How to Set Default Consent Settings in GTM: A Practical Guide for GDPR Compliance

Introduction

*Updated for 2026 compliance practices.*

Setting default consent settings in Google Tag Manager (GTM) is a foundational step for any website owner aiming to align with GDPR requirements. This practical guide explains what `set-default-consent-settings-gtm` means for your site, how to implement it correctly, and how to verify your setup using GDPRChecker’s scanner. We’ll cover technical steps, common pitfalls, and validation methods—all based on official documentation and practical experience. Remember, this is technical implementation guidance, not legal advice.

What Does Set Default Consent Settings GTM Mean for Website Owners?

When a user first lands on your website, before they interact with your cookie banner, your tags and scripts must behave as if consent has not been granted. In GTM, this is achieved by configuring the default consent state for various consent types (such as `ad_storage`, `analytics_storage`, `functionality_storage`, `personalization_storage`, and `security_storage`). The command `set-default-consent-settings-gtm` is not an actual GTM API call; rather, it refers to the practice of using Google Consent Mode’s default consent settings within GTM to ensure that tags respect the user’s initial unconsented state.

By setting defaults to `denied` for all non-essential consent types, you prevent tags from setting cookies or sending data before the user has made a choice. This is critical because under GDPR, processing personal data (including via cookies) generally requires prior consent. Google Consent Mode allows tags to adjust their behavior based on the consent state, sending cookieless pings when consent is denied, which can help with modeling in Google Analytics 4 and Google Ads. However, the legal basis for such modeling is still subject to interpretation, and you should consult your legal team.

For website owners, this means you must actively configure your GTM container to default to a denied state and then update it only after the user has granted consent via your Consent Management Platform (CMP). This is not just a technical checkbox; it’s a practical compliance topic that directly impacts how your analytics, advertising, and functional tags operate.

Requirements and Compliance Expectations

GDPR requires that you obtain valid consent before processing personal data. In the context of tags and cookies, this typically means blocking tags that set non-essential cookies until the user has explicitly agreed. The European Data Protection Board (EDPB) has emphasized that consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes or implied consent are not compliant.

When using GTM, the default consent settings must reflect a “no consent” state. This means: - `ad_storage`: denied - `analytics_storage`: denied - `functionality_storage`: denied (if it involves non-essential processing) - `personalization_storage`: denied - `security_storage`: granted (usually, as it’s essential)

Note that `security_storage` is typically set to `granted` because it relates to security measures that are necessary for the website’s operation. However, you should assess whether your use of security storage actually falls under the strictly necessary exemption.

Compliance expectations also include: - Providing a clear and accessible cookie banner that explains the purposes of data processing. - Ensuring that the banner offers a “Reject All” option that is as easy to use as “Accept All.” - Keeping records of consent (a CMP usually handles this). - Allowing users to withdraw consent at any time.

If you use Google services like Google Analytics 4 or Google Ads, you should also implement Google Consent Mode v2, which introduces two additional consent signals: `ad_user_data` and `ad_personalization`. These must also be set to `denied` by default. For more details, see our guide on Google Consent Mode v2.

How to Implement Set Default Consent Settings GTM Step by Step

Implementing default consent settings in GTM involves a few key steps. Below is a detailed walkthrough.

Step 1: Choose a Consent Management Platform (CMP)

While you can manually manage consent states, using a CMP is highly recommended. A CMP automates the consent collection and updates the consent state in GTM. If you’re wondering whether you need a CMP even if you don’t run Google Ads, check our article Do I Need a CMP If I Do Not Run Google Ads?.

Step 2: Set Up Consent Mode Defaults in GTM

1. In your GTM container, go to **Tags** and create a new tag.
2. Choose **Tag Configuration** > **Custom HTML** (or use a tag template if your CMP provides one).
3. Insert the following code **before** your GTM container script (or as early as possible in the `<head>`):

```html <script> window.dataLayer = window.dataLayer || []; function gtag() { dataLayer.push(arguments); } gtag('consent', 'default', { 'ad_storage': 'denied', 'ad_user_data': 'denied', 'ad_personalization': 'denied', 'analytics_storage': 'denied', 'functionality_storage': 'denied', 'personalization_storage': 'denied', 'security_storage': 'granted', 'wait_for_update': 500 }); </script> ```

1. Set the tag to fire on **All Pages** with a trigger of **Consent Initialization - All Pages**. This ensures the defaults are set before any other tags fire.

**Important:** The `wait_for_update` parameter tells tags to wait for a consent update from your CMP before firing. The value is in milliseconds; 500ms is typical, but you may need to adjust based on your CMP’s response time.

Step 3: Configure Your CMP to Update Consent

Your CMP must push an update to the data layer when the user makes a choice. This usually looks like:

```javascript gtag('consent', 'update', { 'ad_storage': 'granted', 'analytics_storage': 'granted', // etc. }); ```

Ensure your CMP is correctly integrated with GTM. Many CMPs have built-in GTM templates that simplify this process.

Step 4: Adjust Tag Triggers for Consent

For each tag in GTM that requires consent, you should add a consent check. GTM’s built-in consent settings allow you to specify which consent types are required for a tag to fire. For example, a Google Analytics 4 tag should require `analytics_storage` consent. You can set this in the tag’s **Advanced Settings** > **Consent Settings**.

Alternatively, you can use custom triggers that fire only when the corresponding consent state is `granted`. This is more flexible but requires more setup.

Step 5: Test Your Implementation

After setting up, thoroughly test your implementation. Use GTM’s Preview mode to verify that: - Default consent is set to `denied` on page load. - No non-essential tags fire before consent. - After consent is granted, the consent state updates and tags fire accordingly. - After consent is denied, tags remain blocked or fire in cookieless mode.

Common Mistakes and How to Avoid Them

Even with careful setup, mistakes can happen. Here are some common pitfalls and how to avoid them.

1. Setting Defaults Too Late

If your default consent script fires after other tags, those tags may execute before consent is set. Always place the default consent script as early as possible, ideally directly in the `<head>` before the GTM container snippet.

2. Forgetting to Deny All Non-Essential Types

Some implementations only deny `analytics_storage` and `ad_storage`, forgetting `functionality_storage` or `personalization_storage`. If you use these for non-essential purposes, they must also be denied by default.

3. Not Using `wait_for_update`

Without `wait_for_update`, tags may fire immediately with the default denied state, but then not re-fire when consent is granted. This can cause data loss. The `wait_for_update` parameter tells tags to wait for a consent update before firing, ensuring they fire with the correct state.

4. Inconsistent Consent States Across Services

If you use multiple services (e.g., Google Analytics and Facebook Pixel), ensure that the consent states are consistent. For example, if a user denies `analytics_storage`, both Google Analytics and any other analytics tool should be blocked.

5. Not Testing the Reject Flow

Many implementations only test the “Accept All” flow. It’s crucial to test what happens when a user rejects all or customizes their consent. Verify that tags are not firing and that no cookies are set.

6. Relying Solely on GTM’s Built-in Consent Checks Without Defaults

GTM’s built-in consent checks are useful, but they only work if the default consent state is correctly set. If you don’t set defaults, GTM may assume consent is granted until told otherwise, which is non-compliant.

How to Validate with GDPRChecker

After implementing default consent settings, you need to verify that your website is actually compliant. This is where GDPRChecker’s scanner comes in. GDPRChecker scans help verify pre-consent network requests, banner behavior, and disclosure gaps after changes.

Here’s how to use it:

1. **Run a Pre-Consent Scan:** Use GDPRChecker to scan your website before interacting with the cookie banner. The scanner will check for any network requests that set cookies or send data. If you see requests to analytics or advertising endpoints, your defaults may not be working.
2. **Check Banner Behavior:** The scanner can also verify that your cookie banner appears correctly and that the options are clear. It checks for common issues like missing “Reject All” buttons or pre-ticked boxes.
3. **Validate After Consent:** After granting consent, run another scan to ensure that tags are firing as expected. This helps confirm that your consent updates are working.
4. **Test the Reject Flow:** Use the scanner to simulate a user who rejects all cookies. Verify that no non-essential tags fire and that essential tags (like `security_storage`) still work.

GDPRChecker also checks for other compliance gaps, such as missing privacy policy links or incomplete disclosures. For a comprehensive check, combine it with our Google Consent Mode v2 Checker to ensure your Consent Mode implementation is correct.

Regular scanning is essential because websites change over time. New tags, plugins, or updates can inadvertently break your consent setup. Schedule periodic scans to catch issues early.

Implementation Checklist

Use this checklist to ensure you’ve covered all bases when setting default consent settings in GTM:

1. Choose a CMP that supports Google Consent Mode v2.
2. Place the default consent script in the `<head>` before the GTM container.
3. Set all non-essential consent types to `denied` (ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, personalization_storage).
4. Set `security_storage` to `granted` if it’s strictly necessary.
5. Include `wait_for_update` with an appropriate timeout (e.g., 500ms).
6. Configure your CMP to push consent updates to the data layer.
7. Add consent checks to all relevant tags in GTM (either via built-in settings or custom triggers).
8. Test in GTM Preview mode: verify defaults, consent updates, and tag firing.
9. Test the “Reject All” flow thoroughly.
10. Run a GDPRChecker scan before and after consent to validate network requests.
11. Check that your cookie banner meets [cookie banner requirements](/guides/cookie-banner-requirements).
12. Document your setup and keep records of consent configurations.

FAQ

What is set-default-consent-settings-gtm?

It refers to the practice of configuring default consent states in Google Tag Manager using Google Consent Mode. This ensures that tags do not fire or set cookies until the user has granted consent, which is a key requirement for GDPR compliance.

Do I need set-default-consent-settings-gtm for GDPR?

Yes, if you use GTM to manage tags that process personal data. GDPR requires prior consent for non-essential cookies and tracking. Setting defaults to denied ensures compliance by blocking tags until consent is obtained.

How do I implement set-default-consent-settings-gtm?

Implement by adding a Consent Mode default script in the `<head>` of your site, setting all non-essential consent types to denied. Then, use a CMP to update consent based on user choices. Detailed steps are in the implementation section above.

How can I verify set-default-consent-settings-gtm with a scanner?

Use GDPRChecker’s scanner to check for pre-consent network requests. Run a scan before interacting with your banner; if any non-essential requests appear, your defaults may not be working. Also scan after consent to confirm tags fire correctly.

What are common set-default-consent-settings-gtm mistakes?

Common mistakes include placing the default script too late, forgetting to deny all consent types, omitting `wait_for_update`, not testing the reject flow, and relying solely on GTM’s built-in checks without setting proper defaults.

Next Steps for a Compliant Setup

Setting default consent settings in GTM is just one part of a broader compliance strategy. To close other gaps, explore our related guides: - Google Analytics GDPR Compliance - Consent Mode v2 vs Google Certified CMP - Google Consent Mode v2 Guide

Remember, compliance is an ongoing process. Regularly scan your site with GDPRChecker to catch new issues, and stay updated with regulatory changes. For a complete check, run a scan now and ensure your `set-default-consent-settings-gtm` implementation is watertight.

<!-- schema:faq ready -->

Copyright and editorial notice