Consent Management

Consent management isn't technically part of your server-side tagging setup, but it affects it a lot. But your tracking setup and your consent management are tied together whether you like it or not. Since the GDPR rulings, every website and webshop needs a Consent Management Platform that correctly handles visitors' choice in your cookiebanner. Your tracking setup then has to respect those choices. Besides GDPR, Google has its own requirements. If you want to keep using their advertising and measurement products in Europe, you need to send the right consent signals for Consent Mode v2.

What is Consent Mode v2?

Consent Mode v2 is Google's framework for adjusting tag behavior based on a visitor's cookie choices, without you having to fully block every Google tag by hand. Instead of an all-or-nothing switch, your CMP passes four consent signals into the Google tag:

Signal	Controls
analytics_storage	Whether measurement data (e.g. GA4) can be stored
ad_storage	Whether advertising cookies/identifiers can be stored
ad_user_data	Whether user data can be sent to Google for advertising purposes
ad_personalization	Whether the visitor can be used for personalized/remarketing ads

Consent Mode v2 only governs Google's own tags (Google Tag, GA4, Google Ads, Floodlight). Every other platform (Meta, Pinterest, LinkedIn, TikTok, etc.) needs to be gated separately, which is covered in step 2 below.

Basic vs. Advanced mode

• Basic mode If a visitor denies consent, the relevant Google tags simply don't fire at all. No data reaches Google for that category. This requires you to add blocking triggers on the server so the tag can't fire without consent.

• Advanced mode Google's tags fire either way, no matter the visitor's choice in your cookiebanner. The difference is what data actually goes out the door. If consent is denied, the request gets stripped of anything that could identify the person and goes out as a plain, cookieless ping instead. Google then fills in the missing pieces with modeling, basically making an educated guess about the traffic it couldn't measure properly.

With Advanced mode, an extra parameter is added to outgoing requests indicating what was and wasn't consented to:

Code	Marketing consent	Analytics consent
G100	No	No
G101	No	Yes
G110	Yes	No
G111	Yes	Yes

Most setups should default to Advanced mode unless there's a specific compliance reason to hard-block Google tags, it preserves far more usable data while still respecting the visitor's choice.

Step 1: Configure Consent Mode v2 in web GTM

1

Load your CMP on the Consent Initialization trigger

Your CMP (Cookiebot, Consent Studio, etc) needs to load before anything else on the page. GTM has a dedicated Consent Initialization trigger reserved exactly for this, it fires before any other tag, so nothing else can activate until a consent state exists.

2

Set the default consent state

Before a visitor makes a choice, all four signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) should default to "denied." Set this as the default state on your Google tag / consent settings.

3

Turn on Consent Overview in GTM Web

Enable the Consent Overview settings in your web container. This is what lets you require specific consent signals per tag rather than relying on a single global switch.

4

Assign consent requirements to each Google tag

For tags without built-in consent checks, specify which consent signal is required. The Google Tag, GA4 event tags, Conversion Linker, and Google Ads conversion tags already have built-in consent checks, so they don't need manual configuration, they read the consent state automatically.

In the Consent Overview you are able to bulk select tags to select the Additional Consent required to fire these tags.

Step 2: Send consent to your server container

Google tags carry their consent signals to GTM Server automatically as part of the request. There's nothing extra to build for those requests. Every other platform (Meta, Pinterest, LinkedIn, TikTok, etc.) needs its consent status forwarded manually, since those tags don't understand Consent Mode v2 at all.

1

Find where your CMP stores accepted vendors

Most CMPs store the list of vendors/categories a visitor accepted, either in a first-party cookie or as a dataLayer variable. Check your CMP's documentation to confirm which one applies, the exact cookie or variable name differs per CMP.

2

Create a variable in GTM Web to read it

Add a First-Party Cookie variable (or a Data Layer Variable, depending on your CMP) that captures the accepted vendors or categories.

3

Add it as a parameter on your Google tag

Add an extra event parameter (for example consent_status) to your Google tag configuration, using the variable from the previous step as its value. This is what carries the consent information from the browser into the request sent to your server container.

Step 3: Configure server-side triggers based on consent

Once consent_status (or whatever you named it) arrives at your GTM Server container, each non-Google tag needs a trigger condition that checks it before firing.

1

Create an Event Data variable

In GTM Server, create a variable that reads the incoming consent_status parameter from the event data.

2

Add a consent condition to each platform tag

For each platform tag (Meta CAPI, Pinterest CAPI, LinkedIn CAPI, etc.), add an extra trigger condition checking that the Event Data variable contains that platform's identifier, e.g. the Meta tag only fires if the value contains "facebook", the Pinterest tag only if it contains "pinterest".

3

Repeat for every non-Google platform

Apply the same pattern to every remaining server-side tag. Any tag without a consent condition will fire regardless of the visitor's choice, so double-check nothing is left unguarded.

Step 4: Validate that it's actually working

1

Test the "deny" path

Open your site in an incognito window with GTM Web preview mode running, and reject all cookies. Confirm only the CMP/Consent Initialization tag fires, no Google or platform tags should activate yet.

2

Check the Google tag's request in Basic mode

If you're running Basic mode, confirm in GTM Server preview that the Google tags are blocked from firing while consent is denied, and that no request reaches Google Ads or GA4 for that visit.

3

Check the anonymized ping in Advanced mode

If you're running Advanced mode, confirm the Google tag still fires but the outgoing request carries a gcs parameter matching a denied state (e.g. G100) and contains no identifying cookie values.

4

Test the "accept" path

Accept all cookies and reload. Confirm the CMP's consent-update event or cookie now reflects full consent, and that your Google tags fire with the gcs parameter matching full consent (e.g. G111).

5

Confirm consent reaches the server for non-Google tags

In GTM Server preview mode, inspect an incoming request and confirm the consent_status parameter is present and contains the vendors the visitor accepted.

6

Confirm platform tags only fire when consented

Still in Server preview, accept only some categories (e.g. accept Meta but reject Pinterest) and confirm the Meta CAPI tag fires while the Pinterest CAPI tag does not — and vice versa when you flip the choice.

If any of these checks fail, head back to the matching step. Usually the problem is one of two things. Either the Google tag is missing a consent parameter, or one of your platform tags on the server never got its trigger condition set up.