Consent Mode v2 and CMPs in Google Tag Manager

#01The four parameters you must know

Per Google’s consent mode documentation:

Additional types exist (functionality_storage, personalization_storage, security_storage) for finer CMP setups.

#02Default then update

Google’s template guidance: set defaults immediately using the Consent Initialization - All Pages trigger, then update when the user chooses. Defaults for EEA traffic are often denied until grant — align with legal counsel and your CMP’s regional rules.

Caveats. Using raw gtag('consent', ...) inside Custom HTML can queue later than you think. Google’s template docs recommend Tag Manager consent APIs (setDefaultConsentState, updateConsentState) inside sandboxed templates.

#03CMP options

1. Community Template Gallery CMP that supports Consent Mode v2 (Cookiebot, OneTrust, and others — verify current gallery listings).
2. Custom consent template built by your developers per Google’s consent template APIs.
3. Banner outside GTM that still calls the consent update APIs in a supported way.

Whatever you pick, the banner must appear promptly and record choices for all required types.

#04Basic vs advanced (marketer summary)

Covered in depth in GA4 Consent Mode v2 and Ads consent mode:

• Basic: wait for consent before firing storage-using tags; less modelling signal.
• Advanced: tags may send cookieless / limited pings when denied; Google may model gaps when requirements are met.

Your legal and analytics leads should choose deliberately. GTM implements the plumbing either way.

#05Tag consent settings

In GTM, tags can require specific consent types to fire. Built-in Google tags are generally consent-aware. Custom HTML tags often need additional care — they may not magically know consent unless you gate them with consent checks or Consent Mode-aware templates.

Our view: treat unmanaged Custom HTML pixels as the highest consent risk in the container. Replace with templates where possible.

#06Server-side note

With server-side tagging, Google documents that consent is typically established in the web container and passed to the server. You still configure Consent Mode properly client-side (lesson 17).

#07Worked example: Ledgerline

Ledgerline is a fictional accounts-payable software company. Details are illustrative.

Ledgerline’s CMP showed a banner but never fired updateConsentState for ad_user_data and ad_personalization. Ads conversion modelling looked odd after policy enforcement dates. Updating the CMP template to v2 parameters restored expected consent signals in Tag Assistant.

They also found a Custom HTML LinkedIn tag firing regardless of consent. It was moved behind additional consent checks / a consent-aware template approach.

Walkthrough

1. In Preview, open a fresh session from an EEA test VPN or region setting if you use regional defaults.
2. Before interacting with the banner, inspect consent state in Tag Assistant / GTM consent debug.
3. Accept ads + analytics; confirm updates flip to granted for all four v2 params.
4. Reject all; confirm Google tags respect denied storage behaviour.
5. Publish only after legal signs off the banner copy and categories.

#08Regional defaults

You can set different default consent by region (for example deny ads storage in EEA, grant in regions where your policy allows different defaults). Mis-set regions cause either compliance risk or unnecessary data loss. Legal owns the matrix; GTM implements it.

#09Modelling expectations

Advanced mode may allow Google to model conversions when requirements are met — it is not magic recovery of every denied hit. Read the GA4 lesson for what modelling can and cannot do. Never promise finance "Consent Mode restores 100%".

#10Tag Assistant consent debugging

During Preview, confirm each Google tag’s consent status on grant and deny paths. If a Custom HTML tag still fires under deny for ad storage, treat it as a defect even if "everyone uses that pixel".

#11CMP template updates

CMP vendors ship Consent Mode v2 template updates. Pin a quarterly reminder to check the Community Template version and release notes. An outdated template is a quiet compliance risk.

#12Custom HTML pixels under consent

For each Custom HTML tag, ask: does it understand Consent Mode? If not, either replace it with a consent-aware template, wrap firing in additional consent checks, or remove it. "We'll fix consent later" is how containers fail audits.

#13Implementation sequence that fails less often

1. Legal signs off default states by region.
2. Install CMP with official GTM template (or vendor-supported pattern).
3. Confirm Consent Initialization tag / default runs first in Preview.
4. Map banner categories to the four v2 parameters.
5. QA grant path and deny path with Tag Assistant consent debug.
6. Only then enable Ads remarketing tags that depend on storage.
7. Document the matrix in the same sheet as the event dictionary.

Skipping step 1 and "just denying everything globally" can kneecap measurement outside the EEA without legal benefit. Skipping step 5 ships a pretty banner that never updates GTM state.

#14Wait for update vs fire anyway

Advanced Consent Mode may send cookieless pings when denied (per Google’s model). That is different from firing a raw Meta Pixel Custom HTML that ignores consent. Treat Google’s Consent Mode-aware tags and rogue Custom HTML differently in the audit.

#15Coordination with Meta and others

Consent Mode is Google’s API. Meta, LinkedIn and TikTok need their own consent handling via CMP integration or trigger conditions. A green Consent Mode setup does not automatically silence a Custom HTML pixel. Inventory every non-Google tag against the CMP.

#16Banner UX that breaks consent wiring

Watch for:

• Soft walls that let users browse without a choice while tags already set granted defaults.
• "Accept all" that updates UI only and never calls updateConsentState.
• Preference centre toggles that do not map to ad_user_data / ad_personalization.
• Geo mis-detection showing the wrong banner script.

Have legal and marketing ops click through together with Tag Assistant open once per quarter.

#17Documentation pack for auditors

Keep: CMP contract + DPA, parameter matrix, screenshots of deny/grant Tag Assistant, list of tags with Additional Consent Checks, and the date of last template update. When a prospect’s security questionnaire asks about tracking consent, you answer from this pack — not from memory.

#18Google tags vs non-Google tags under consent

Consent Mode primarily governs Google tags (Google tag / GA4, Ads, Floodlight, and other consent-aware Google tags). A Custom HTML Meta Pixel, LinkedIn Insight Tag, or TikTok Pixel does not automatically become compliant because you enabled Consent Mode v2. For those:

• Use CMP integrations that gate their scripts, or
• Apply GTM Additional Consent Checks on the tag (where the tag type supports it), or
• Fire only on a Custom Event your CMP pushes after the relevant category is granted.

Audit non-Google tags as a separate column in the inventory sheet: consent_method = CMP script | additional check | custom trigger | NONE. Anything marked NONE is a finding.

#19Basic vs advanced — decision framing for marketers

Basic: tags wait until consent updates. Simpler mental model; less data before consent.

Advanced: tags may load in a restricted way before consent and send cookieless or limited pings; when the user grants, behaviour upgrades. Google may model conversions when eligibility requirements are met — modelling is statistical, not a full restore of every denied hit. Read the modelling caveats in the GA4 consent and modelling material and never promise finance a fixed recovery percentage.

Pick basic vs advanced with legal + analytics together. GTM implements the choice; it should not invent it.

#20Try it yourself

List every non-Google tag in the container. Mark each Consent Mode aware / unknown / not aware. Make a plan for the unknowns.

#21Quick quiz

1. Name the two Consent Mode v2 parameters added beyond ad_storage and analytics_storage.

Answer: ad_user_data and ad_personalization.

2. Which trigger is used for consent defaults?

Answer: Consent Initialization - All Pages (for setting defaults early).

3. Does a banner alone equal Consent Mode?

Answer: No. The CMP must communicate choices via consent APIs to Google tags.

#22What should you check before the next lesson?

• CMP supports v2 parameters.
• Defaults fire on Consent Initialization.
• Tag Assistant shows expected grant/deny behaviour.

Previous: Meta Pixel and CAPI basics. Next: Form, click and scroll tracking. Or return to the GTM for Marketers track.

#23Common questions

What changed in v2? Added ad_user_data and ad_personalization.

Basic vs advanced? Timing/limited pings and modelling trade-offs — see GA4 lesson.

Banner = Consent Mode? No; need API updates.