Google Tag Manager Consent Mode: A Practical Guide for UK Sites

If your site runs Google Analytics or Tag Manager and you have UK or EU visitors, you're covered by UK GDPR and PECR — and both expect consent before non-essential cookies are set, not after. Consent Mode is Google's way of letting your tags respect that choice without you having to rebuild your tracking setup from scratch.

What the law actually asks for

PECR (the Privacy and Electronic Communications Regulations) covers cookies specifically, and UK GDPR covers the personal data those cookies collect. Together they mean: analytics and advertising cookies need informed, opt-in consent before they load — not a banner that fires everything anyway and merely warns you it's happening.

That's the part sites most often get wrong. A cookie banner that just informs, rather than gates, doesn't meet the bar.

How Consent Mode changes things

Consent Mode doesn't remove the need for a consent banner — you still need a proper CMP (Consent Management Platform) making that decision. What it does is give Google's tags a standard way to react to that decision:

• Denied: GA4 and Google Ads tags don't set cookies or send identifying data, but can still send anonymous "pings" that Google uses to model the traffic you'd otherwise have missed.
• Granted: Tags behave normally, cookies are set, and full measurement resumes.

This is why sites using Consent Mode properly tend to see smaller analytics gaps after a "Decline" click than sites that just block GTM entirely — Google's modelling fills in some of the blanks.

Setting it up in GTM

1. Install your CMP so it loads before any other tag — most CMPs provide their own GTM tag template for exactly this.
2. Set default consent state (usually "denied" for analytics_storage and ad_storage) as early as possible, ideally before the GTM container itself finishes loading.
3. Configure your GA4 and Ads tags' built-in consent settings rather than relying only on trigger conditions — this is what lets Consent Mode's modelling kick in.
4. Update consent state when the visitor makes a choice, and confirm tags actually respond by checking the GTM preview mode's consent overview.

The most common mistake isn't missing consent mode — it's a CMP that's installed but never actually wired into the tags it's supposed to be gating.

Checking it's actually working

Don't take the CMP vendor's word for it. Open your site in an incognito window, decline cookies, and check your browser's network tab for requests to google-analytics.com or doubleclick.net. If they're still firing with identifying parameters after a decline, something isn't wired up correctly.

Getting this right protects you legally, but it also protects your data — a consent setup that silently blocks GTM entirely (rather than using Consent Mode's partial signal) can leave you with much bigger gaps in your GA4 reporting than necessary.