How to Set Up Cookiebot with Google Tag Manager
A step by step setup, including the tag sequencing mistake that silently blocks all your measurement.
Cookiebot is one of the more common consent tools, and the setup has one step that is easy to get wrong in a way that silently blocks all your measurement.
Here is the full setup, with that step called out clearly.
What you are building
Three things working together:
Cookiebot loads early and sets consent defaults before anything else runs.
GTM loads and initialises Consent Mode with those defaults.
Tags wait for consent, then fire when the user grants it.
Get the order wrong and either you collect data before consent, or nothing ever fires. Both happen regularly.
Step one: the Cookiebot GTM template
Use the official Cookiebot CMP template from the GTM community template gallery. Do not paste the script into a Custom HTML tag.
The template exists specifically to handle consent initialisation correctly, and hand rolling it is how the load order goes wrong.
In GTM, go to Templates, search the gallery for Cookiebot CMP, and add it.
Create a new tag from that template.
Enter your Cookiebot domain group ID.
Set your default consent states per region.
Step two: the trigger, which is the important bit
Set the tag’s trigger to Consent Initialization, not All Pages.
This is the step people get wrong. Consent Initialization is a special trigger that fires before everything else, including tags set to fire on page view or on the container load.
If you trigger Cookiebot on All Pages, other tags can fire first, before consent defaults are set. Then you are collecting data without consent, which is the exact problem the tool was bought to solve.
One dropdown. Get it right.
Step three: set defaults by region
In the template configuration, set what consent is assumed before the user chooses.
A sensible configuration:
EEA, UK and Switzerland: all consent types denied by default.
Other regions: set according to your legal advice and your own policy. Many businesses grant by default outside strict jurisdictions.
Region specific defaults matter commercially. Applying EEA defaults worldwide means losing a large share of your US and other data for no legal reason.
Step four: set consent requirements on your tags
Every tag in GTM has a Consent Settings section under Advanced Settings.
Set additional consent checks per tag:
GA4 tags. Require analytics_storage.
Google Ads conversion and remarketing. Require ad_storage and ad_user_data.
Meta, TikTok and other advertising pixels. Require ad_storage.
Heatmaps and session recording. Require analytics_storage, and check what your tool’s own requirements are.
Google’s own tags respect Consent Mode natively. Third party tags generally do not, which is why you set the requirement explicitly on them.
Step five: verify
Open GTM preview on the live site in a fresh browser profile.
Before choosing anything, check the Consent tab in preview. Defaults should show as denied for the relevant types.
Confirm Google tags fire but send cookieless pings, and that third party pixels do not fire at all.
Accept consent. Confirm the state updates and previously blocked tags now fire.
Check the browser cookie list before and after. No analytics cookie before consent, one after.
Reject consent in another fresh profile and confirm nothing is set.
Step four is the one that proves it to a sceptical legal team, and it takes thirty seconds.
Common problems
Nothing fires at all. Usually the consent requirement is set to a consent type Cookiebot never grants, or the category mapping is wrong.
Everything fires before consent. The Consent Initialization trigger was not used.
Banner appears on every page load. Cookie storage problem, often caused by the consent cookie being set on the wrong domain.
Consent not shared across subdomains. Check the Cookiebot domain configuration covers the root domain.
Google Ads conversions drop sharply. Expected to some degree, and check that ad_user_data is being granted rather than only ad_storage.
Cookiebot’s automatic script blocking
Cookiebot can block scripts directly on the page, independently of GTM, by rewriting script tags.
If you are managing consent through GTM, this feature can conflict with it and produce confusing behaviour where a tag fires in preview and not in production.
Pick one mechanism. If GTM is handling consent, configure Cookiebot’s automatic blocking accordingly rather than running both.
After setup
Watch your consent rate in the Cookiebot dashboard for the first fortnight. If it is very low, the banner design is worth working on, because consent rate directly determines how much data you have.
And expect your reported conversions to change. Understanding by how much and why is worth doing deliberately: Consent Mode v2 and lost conversions.
Need this built properly?
One trigger setting is the difference between a working consent setup and a decorative one. I set up and repair tracking for ecommerce stores and lead generation businesses, so the numbers in your ad accounts match the money in your bank account.
Have a look at what I do, or book a call and we can go through your setup together.
