How to make tags in Google Tag Manager GDPR-compliant without using 3rd party services like CookieBot?

I have a custom "We use cookies" popup and GTM set up. I need to understand how to configure the GTM so it is GDPR compliant.

I tried to configure Google's Consent mode (beta), but the integration article describes only how to configure gtag and not GTM. Also, the solution is only applicable to Google's products, but other services may also use cookies.

  • 3
    GDPR is about choice, so to make your GTM setup compliant (provided you're using it for services that create cookies), you should enable it only after getting explicit consent from a user. The way you say I have a custom "We use cookies" popup may mean it's declarative and you're just stating the fact instead of collecting proper consent, in which case your whole approach is not compliant. You can then keep doing it this way, but then don't worry about compliance. See here
    – mehov
    Apr 13 '21 at 14:44
  • I managed to configure that Google Analytics activates only after the consent was given. This way I don’t see any statistics until the user clicks “Accept”. It would be nice to have some kind of anonymous statistics before the user accepts. I also need to add tags for Google Ads, Facebook pixel etc. But it becomes tough to figure out how to configure all that with GTM in a way that cookies are not collected until the user clicks “Accept”. Maybe someone has a guide for that?
    – Tymoxx
    Apr 14 '21 at 9:33
  • As for analysing traffic from those who haven't consented, consider Matomo (ex. Piwik). Regarding tags, have you considered using two GTM containers: one for those tags not requiring consent, and the other to be launched after the visitor accepts? You can wrap the latter into a <template> and only run it once you got the consent
    – mehov
    Apr 15 '21 at 12:01

First of all, the core functionality of all those third party compliance services is trivial and not worth paying for. Some of them, however, add things that may be valuable, but the core logic is very easy to reimplement.

Here is what you typically do:

  1. That compliance pop up that you own and now have on the page. It should use something like a cookie to know whether to show or not (whether the client gave compliance or not). And that cookie should contain the info of the kind of consent the user gave.

  2. Make a cookie variable in GTM that would grab your cookie value. You can also go the CJS route here. I prefer CJS since I often need to add logic there.

  3. Make a trigger in GTM. the type of it would be custom event. The event name would be .* and regexp enabled like so:

enter image description here

Now this trigger will fire on every event. Not just DL events. Every event. Bear with me.

  1. Oh, I spoiled it. The screenshot shows it. Well, yes, add the condition in which you reference the value of your cookie. So this trigger has to fire only when the cookie says tracking should not happen

  2. As you could've guessed, this is a blocking trigger. We will now use it as a blocker in every tag that you want to comply to user consent, like so:

enter image description here

There we go. Keep in mind that this is only an example. It's not perfect. For example, it's much better to have "doesn't contain Allow" than "contain Block" because when the user consent is not given, there will be no cookie, therefore, it will not contain Block, therefore, you will be tracking things. A bit convoluted, but you get used to it.

Another point is that people often do something like leveled consent when they will ask a user about different kinds of tracking that a user can disable. Stuff like internal tracking, third party tracking, personalization, etc, etc. So you could build a more comprehensive logic, add more blocking triggers: some of which you would use for third party tracking, some for first-party and so on. I don't think it is very useful, but business often asks for this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.