# Consent-aware GTM setup and troubleshooting

Use the [Webflow setup guide](/webflow/google-tag-manager) or [Web App setup guide](/web-app/google-tag-manager) for installation. Select your Google Consent Mode approach separately from third-party tracking behavior.

## Choose triggers and consent checks first

Choose Basic or Advanced for Google measurement before changing Google tags. If the approach has not been selected, keep it unknown and review the options first.

| Tag purpose                                      | Recommended trigger                      | Consent checks                                                                  |
| ------------------------------------------------ | ---------------------------------------- | ------------------------------------------------------------------------------- |
| Consent Pro defaults                             | Consent Initialization — All Pages       | Establish approved defaults before measurement                                  |
| GA4 initialization — Basic                       | `analytics-activated`                    | Require `analytics_storage`                                                     |
| Google initialization — Advanced                 | Initialization — All Pages               | Built-in consent behavior; no additional `analytics_storage` firing restriction |
| Consent-dependent analytics initialization       | `analytics-activated`                    | Matching analytics consent checks                                               |
| Consent-dependent marketing initialization       | `marketing-activated`                    | Matching marketing consent checks                                               |
| Consent-dependent personalization initialization | `personalization-activated`              | Matching personalization consent checks                                         |
| Purchase, lead, click or SPA navigation          | Keep the original business-event trigger | Appropriate checks for the selected mode and actual purpose                     |

Category activation events fire once per page when the category becomes active, including remembered consent on returning visits. Choose the category from the tag's actual purpose. Reserve `consent-updated` for deliberately configured update handling: it also follows rejection and can occur repeatedly. Review an existing valid setup before replacing its triggers.

Activation does not stop already-loaded code after withdrawal. Test subsequent requests, consent persistence and any vendor shutdown behavior separately. See [Consent-aware GTM troubleshooting](/knowledge/gtm-troubleshooting).

## Defaults before ordinary tags

The Consent Pro consent-setting template belongs on **Consent Initialization — All Pages**. Set the intended region defaults before measurement tags run. The Consent Initialization trigger is reserved for tags that set or update consent; ordinary early Google tags use **Initialization — All Pages**, after consent initialization. Tag firing priority is not a substitute for this ordering.

## Basic and advanced modes

In **basic mode**, Google measurement tags are blocked before the necessary consent is granted. For a page-view initialization tag, the `analytics-activated` category trigger plus an `analytics_storage` additional check can initialize analytics when it becomes allowed. Verify returning visitors as well as fresh acceptance.

In **advanced mode**, supported Google tags may load before consent and use their built-in consent behavior, including cookieless pings while storage is denied. An ordinary Google tag can run on Initialization after defaults are established. Adding an `analytics_storage` additional check blocks the tag while denied and therefore prevents this advanced behavior. Cookieless does not mean no network transmission or legal compliance.

Third-party tags do not automatically inherit Google's built-in behavior. Require the categories appropriate to their purposes, or verify a documented equivalent integration.

## Keep conversion triggers intact

Do not replace purchase, lead, form-submit, click, or SPA navigation triggers with Consent Updated or All Pages. Those triggers represent business events. Keep them. In basic mode and for blocked third-party tags, add appropriate additional consent checks. Supported native Google conversion tags in advanced mode retain business-event triggers and use their built-in consent behavior; additional checks would block that behavior while consent is denied. A purchase tag must represent a purchase, not every consent change.

Additional checks require all selected consent types to be granted when the triggering event occurs. A denied purchase event is not automatically replayed after later acceptance. Any deferred measurement design needs explicit handling to prevent duplicate or incorrectly attributed conversions.

For page-view and initialization tags only, configure the intended consent event and firing frequency deliberately. `consent-updated` can occur more than once and after rejection. Use checks and appropriate firing options to avoid repeated initialization or duplicate page views.

## Category mapping

| Category        | Additional consent checks to consider                                                  |
| --------------- | -------------------------------------------------------------------------------------- |
| Analytics       | `analytics_storage`                                                                    |
| Marketing       | `ad_storage`, `ad_user_data`, `ad_personalization` as applicable to the tag's purposes |
| Personalization | `functionality_storage`, `personalization_storage` as applicable                       |
| Essential       | `security_storage`; verify that the purpose is actually essential                      |

All selected checks must be granted. Built-in checks describe how a supported tag adapts; additional checks decide whether GTM allows it to fire. Inspect both in GTM Consent Overview.

## Consent Pro events

`consent-updated` fires after rejection as well as acceptance and is never a consent gate by itself. `analytics-activated`, `marketing-activated`, and `personalization-activated` are current-runtime events, not legacy-only events. They fire once per page when the category becomes active. They do not replace consent checks for later conversion events or prove ongoing enforcement after withdrawal.

## Verify GTM for returning visitors with stored consent

Test returning visitors without clearing their saved consent between the choice and the next page load:

1. Reject non-essential categories, then reload. Confirm the runtime restores the saved denied choices. Basic Google measurement and consent-dependent third-party tags must remain blocked; Advanced Google tags may send cookieless pings while storage is denied.
2. Accept analytics only, then reload again. Confirm analytics is restored while marketing remains denied. Check that Consent Pro establishes defaults before ordinary Google initialization and that any consent update is applied before consent-dependent measurement fires.
3. In Tag Assistant, confirm `analytics-activated` occurs once per page when analytics becomes active from the remembered choice. Keep purchase, lead and navigation tags on their business-event triggers; restoring consent is not a conversion.
4. Withdraw consent through preferences, reload, and inspect subsequent requests and persisted choices. Do not assume the choice stopped code that already executed. A changed region, expired choice or changed configuration may require a new choice; record those conditions separately.

Use a separate clean session for first-visit testing. Clearing storage before every test cannot establish returning-visitor behavior.

## Verification checklist

1. Use Tag Assistant to confirm defaults are set before ordinary tags.
2. With a fresh visitor, reject all: third-party consent-dependent tags must stay blocked; basic Google measurement must stay blocked; advanced Google tags may send cookieless pings.
3. Grant analytics only: marketing remains denied. Inspect tag firing, storage, and network requests.
4. Grant marketing: inspect the applicable marketing checks and tag behavior.
5. Trigger a purchase or lead: it must fire only for its business event and permitted consent state.
6. Withdraw consent: inspect subsequent requests, cleanup, and third-party shutdown behavior. Previously sent data is not recalled.
7. Reload as a returning visitor: confirm stored choices, consent order, and initialization frequency.
8. Check SPA navigation and repeated preference changes for duplicate events.

A blocking exception, a custom template, or an unknown vendor tag requires inspection. Review its complete settings and test its behavior before relying on it to block tracking.

## Reviewed references

- [Google Tag Manager consent mode support](https://support.google.com/tagmanager/answer/10718549).
- [Google Consent Mode implementation](https://developers.google.com/tag-platform/security/guides/consent).
- [Google Consent Mode overview](https://developers.google.com/tag-platform/security/concepts/consent-mode).
- [Simo Ahava: Basic Consent Mode — the guide](https://www.simoahava.com/analytics/basic-consent-mode-the-guide/): worked examples; validate dated examples against current Google documentation.

Reviewed against the current runtime and primary Google references on 2026-10-27.

## Review settings and test your website

Choose Basic or Advanced measurement before changing Google tags. The same Consent Pro template can be used with either approach; its presence does not establish your intended setup. Non-Google tags still need consent appropriate to their purposes.

For example, `security_storage` does not grant marketing consent, and an analytics activation event does not mean marketing is allowed. Check the consent types required by each tag against what it actually collects.

Check all intended default values and regions in Google Tag Manager. A command pasted into Custom HTML has no effect unless the tag executes; verify its trigger and timing in Tag Assistant. Test the published website as well as saved settings, including returning visitors and withdrawal.

Use the recommended non-async installation for [automatic blocking](/runtime/automatic-blocking). Configure tag consent inside Google Tag Manager separately.

## Publishing after a rollback

Rollback publishes an earlier live version without changing existing workspaces or Google's latest synchronization baseline. Review live/latest versions and the intended baseline in Tag Manager before further edits. Never automatically change the baseline or republish the newer version to clear a blocker.

A signed recovery marker authenticates previously reviewed content, not its publication history. A recovery candidate may already have been published and later rolled back. Inspect its complete settings and publication history in Tag Manager and obtain separate approval before recovery. Workspace changes shown by a publish preview do not review the contents of that separate recovery version.

Google documents [publishing](https://developers.google.com/tag-platform/tag-manager/api/reference/rest/v2/accounts.containers.versions/publish) and [setting the latest workspace synchronization version](https://developers.google.com/tag-platform/tag-manager/api/reference/rest/v2/accounts.containers.versions/set_latest) as separate operations. This behavior was checked against real Google on 2026-10-22.