Google Tag Manager and GDPR cookie consent setup

Whether Google Tag Manager meets the GDPR depends on what it loads: it is a tool, and what makes a setup lawful is whether the tags it loads wait for consent. Google Tag Manager (GTM) does not set tracking cookies by itself. It acts as a delivery system for scripts and pixels that write data to a visitor's browser. Even the container is debated: in March 2025 a German court held that loading GTM itself needs consent.

When you add a Facebook Pixel or Google Analytics tracking code to your website, GTM controls when and where these scripts execute. Privacy regulators view the site owner as the data controller responsible for what these third-party scripts do. If a tag deployed through GTM writes data without prior permission, the website owner faces the legal consequences. Enforcement keeps returning to tags that fire too early.

In November 2025 the French CNIL fined the publisher of vanityfair.fr 750,000 euros because cookies needing consent were set as soon as visitors arrived, and more were set even after they clicked "Refuse all".

To configure GTM legally, you must align your tag firing rules with user choices. This requires connecting your consent management platform to the GTM data layer. The container will then read the data layer variables to block or execute tags based on the explicit choices recorded.

Legal requirements for tag deployment

Article 5(3) of the ePrivacy Directive mandates that you store information on a user's device only after they give permission, unless the storage is strictly necessary for a service they asked for. This rule applies regardless of whether the script comes directly from your source code or through a container management system.

The General Data Protection Regulation adds the requirement that this permission must be freely given, specific, informed, and unambiguous. You cannot use pre-ticked boxes or assume consent from a user scrolling the page. Any tag that sets non-essential trackers must wait in a paused state until the user actively clicks an accept button. Under strict GDPR consent standards, firing a marketing tag on the initial page load is unlawful. The Spanish AEPD's cookie guide, last updated in May 2024, states that continuing to browse is not a valid way to give consent.

A well-built GTM setup prevents data collection tags from triggering until the required consent variable returns a positive value.

You must audit every active tag in your workspace before adjusting any trigger rules. Assign each script to a specific regulatory category to determine its lawful basis for processing. A tag that manages your live chat widget operates differently under the law than a tag tracking conversions for a social media advertising campaign.

Scripts that remember user choices, like language settings or shopping cart contents, usually fall under functional cookies. These often qualify for the strictly necessary exemption and can fire without prior permission from the visitor.

Measurement tools require careful handling in your container setup. Tags that deploy analytics cookies need active user opt-in in most European jurisdictions. Some authorities like the French CNIL offer limited exemptions for strictly anonymised, first-party audience measurement under specific configurations. Most default Google Analytics 4 installations do not meet this exemption standard and must wait for explicit user permission.

The container itself is a harder question. On 19 March 2025 the Administrative Court of Hanover (case 10 A 5385/22) held that loading Google Tag Manager needs consent under section 25 of the TDDDG, because fetching gtm.js from Google already transmits the IP address and device details, and GTM is not needed for a website's basic functions. Other courts and regulators have not all followed it, but if you serve German visitors, load the container only after consent or be ready to defend why you do not.

Any tag deploying marketing cookies, such as the TikTok Pixel or LinkedIn Insight Tag, strictly requires prior opt-in everywhere.

How the data layer carries consent

The data layer is a JavaScript object that sits between your website and your GTM container. It holds structured information about the page context, user actions, and current privacy preferences. When a visitor interacts with your privacy banner, the platform pushes an event to this layer detailing exactly which categories the user accepted or rejected.

GTM uses these data layer events to evaluate trigger conditions. If a user rejects advertising trackers, the data layer updates to reflect a negative state for that specific category.

Configure your marketing tags to check this state before executing their code. Instead of using the default page view trigger, you replace it with a custom event trigger that requires a positive consent signal. This keeps the Meta Pixel dormant if the visitor ignores the banner or selects a reject option. Failing to replace default triggers is a common technical error in website audits. Implementing custom event triggers provides a hard mechanism to block unauthorised data collection.

Testing this mechanism requires opening your site in an incognito window and monitoring the network tab in your browser developer tools.

Built-in consent checks in GTM

GTM includes native settings to help you manage these rules without writing complex custom variables for every single tag. You can assign built-in checks like ad_storage or analytics_storage directly in the tag configuration panel. If the user has not granted the corresponding permission, the container automatically blocks the tag from firing.

The system integrates with Google Consent Mode to handle granular user choices. When active, this framework adjusts how Google-specific tags behave based on the status passed from your banner.

If a user rejects analytics tracking, a GA4 tag configured with this mode will not set standard tracking identifiers on the device. It will instead send cookieless, anonymised pings to Google servers to log basic interactions. This lets Google model conversions and basic traffic volumes from those pings. Whether sending them before a choice needs consent under Article 5(3) is debated, so some sites block Google tags entirely until consent instead.

The Information Commissioner's Office in the UK warns that non-cookie tracking methods fall under the same strict regulatory rules if they single out specific users.

Auditing third-party templates

GTM offers a community template gallery where you can install pre-configured tags from hundreds of vendors. Take care when adding these third-party templates to your workspace. The template creator determines what data the script accesses and where it sends that information.

Many community templates lack built-in privacy checks and will execute immediately upon page load if assigned a standard trigger. You bear the legal responsibility for any personal data these third-party scripts capture and transmit.

Conduct a thorough review of the permissions tab before importing any new template into your container. GTM displays exactly which cookies the script intends to read or write and which external domains it will contact. If a template requests unrestricted access to all browser cookies, you should evaluate if that level of access is strictly necessary for its function. Restricting tag permissions provides an additional layer of defence against accidental data leaks.

You can manually edit template permissions to block injection of unknown scripts or restrict network requests to approved domains only.

The server-side tracking alternative

Many organisations are moving their tag management infrastructure to server-side containers to improve data security. In a server-side setup, the visitor's browser communicates only with a server you control, rather than sending data directly to vendors like Meta or Google. Your server then processes the data stream, removes sensitive information, and forwards it to the third-party platforms.

This architecture gives you much more control over what data leaves your infrastructure. You can strip out IP addresses, user agents, and cross-site identifiers before the vendor ever sees the request.

Server-side tracking does not eliminate the need for user permission. If your initial data collection involves accessing information stored on the user's device, the ePrivacy Directive still applies in full. Secure active opt-in before sending that initial data stream to your server container. The advantage lies strictly in data governance, not in bypassing consumer privacy rights.

Regulators assess compliance based on the initial access to the terminal equipment, regardless of where the data goes afterward.

Regular monitoring of your container setup prevents compliance drift over time. Marketing teams frequently add new tags to support campaigns, sometimes bypassing the established privacy triggers in a rush to launch.

How to set up cookie consent in Google Tag Manager

The order matters more than the tool. These steps use GTM's own consent features, whichever consent banner you run:

1. In Admin, open Container Settings and turn on Enable consent overview.
2. Add your consent tool's template, or a consent default tag, on the Consent Initialization - All Pages trigger, with ad_storage, analytics_storage, ad_user_data and ad_personalization set to denied for regions that need opt-in.
3. Make sure the banner sends a consent update when the visitor chooses. Kukie.io's banner, for example, sends the update and pushes a cookie_consent_update event to the data layer.
4. Open the consent overview in the Tags list and check each tag. Google tags have built-in consent checks. For other tags, set Require additional consent for tag to fire with the matching consent types.
5. Where a non-Google tag needs a trigger rather than a consent check, fire it on a custom event that your banner pushes after an accept.
6. Use Preview mode and Tag Assistant to confirm that the default shows denied on load and that the update arrives after a choice.
7. Publish the container, then load the site in a private window and check the Network tab before touching the banner.

As of October 2026, Tag Manager can also send to Google Analytics, Google Ads and Floodlight as destinations. The consent commands stay the same, and a consent default on the Consent Initialization trigger still comes first.

Google Tag Manager and consent: short answers

See which scripts your container loads before consent

If you are not sure which tags are firing before visitors choose, run the Script audit. It lists the third-party scripts a page loads and where they come from, so you can match them against your GTM triggers.

Audit your scripts