Combine the use of Google Tag Manager with automated cookie blocking by Cookiebot to get the best of both worlds. Implementation is quick and easy and allows you to:
- Control tags and cookies based on the user's consent, using triggers and Consent Mode in Google Tag Manager AND
- Let Cookiebot automatically control all other cookies not set by Google Tag Manager, based on the consent given, typically cookies set by third party scripts that are embedded directly in your website.
To achieve this, make sure that the Cookiebot script is not executed by Google Tag Manager. So either remove the Cookiebot CMP tag, pause it, or remove the trigger assigned to it.
Furthermore, for optimal results:
- Ensure that the Google Tag Manager script is first to load on your website.
- Mark up your Google Tag Manager script tag with:
data-cookieconsent="ignore"
This will ensure that the Google Tag manager script can't unintentionally get blocked by the auto blocking feature. - Insert the Cookiebot script with automatic cookie blocking immediately after Google Tag Manager script.
- If you choose to use Google Consent Mode, ensure this script loads before the Google Tag Manager script does.
Here's an example of how this could look:
If you have renamed the dataLayer, you need to add the data-layer-name attribute to the Cookiebot script tag, with the new dataLayer name as its value.
For example: data-layer-name="gtmDataLayer".
Google Consent Mode
For tags that support built-in consent checks, like Google Ads Conversion Tracking and Remarketing, Floodlight, Google Analytics and Conversion Linker, we recommend using Google Consent Mode, which can be activated by inserting the following snippet before the Google Tag Manager script in your header:
<script data-cookieconsent="ignore">
window.dataLayer = window.dataLayer || [];
function gtag() {
dataLayer.push(arguments);
}
gtag("consent", "default", {
ad_storage: "denied",
analytics_storage: "denied",
functionality_storage: "denied",
personalization_storage: "denied",
security_storage: "granted",
wait_for_update: 2000,
});
gtag("set", "ads_data_redaction", true);
</script>
It is vital that this script loads before the Google Tag Manager script, otherwise the instructions to deny the use of cookies and to redact data will come too late!
Furthermore, if you have renamed the dataLayer, ensure that you replace window.dataLayer with the actual name of the dataLayer.
For example: window.gtmDataLayer
= window.gtmDataLayer || [];
For all other cookie-setting tags in Google Tag Manager, implement Additional Consent Checks as described in our GTM deployment guide.
Disabling Consent Mode
It's important to note that regardless whether you implement the Consent Mode script, which sets the default permissions within Google Tag Manager, the Cookiebot script will always pass updated Consent Mode data when it has established a visitor's consent choices.
If you for any reason prefer not making use of Consent Mode, you have to option to prevent Cookiebot from sending Consent Mode signals to Google Tag Manager.
Cookiebot will continue to send consent data to ensure that you still can conditionally load tags that require consent, in the form of the following three custom events:
cookie_consent_preferencescookie_consent_statisticscookie_consent_marketing
Please note that the cookie_consent_update event will no longer be available when consent mode is disabled though.
To disable Consent Mode, add the following attribute to the Cookiebot script tag:
data-consentmode="disabled"
This could look similar to this:
<script
id="Cookiebot"
type="text/javascript"
src="https://consent.cookiebot.com/uc.js"
data-cbid="12345678-90ab-cdef-1234-567890abcdef"
data-blockingmode="auto"
data-consentmode="disabled"
></script>
Alternatively, you can add this setting as a query parameter.
This is particularly useful if you implement Cookiebot using a custom HTML tag in Google Tag Manager, since non-standard attributes are stripped. This makes the use of data attributes impossible.
Here's an example of how this could look:
<script
id="Cookiebot"
type="text/javascript"
src="https://consent.cookiebot.com/uc.js?consentmode=disabled"
data-cbid="12345678-90ab-cdef-1234-567890abcdef"
async
></script>
You may also implement the use of Google Tag Manager with manual blocking and implementation of prior consent for any remaining elements outside your tag manager. Use the script for manual cookie blocking and follow our guide here for setting up Google Tag Manager implementation
Comments
30 comments
When would you use this installation mode versus the other one outlined here: https://support.cookiebot.com/hc/en-us/articles/360003793854
We are having issues of Pardot tracking working with Cookiebot -- will changing the deployment help with that?
Great guide, thanks! With this implementation I found that the GTM Preview & Debug Mode stops working as it seems to block the GTM preview JS library from loading in the browser. What do you recommend?
Same issue :(
Plus when i agree with the cookies and go back to the page with the video, it doesnt show up anymore?
As pointed out above, this setup seems to break GTM's "Preview and Debug mode". The debug panel seems to open, but it remains an empty box.
In the browser's dev-tools, it seems the loading of the "https://tagmanager.google.com/debug/debuguiApp-bundle.js" script is cancelled, and I am guessing this is due to Cookiebot's automatic blocking behaviour?
Since that script is loaded by GTM behind the scenes, it is not possible to allow it with the `data-cookieconsent="ignore"` attribute. Is there any other way to add exceptions to Cookiebot's automatic blocking ? Or can automatic blocking with GTM be implemented in another way, that does not break the preview and debug mode?
Using this implementation as far as I can tell only fires your tags after the consent dialog is submitted (only on the first page the consent is provided on). In my tests, if you set your cookie preferences and then navigate to another page the cookie_consent_ events don't fire. Am I missing something?
I got around this by adding the following code after my cookiebot script on each page
<script>
function CookiebotCallback_OnAccept() {
if (Cookiebot.consent.preferences)
dataLayer.push({'event':'cookie_consent_preferences'});
if (Cookiebot.consent.statistics)
dataLayer.push({'event':'cookie_consent_statistics'});
if (Cookiebot.consent.marketing)
dataLayer.push({'event':'cookie_consent_marketing'});
}
</script>
Another thing worth noting is that if you are pushing the cookie_consent_ events manually, as described above, and triggering your Google Analytics tracking script using these events in Google Tag Manager, make sure to configure the Tag Firing Options (Under Advanced Settings) to 'Once per page'. Otherwise, the GA script will fire twice causing two page hits instead of one.
Hi Matthew, would that script work in a custom HTML tag in tag manager that triggers on all pages then?
Hi,
I have followed same steps described in this page and implemented in drupal website.
And i could see JS variable "Cookiebot.consent" is set according user accept values and "dataLayer" event also triggering perfectly in all pages.
Does this means its working fine? How can i confirm that GTM works perfectly after user accepts statistics consent and GTM doesnt when user doesn't provide consent?
Benjamin:
I wouldn't execute that script via Tag Manager, I just placed it immediately below my Cookiebot script directly in the site's head code. Worth double-checking my observations are correct (cookie_consent_ events not firing on subsequent pages) on your own site too.
Another thing worth noting is that if you are pushing the cookie_consent_ events manually as described above and triggering your Google Analytics tracking script using these events in Google Tag Manager make sure to configure the Tag Firing Options (Under Advanced Settings) to 'Once per page'. Otherwise, the GA script will fire twice causing two page hits instead of one.
Manjunath:
If you followed the steps above, Cookiebot is likely blocking Google's Tag Manager preview functionality (if not let me know how you are achieving that.)
I use the Ghostery and EditThisCookie Chrome extensions to monitor which tags and cookies are firing and when. Just make sure to turn off Ghostery's ad-blocking features or it will block your tags and cookies itself.
Also, using Google Tag Assistant recordings is a useful way to see which tags are firing and what is happening with your Google Analytics tracking.
Hi Matthew,
You don't need to include that script to each page. The Cookiebot script pushes these events to the dataLayer on each page when the script loads.
If you push the events again, your triggers will also fire your tags again.
We're also aware that the preview breaks if you combine Cookiebot with automatic cookie blocking and Google Tag Manager.
Is there a plan to get Google Tag Manager Preview to work? The clients we work with all have marketing teams that rely on the Preview functionality to create their tags. They are all getting emails about "Prior consent fully enabled" and are concerned their Cookiebot configuration is not set up properly.
Just implemented GTM and Automatic cookie blocking and getting all of a sudden 100% bounce rates. Anyone noticing the same effect occuring to their site?
Georg Nasser
I would recommend sending us a ticket regarding the issue for the specific domain.
I don't quite understand why the triggers (for preferences, statistics, marketing) here have the following settting:
"Make sure All custom events is checked under This trigger fires on"
While here https://support.cookiebot.com/hc/en-us/articles/360003793854 in section "2. Controlling cookies" you need to speficify in what case the trigger fires.
Would the setting from https://support.cookiebot.com/hc/en-us/articles/360003793854 also work in this case?
Hello there. It's a shame that this implementation prevents the "Debug mode" of Google tag manager from working, as it makes it totally useless.... Can't work properly with GTM.
Any idea on how to resolve that ?
Hi Nicolas Chollet,
We're currently looking into resolving the issue. The problem most likely lies in the fact that the preview relies on certain cookies to be present.
I can't give you an exact timeline, but since a very large part of our customer base have ran into this issue, this has been given high priority.
We're pleased to announce that we've finally found the cause of the Preview breaking when using auto blocking. The issue has been resolved with today's release.
I'm asking me the same ask, like Tycho Willems
Here https://support.cookiebot.com/hc/en-us/articles/360009192739/comments/360001010539
Please could someone give us an answer?
Hi Regina Oswald (and Tycho Willems),
While not strictly necessary, the trigger configuration described in step 2 of https://support.cookiebot.com/hc/en-us/articles/360003793854-Google-Tag-Manager-deployment does indeed also work in this set-up.
The Cookiebot script will only push events if the corresponding category has been consented to. So the mere fact that an event is pushed is sufficient to determine that consent has been given.
Checking the value of the Cookie Consent variable is optional in this case.
In cases where you don't want to use one of the Cookiebot triggers, but still need to check the consent state, using the Cookie Consent variable is the best approach.
Is this method even compliant with the GDPR? I mean, you grant GTM full control over itself because it will be ignored by Cookiebot, which means that it can set as many (tracking) cookies as it wants.
By default, Google Tag Manager does NOT use cookies because GTM is just a middle man between your website and marketing/analytics tools you have installed. Google Tag Manager does not store any personal data about visitors. On the other hand, those 3rd party tools YOU have installed via GTM, they are most likely storing cookies and process PII (personally identifiable information).
Hi ETES GmbH,
We want the script to be ignored to ensure the dataLayer is ready to receive events from Cookiebot. Your concern that this can lead to cookies being set without consent in not totally unwarranted though. As Georg Nasser explains, GTM doesn't use cookies itself, but the tags you fire can. This does mean that you could be setting cookies without prior consent.
However, the alternative is, when you don't "ignore" GTM, that a single misconfigured trigger will cause the entire GTM script and all tags to be blocked prior consent. Which is obviously very undesirable as well.
Therefore, if you choose this method, make sure to correctly configure your triggers. If you find yourself struggling with this, please don't hesitate to contact our support team.
Hi,
I spend 2 days on that Consent mode, and I really there is something wrong.
First the "Make sure All custom events is checked under This trigger fires on " seems to be wrong. The triggers Marketing/Stats and Prefs shoudl fires when the "Consent mode" contain "preferences" or "marketing"... but not on all events.
But yes, Analytics, Ads, Conversion linker tag should fired always, without condition of marketing, stats, this is on the Google side, that it will handle it.
On my side, I tried with the script id="Cookiebot" on auto or manual, same thing, I can not see the Analytics working. I install the gtag("consent", "default", first. I see the Analytics tag executed, but nothing is showing in Analytics realtime. Whenever I accept the stats and/or marketing, cookies are nether installed on the browser, and then the tag is executed without cookies, that seems to have no effect to Analytics, even if the tag is fired. (Tag assistant in Chrome).
That means, this portion of code is always blocking the cookies, if I accept stats or not.
That without cookies Analytics tags send nothing, even the promise "ping", and Analytics stays at 0.
Did somebody managed to make it works ? I have the data-cookieconsent="ignore"
Hi hugolin69,
Sadly we've been receiving similar feedback from several users that have more or less the same experience you describe.
We've relayed our findings in these cases to Google, who are looking into this issue.
Several users have reported that Consent Mode appears to work far better with GA4 than older versions.
If you're unsure if you've correctly set-up Consent Mode (although judging from your message you've done it correctly), you can try following the instructions mentioned in this guide: Checking if Consent Mode is properly implemented – Cookiebot Support
Hi,
Thank you, I already saw this article, and all was good. You mentionned the G4, which was something I want to try, but I need to make many changes for that. Thanks for confirming I am not creasy, after 2 days of works on that. you should correct the article for the All events thing, because it drives to the wrong conclusion, and maybe you could mention somewhere that there is some workaround.
Everyone here probably needs to be aware of this ongoing issue:
https://support.cookiebot.com/hc/en-us/community/posts/360010218399-Google-Analytics-Pageviews-suddenly-incredibly-low
Why does this page state that I must rename the trigger events from cookieconsent_category to cookie_consent_category, when the events are already named "cookie_consent_category" etc. on the page about the standard GTM setup (https://support.cookiebot.com/hc/en-us/articles/360003793854-Google-Tag-Manager-deployment)?
Hi Chris,
Previously we used a custom HTML tag that which added the Cookiebot (uc.js) script and manually pushed cookieconsent_category events to the dataLayer in a callback function.
We decided that we might as well build the pushing of events into the uc.js script, but we wanted to prevent that tags were fired twice for users that were still using the "old" method. We therefore used the slightly different cookie_consent_category events which are pushed by uc.js, opposed to by a callback added to the Cookiebot tag.
That way users using the old method are unaffected by the change.
Hi Richard, quick question: Do you see any issues if the Google Optimize and GTM snippets are placed (directly) after the cookiebot autoblocking script?
We are using a modified version of the cookiebot script that automatically sets all consent cookies for users outside the GDPR countries.
To combine this with Google Optimize I have to wait for your script to set the cookies before the optimize script executes.
Thanks a lot.
Regards,
Jochen
Hi Jochen Setzer,
I apologize for the delayed response, since I'm not the owner of the article I don't get notifications when comments are added.
I can't think of any potential issues when placing Google Optimize and GTM snippets directly after the Cookiebot script. As a matter of fact I believe that would be the optimal way to go about it.
You may have to mark up both scripts with data-cookieconsent="ignore" to ensure they won't be blocked prior consent.
Please sign in to leave a comment.