Syrenis Syrenis
Syrenis
Book a Demo
Blog Article

How To Integrate Cookie Management With Google Tag Manager? 

Posted: August 11, 2024

Google Tag Manager (GTM) is a powerful tool for deploying scripts and tracking technologies across your website. However, GTM does not manage user consent by default. If tags are fired before a user explicitly agrees, you may be violating privacy regulations like GDPR and the ePrivacy Directive. A landmark 2023 German court ruling confirmed this: loading GTM before obtaining consent is unlawful. Why? Because GTM can load third-party trackers that require prior consent. This ruling reflects a broader trend across Europe and beyond. So, what does a compliant, user-respecting integration look like?

This might sound obvious, but it’s often overlooked. Your cookie banner should be the first thing that loads on your site, before GTM, before analytics, before anything else. Why? Because users need to make a choice before any tracking begins, as part of this you should make sure:

  • The banner is jurisdiction-aware (GDPR, CCPA, etc.)
  • Users can accept, reject, or customize their preferences
  • It’s accessible and doesn’t rely on dark patterns.

Top tip: If you’re deploying the banner via GTM, use a high-priority trigger to ensure it loads immediately.

Google introduced Consent Mode to help bridge the gap between privacy and performance, allowing GTM to adjust how tags behave based on the user’s consent status.For example:

  • If a user declines analytics cookies, Google Analytics can still send anonymized data
  • If marketing consent isn’t given, ad tags won’t fire.

To implement:

  • Set default consent states in GTM
  • Update those states dynamically based on user interaction with your banner
  • Configure each tag to respect those states (Google’s setup guide)

It’s not a silver bullet, but it’s a solid foundation.

Step 3: Control tag firing with triggers and variables

This is where GTM’s flexibility really helps. You can create custom triggers that only fire tags when specific consent categories are accepted. For example:

  • Fire Meta Pixel only if “Marketing” consent is true
  • Load Hotjar only if “Performance” consent is accepted.

To do this:

  • Create consent variables in GTM
  • Build triggers that check those variables before firing
  • Apply these triggers to each tag individually.

It takes some setup, but once it’s in place, it gives you full control over what runs and when.

Step 4: Audit your tags and cookies regularly

Even with a solid setup, things change. New campaigns, new tools, new scripts and this is why regular audits are essential. Use a scanner like the Syrenis Cookie Audit to:

  • Identify all cookies and scripts running on your site
  • Categorise them by purpose (essential, performance, marketing)
  • Check if any are firing before consent is given.

This isn’t just about compliance – it’s about knowing what’s happening on your site, and compliantly being able to review your site’s activity.

If regulators ask how consent was obtained, you need to show them, that means logging:

  • Timestamped consent decisions
  • Banner interactions
  • Consent status at the time each tag fired.

Most CMPs including Syrenis offer this natively. Ensure GTM supports it via Data Layer events like: Many consent platforms offer this out of the box, but make sure your GTM setup supports it too, it’s your safety net.

  • Consent must be explicit and freely given – no pre-ticked boxes or vague language
  • Rejecting cookies must be as easy as accepting them
  • GTM is not exempt – it must not load before consent unless strictly necessary
  • International data transfers and withdrawal rights must be disclosed upfront.

Don’t:

  • Load GTM before consent
  • Assume Consent Mode alone ensures compliance
  • Use vague or misleading banner language
  • Overlook third-party scripts that silently track.