How to make tags in Google Tag Manager GDPR-compliant without using 3rd party services like CookieBot?

I have a custom "We use cookies" popup and GTM set up. I need to understand how to configure the GTM so it is GDPR compliant.

I tried to configure Google's Consent mode (beta), but the integration article describes only how to configure gtag and not GTM. Also, the solution is only applicable to Google's products, but other services may also use cookies.

  • 3
    GDPR is about choice, so to make your GTM setup compliant (provided you're using it for services that create cookies), you should enable it only after getting explicit consent from a user. The way you say I have a custom "We use cookies" popup may mean it's declarative and you're just stating the fact instead of collecting proper consent, in which case your whole approach is not compliant. You can then keep doing it this way, but then don't worry about compliance. See here Apr 13, 2021 at 14:44
  • I managed to configure that Google Analytics activates only after the consent was given. This way I don’t see any statistics until the user clicks “Accept”. It would be nice to have some kind of anonymous statistics before the user accepts. I also need to add tags for Google Ads, Facebook pixel etc. But it becomes tough to figure out how to configure all that with GTM in a way that cookies are not collected until the user clicks “Accept”. Maybe someone has a guide for that?
    – Tymoxx
    Apr 14, 2021 at 9:33
  • As for analysing traffic from those who haven't consented, consider Matomo (ex. Piwik). Regarding tags, have you considered using two GTM containers: one for those tags not requiring consent, and the other to be launched after the visitor accepts? You can wrap the latter into a <template> and only run it once you got the consent Apr 15, 2021 at 12:01

1 Answer 1


//UPD: There has been Consent Mode feature in GTM in Beta for some time now, it may be good enough to use in production. https://developers.google.com/tag-platform/tag-manager/templates/consent-apis And the old answer:

First of all, the core functionality of all those third party compliance services is trivial and not worth paying for. Some of them, however, add things that may be valuable, but the core logic is very easy to reimplement.

Here is what you typically do:

  1. That compliance pop up that you own and now have on the page. It should use something like a cookie to know whether to show or not (whether the client gave compliance or not). And that cookie should contain the info of the kind of consent the user gave.

  2. Make a cookie variable in GTM that would grab your cookie value. You can also go the CJS (Custom JavaScript) route here. I prefer CJS since I often need to add logic there.

  3. Make a trigger in GTM. the type of it would be custom event. The event name would be .* and regexp enabled like so:

enter image description here

Now this trigger will fire on every event. Not just DL (Data Layer) events. Every event. Bear with me.

  1. Oh, I spoiled it. The screenshot shows it. Well, yes, add the condition in which you reference the value of your cookie. So this trigger has to fire only when the cookie says tracking should not happen

  2. As you could've guessed, this is a blocking trigger. We will now use it as a blocker in every tag that you want to comply to user consent, like so:

enter image description here

There we go. Keep in mind that this is only an example. It's not perfect. For example, it's much better to have "doesn't contain Allow" than "contain Block" because when the user consent is not given, there will be no cookie, therefore, it will not contain Block, therefore, you will be tracking things. A bit convoluted, but you get used to it.

Another point is that people often do something like leveled consent when they will ask a user about different kinds of tracking that a user can disable. Stuff like internal tracking, third party tracking, personalization, etc, etc. So you could build a more comprehensive logic, add more blocking triggers: some of which you would use for third party tracking, some for first-party and so on. I don't think it is very useful, but business often asks for this.

  • What does CJS and DL stand for? Thanks Sep 26, 2022 at 19:57
  • 1
    Sorry, CJS is custom javascript (variable in GTM) and DL is the dataLayer object. I'll add notes to the answer.
    – BNazaruk
    Sep 26, 2022 at 23:05
  • 1
    I found this official documentation that I suspect was written after your answer: developers.google.com/tag-platform/tag-manager/templates/… It's more thorough, but I don't know if it completely overlaps with your answer. Is there any information missing from this official answer? Thanks Sep 27, 2022 at 20:57
  • 1
    Nice! I didn't see that. I'll update my answer, referencing the template. I would likely use the template if it was there back when I had to implement it.
    – BNazaruk
    Sep 27, 2022 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.