Combine the use of Google Tag Manager with automated cookie blocking by Cookiebot to get the best of both worlds. Implementation is quick and easy and allows you to:
- Control tags and cookies based on the user's consent, using triggers and Consent Mode in Google Tag Manager AND
- Let Cookiebot automatically control all other cookies not set by Google Tag Manager, based on the consent given, typically cookies set by third party scripts that are embedded directly in your website.
To achieve this, make sure that the Cookiebot script is not executed by Google Tag Manager. So either remove the Cookiebot CMP tag or the "All Pages" trigger assigned to it.
Furthermore:
- Make sure that Google Tag Manager is the very first script to load on your website.
- Mark up your Google Tag Manager script tag with:
data-cookieconsent="ignore"
This will ensure that Google Tag manager will always be allowed load. - Insert the Cookiebot script with automatic cookie blocking immediately after Google Tag Manager script.
Here's an example of how this could look:
If you have renamed the dataLayer, you need to add the data-layer-name attribute to the Cookiebot script tag, with the new dataLayer name as its value. For example: data-layer-name="gtmDataLayer".
For the Google tags Google Ads (Google Ads Conversion Tracking and Remarketing), Floodlight, Google Analytics and Conversion Linker, we recommend using Google Consent Mode, which can be activated by inserting the following snippet right before the GTM tag on your site:
<script data-cookieconsent="ignore">
window.dataLayer = window.dataLayer || [];
function gtag() {
dataLayer.push(arguments);
}
gtag("consent", "default", {
ad_storage: "denied",
analytics_storage: "denied",
wait_for_update: 500,
});
gtag("set", "ads_data_redaction", true);
</script>
Please ensure that this script loads before the Google Tag Manager script! If you have renamed the dataLayer, ensure that you replace window.dataLayer with the actual name of the dataLayer. For example: window.gtmDataLayer
= window.gtmDataLayer || [];
For all other cookie-setting tags in Google Tag Manager, implement a trigger for each of the three categories.
If you're modifying a previous Cookiebot implementation:
Change the event name for each tag from cookieconsent_category to cookie_consent_category
Or if you're creating new triggers:
- From the menu on the left, select Triggers
- Create a new trigger by clicking New and choose Custom Event
- Under Event name, for each of the categories, enter the corresponding value:
Preferences : cookie_consent_preferences Statistics : cookie_consent_statistics Marketing : cookie_consent_marketing - Make sure All custom events is checked under This trigger fires on
- Click Save to create the trigger.
Assign these triggers to the tags you wish to control based on the user's consent. For example, assign the cookie_consent_marketing trigger to your Facebook Pixel Code tag like here:
If you adjusted existing triggers, you don't need to assign them again to the tags they were assigned to.
You may also implement the use of Google Tag Manager with manual blocking and implementation of prior consent for any remaining elements outside your tag manager. Use the script for manual cookie blocking and follow our guide here for setting up Google Tag Manager implementation
Comments
21 comments
When would you use this installation mode versus the other one outlined here: https://support.cookiebot.com/hc/en-us/articles/360003793854
We are having issues of Pardot tracking working with Cookiebot -- will changing the deployment help with that?
Great guide, thanks! With this implementation I found that the GTM Preview & Debug Mode stops working as it seems to block the GTM preview JS library from loading in the browser. What do you recommend?
Same issue :(
Plus when i agree with the cookies and go back to the page with the video, it doesnt show up anymore?
As pointed out above, this setup seems to break GTM's "Preview and Debug mode". The debug panel seems to open, but it remains an empty box.
In the browser's dev-tools, it seems the loading of the "https://tagmanager.google.com/debug/debuguiApp-bundle.js" script is cancelled, and I am guessing this is due to Cookiebot's automatic blocking behaviour?
Since that script is loaded by GTM behind the scenes, it is not possible to allow it with the `data-cookieconsent="ignore"` attribute. Is there any other way to add exceptions to Cookiebot's automatic blocking ? Or can automatic blocking with GTM be implemented in another way, that does not break the preview and debug mode?
Using this implementation as far as I can tell only fires your tags after the consent dialog is submitted (only on the first page the consent is provided on). In my tests, if you set your cookie preferences and then navigate to another page the cookie_consent_ events don't fire. Am I missing something?
I got around this by adding the following code after my cookiebot script on each page
<script>
function CookiebotCallback_OnAccept() {
if (Cookiebot.consent.preferences)
dataLayer.push({'event':'cookie_consent_preferences'});
if (Cookiebot.consent.statistics)
dataLayer.push({'event':'cookie_consent_statistics'});
if (Cookiebot.consent.marketing)
dataLayer.push({'event':'cookie_consent_marketing'});
}
</script>
Another thing worth noting is that if you are pushing the cookie_consent_ events manually, as described above, and triggering your Google Analytics tracking script using these events in Google Tag Manager, make sure to configure the Tag Firing Options (Under Advanced Settings) to 'Once per page'. Otherwise, the GA script will fire twice causing two page hits instead of one.
Hi Matthew, would that script work in a custom HTML tag in tag manager that triggers on all pages then?
Hi,
I have followed same steps described in this page and implemented in drupal website.
And i could see JS variable "Cookiebot.consent" is set according user accept values and "dataLayer" event also triggering perfectly in all pages.
Does this means its working fine? How can i confirm that GTM works perfectly after user accepts statistics consent and GTM doesnt when user doesn't provide consent?
Benjamin:
I wouldn't execute that script via Tag Manager, I just placed it immediately below my Cookiebot script directly in the site's head code. Worth double-checking my observations are correct (cookie_consent_ events not firing on subsequent pages) on your own site too.
Another thing worth noting is that if you are pushing the cookie_consent_ events manually as described above and triggering your Google Analytics tracking script using these events in Google Tag Manager make sure to configure the Tag Firing Options (Under Advanced Settings) to 'Once per page'. Otherwise, the GA script will fire twice causing two page hits instead of one.
Manjunath:
If you followed the steps above, Cookiebot is likely blocking Google's Tag Manager preview functionality (if not let me know how you are achieving that.)
I use the Ghostery and EditThisCookie Chrome extensions to monitor which tags and cookies are firing and when. Just make sure to turn off Ghostery's ad-blocking features or it will block your tags and cookies itself.
Also, using Google Tag Assistant recordings is a useful way to see which tags are firing and what is happening with your Google Analytics tracking.
Hi Matthew,
You don't need to include that script to each page. The Cookiebot script pushes these events to the dataLayer on each page when the script loads.
If you push the events again, your triggers will also fire your tags again.
We're also aware that the preview breaks if you combine Cookiebot with automatic cookie blocking and Google Tag Manager.
Is there a plan to get Google Tag Manager Preview to work? The clients we work with all have marketing teams that rely on the Preview functionality to create their tags. They are all getting emails about "Prior consent fully enabled" and are concerned their Cookiebot configuration is not set up properly.
Just implemented GTM and Automatic cookie blocking and getting all of a sudden 100% bounce rates. Anyone noticing the same effect occuring to their site?
Georg Nasser
I would recommend sending us a ticket regarding the issue for the specific domain.
I don't quite understand why the triggers (for preferences, statistics, marketing) here have the following settting:
"Make sure All custom events is checked under This trigger fires on"
While here https://support.cookiebot.com/hc/en-us/articles/360003793854 in section "2. Controlling cookies" you need to speficify in what case the trigger fires.
Would the setting from https://support.cookiebot.com/hc/en-us/articles/360003793854 also work in this case?
Hello there. It's a shame that this implementation prevents the "Debug mode" of Google tag manager from working, as it makes it totally useless.... Can't work properly with GTM.
Any idea on how to resolve that ?
Hi Nicolas Chollet,
We're currently looking into resolving the issue. The problem most likely lies in the fact that the preview relies on certain cookies to be present.
I can't give you an exact timeline, but since a very large part of our customer base have ran into this issue, this has been given high priority.
We're pleased to announce that we've finally found the cause of the Preview breaking when using auto blocking. The issue has been resolved with today's release.
I'm asking me the same ask, like Tycho Willems
Here https://support.cookiebot.com/hc/en-us/articles/360009192739/comments/360001010539
Please could someone give us an answer?
Hi Regina Oswald (and Tycho Willems),
While not strictly necessary, the trigger configuration described in step 2 of https://support.cookiebot.com/hc/en-us/articles/360003793854-Google-Tag-Manager-deployment does indeed also work in this set-up.
The Cookiebot script will only push events if the corresponding category has been consented to. So the mere fact that an event is pushed is sufficient to determine that consent has been given.
Checking the value of the Cookie Consent variable is optional in this case.
In cases where you don't want to use one of the Cookiebot triggers, but still need to check the consent state, using the Cookie Consent variable is the best approach.
Is this method even compliant with the GDPR? I mean, you grant GTM full control over itself because it will be ignored by Cookiebot, which means that it can set as many (tracking) cookies as it wants.
By default, Google Tag Manager does NOT use cookies because GTM is just a middle man between your website and marketing/analytics tools you have installed. Google Tag Manager does not store any personal data about visitors. On the other hand, those 3rd party tools YOU have installed via GTM, they are most likely storing cookies and process PII (personally identifiable information).
Hi ETES GmbH,
We want the script to be ignored to ensure the dataLayer is ready to receive events from Cookiebot. Your concern that this can lead to cookies being set without consent in not totally unwarranted though. As Georg Nasser explains, GTM doesn't use cookies itself, but the tags you fire can. This does mean that you could be setting cookies without prior consent.
However, the alternative is, when you don't "ignore" GTM, that a single misconfigured trigger will cause the entire GTM script and all tags to be blocked prior consent. Which is obviously very undesirable as well.
Therefore, if you choose this method, make sure to correctly configure your triggers. If you find yourself struggling with this, please don't hesitate to contact our support team.
Please sign in to leave a comment.