Set up Google Tag Manager for the Web and Brand Cookie Plugin

Use this guide to connect the Web and Brand Cookie Plugin to Google Tag Manager and Google Consent Mode v2 correctly.

Starting point

The plugin sets Consent Mode defaults in the page head, then pushes updates when a visitor makes a choice. Don't place tracking tags outside Google Tag Manager unless those scripts are demonstrably configured to wait for consent themselves.

Important: the plugin's consent-default code must load before Google Tag Manager tags can fire. Don't place the GTM container or separate tracking tags above the consent-default script.

ad_storage: denied
ad_user_data: denied
ad_personalization: denied
analytics_storage: denied
functionality_storage: granted
personalization_storage: denied
security_storage: granted
wait_for_update: 500

DataLayer contract

The plugin pushes events to the dataLayer. Use these events in GTM to fire tags only after the appropriate consent has been given.

• consent_default
• cookie_consent_restored
• cookie_consent_update
• cookie_consent_expired
• essentialConsent
• analyticalConsent
• advertisingConsent
• analyticalConsentDenied
• advertisingConsentDenied

The main dataLayer variables are essentialConsent, preferenceConsent, analyticalConsent, advertisingConsent, consentAction and consentVersion. Their values are granted or denied.

The plugin also includes a consentSnapshot in the front-end configuration. This contains the active plugin version, consent version, categories, relevant copy and a configHash. These values mainly support debugging and auditability; you don't normally need to use them as GTM triggers.

Step 1: Enable Consent Overview

1. Open the GTM container.
2. Go to Admin > Container Settings.
3. Switch on Enable consent overview .
4. Then go to Tags > Consent Overview.
5. After configuring the tags, check that none remain under Consent Not Configured .

Step 2: Create Data Layer Variables

Create these Data Layer Variables using Data Layer Version 2.

Name in GTM	Data Layer Variable Name
DLV - analyticalConsent	analyticalConsent
DLV - advertisingConsent	advertisingConsent
DLV - preferenceConsent	preferenceConsent
DLV - consentAction	consentAction
DLV - consentVersion	consentVersion

Step 3: Create Custom Event Triggers

For analytics, create a trigger for analyticalConsent and allow it to fire only when DLV - analyticalConsent equals granted.

Trigger type: Custom Event
Event name: analyticalConsent
This trigger fires on: Some Custom Events
Condition: DLV - analyticalConsent equals granted
Name: CE - Analytical Consent Granted

For marketing and advertising, create a corresponding trigger for advertisingConsent.

Trigger type: Custom Event
Event name: advertisingConsent
This trigger fires on: Some Custom Events
Condition: DLV - advertisingConsent equals granted
Name: CE - Advertising Consent Granted

Step 4: Configure GA4

1. Open the GA4 Configuration tag or Google tag.
2. Don't trigger it on All Pages.
3. Use the trigger CE - Analytical Consent Granted.
4. Go to Advanced Settings > Consent Settings.
5. Set Additional Consent Checks to Require additional consent for tag to fire.
6. Add analytics_storage .

If the tag also uses advertising features, also add ad_storage, ad_user_data and ad_personalization .

Step 5: Ads, remarketing and conversions

1. Trigger on CE - Advertising Consent Granted.
2. Go to Advanced Settings > Consent Settings.
3. Set Additional Consent Checks to Require additional consent for tag to fire.
4. Add ad_storage, ad_user_data and ad_personalization .

Step 6: Third-party tags

For Meta Pixel, LinkedIn, Hotjar and similar scripts, don't load them on All Pages. Analytics tools wait for analytics consent. Marketing tools wait for advertising consent.

Step 7: Returning visitors

For a visitor with valid stored consent, the plugin pushes cookie_consent_restored early, followed by the applicable granted events. Tags can therefore wait for the same events on a new page load.

Step 8: Test in Preview / Tag Assistant

• New visitor: defaults are denied and analytics or marketing tags don't fire.
• Necessary cookies only: denied events are pushed and tracking tags don't fire.
• Accept all: granted events are pushed and tracking tags fire.
• Reload after accepting: cookie_consent_restored and the granted events appear again.
• Withdraw consent: optional consent changes to denied and tags must not fire again afterwards.

Common mistakes

• Placing the GTM container or tracking tags above the consent-default script.
• Leaving GA4 or Ads tags on All Pages without additional consent checks.
• Setting only a custom event trigger, without Additional Consent Checks.
• Loading third-party scripts outside GTM.
• analyticalConsentDenied or advertisingConsentDenied as a trigger for tracking tags.
• Not updating the privacy policy or cookie notice when adding vendors.

Publishing

1. Check Consent Overview.
2. Test with GTM Preview / Tag Assistant.
3. Publish the container.
4. Check the live site again in a clean browser or a session without stored cookies.