need consent are held back.
Do I have to write any gtag('consent') code with Consently?
No. Consently sets the default consent state and sends updates to Google automatically once the script loads, with no manual gtag configuration required.
What is the difference between "Not Set," "No additional consent required," and "Require additional consent" in a tag's Consent Settings?
"Not set" is the default and runs only the tag's built-in consent checks. "No additional consent required" lets the tag fire without extra verification beyond those built-in checks. "Require additional consent for tag to fire" blocks the tag until every consent type you list shows granted at the moment the tag triggers.
Can I manage cookie consent across many client GTM containers from one Consently account?
Yes, on Premium or Enterprise plans, using the multi-site dashboard. Each client site gets its own script and banner configuration, managed from a single account and site selector.
Is it legal to load GTM before consent?
Generally, yes, because GTM itself is a script-loading tool that sets no cookies on its own. The tracking tags it fires are what require prior consent under GDPR and similar laws. Some regulators and at least one European court have argued otherwise. Loading GTM itself can require consent, they say, because the container can transmit a visitor's IP address before any tag runs. The dedicated legal guide above covers this position in full.
Consently sets up cookie consent in GTM without hand-written gtag code, then keeps every tag gated as your container grows. Start your free 14-day trial using the link above, no credit card required. See the feature overview above for the full Consently and GTM walkthrough.
