What Is Cookie Consent?

Collecting user data without permission isn’t allowed. Cookie consent is how you ask a visitor for permission before you track them or set cookies. Usually a banner or pop-up on the first visit.

What Changed in Consent Mode V2?

Google added two new signals. It’s now mandatory for anyone showing ads to users in the EEA, since March 2024.

The 4 Consent Signals

• ad_storage — granted / denied. Cookie-based ad storage (Google Ads, Meta Ads).

• ad_user_data — granted / denied. Can user data go to Google for ads at all.

• ad_personalization — granted / denied. Can that data be used for retargeting.

• analytics_storage — granted / denied. GA4 cookie storage and data collection.

How Do CMPs Group These?

Two categories: Marketing (the three ad_* signals) and Statistics (analytics_storage).

Heads up: some CMPs, like Cookiebot, bundle all three ad_* signals under one Marketing toggle. Allow marketing, and all three go to granted together.

Basic or Advanced Consent Mode?

• Basic: tags don’t fire until consent is granted. Simple, but it misses the very first event of the session.

• Advanced: tags fire regardless of consent, Google fills the gaps with modeling. Fixes the first-event problem, but only for Google’s own products. Facebook and TikTok get nothing from that modeling.

Why Do Events Fire Twice on Basic Consent Mode?

Because the standard fix adds a second trigger (cookie_consent_update) next to your existing one. Two triggers on one tag means every event after the first fires twice.

How Do You Fix the Double-Firing?

One Custom HTML tag that checks if the CookieConsent cookie already exists:

<script>
  window.isConsentCookie = document.cookie.includes('CookieConsent=');
</script>

<script>
  window.isConsentCookie = document.cookie.includes('CookieConsent=');
</script>

<script>
  window.isConsentCookie = document.cookie.includes('CookieConsent=');
</script>

Fire it on Consent Initialization - All Pages. Build a JS Variable off it (isConsentCookie). Add a condition to your consent-update trigger: only fire when isConsentCookie is false. Done, no more double counting.

What About Product Pages as the Entry Point?

Same bug, different page. First visit lands on a product page, not the homepage, and that page view won’t get counted. Fix: copy the cookie_consent_update trigger, point it at that URL, attach it to that page view event too.

Does Server-Side Tracking Change Anything?

Yes, and it trips up experienced setups. ad_storage granted does nothing for GA4 data if analytics_storage is denied. GA4 always flows through analytics_storage, even server-side.

What’s the Server-Side Fix?

Set your Analytics tag’s advanced settings to fire in the web container no matter the consent state. In the server container’s Preview mode, read Event Data to see exactly which permissions a user granted. Build variables off that. Wire Marketing and Analytics triggers separately, they need to behave independently.

What About First-Visit Page Views Server-Side?

Same problem, same fix pattern. Create a dedicated GA4 page_view event tag in the web container. Move the Cookie Consent Update trigger off your base GA4 tag onto this new page_view tag instead.

Do I Need to Support TCF Too?

If your CMP supports the IAB’s Transparency & Consent Framework, yes. Turn it on in your CMP, and drop this above your GTM base code:

<script>
window['gtag_enable_tcf_support'] = true;
</script>

<script>
window['gtag_enable_tcf_support'] = true;
</script>

<script>
window['gtag_enable_tcf_support'] = true;
</script>

Source: Google’s “Implement the Transparency & Consent Framework” guide.

Any WordPress Gotchas?

If you’re only using a GTM plugin to enable the dataLayer, check its settings for a hidden attribution badge. Most ship one by default, and it’ll show up on your live site if you don’t turn it off.

How Do You Know It’s Actually Working?

Run a real test conversion in GTM Preview, both containers if you’re server-side. Purge your cache after publishing. Clear your own cookies, walk through the banner, confirm every event fires once with the right permissions attached.