What Is Default Consent State in GTM? A Practical Guide for GDPR Compliance

Introduction

*Updated for 2026 compliance practices.*

Understanding **what is default consent state in GTM** is essential for any website owner using Google Tag Manager (GTM) and aiming for GDPR compliance. The default consent state determines how Google tags behave before a visitor makes a consent choice. When a user lands on your site, tags like Google Analytics 4 (GA4) or Google Ads may fire before any consent is given—unless you configure a default that blocks them until consent is obtained. This guide explains what the default consent state is, why it matters for GDPR, how to implement it step by step, common pitfalls, and how to validate your setup with GDPRChecker.

This is a technical implementation guide, not legal advice. Always consult your legal team for compliance requirements specific to your jurisdiction. The European Data Protection Board (EDPB) and GDPR.eu provide authoritative guidance on consent requirements, and Google’s official documentation details the technical aspects of Consent Mode.

Why Default Consent State Matters for GDPR Compliance

The GDPR requires that personal data processing—including via cookies and tracking scripts—only occurs with a valid legal basis, typically user consent. When you use GTM to deploy tags, the default consent state acts as a gatekeeper: it tells Google’s services whether they can use cookies or send data before the user interacts with your consent banner. Without a properly set default, tags may fire on page load, potentially violating GDPR by processing data without consent.

Google Consent Mode (now in version 2) introduces two key parameters that define the default consent state: `ad_storage` and `analytics_storage`. These control consent for advertising cookies and analytics cookies respectively. In GTM, you can set these defaults to `denied` for GDPR compliance, ensuring that no cookies are set and no personal data is sent until the user grants consent. This is critical because even anonymized data collection can be subject to GDPR if it involves unique identifiers.

The default consent state also affects how Google models conversions and behavior for users who decline consent. With Consent Mode v2, Google can use conversion modeling to fill gaps, but only if the default state is correctly implemented. For website owners, this means balancing compliance with data accuracy. A common mistake is leaving the default as `granted`, which assumes consent and can lead to non-compliance. By setting defaults to `denied`, you respect user privacy from the first page view, aligning with the EDPB’s emphasis on privacy by default.

For more on the broader implications, see our guide on Google Consent Mode v2.

How Default Consent State Works in Google Tag Manager

In GTM, the default consent state is configured using the Consent Initialization trigger or by adding a snippet of code to your website before the GTM container loads. This code sets the initial values for consent types. Google’s Consent Mode API then reads these values and adjusts tag behavior accordingly. Tags that support Consent Mode will check the consent state and either fire with full functionality (if consent is granted) or in a cookieless mode (if denied).

Here’s a typical flow: 1. A user visits your site. 2. Before GTM loads, a script sets `gtag('consent', 'default', { 'analytics_storage': 'denied', 'ad_storage': 'denied' });`. 3. GTM initializes and reads these defaults. 4. Tags that require consent (like GA4) will not set cookies or send data until the user interacts with the consent banner. 5. When the user grants consent, your Consent Management Platform (CMP) updates the consent state to `granted`, and tags fire normally.

It’s important to note that not all tags respect Consent Mode. For tags that don’t, you must use GTM’s built-in consent checks or custom triggers to block them until consent is obtained. This is where many implementations fail—assuming that setting the default consent state alone is sufficient. You also need to configure your tags to respond to consent updates.

For a deeper dive into CMP integration, read Do I Need a CMP If I Do Not Run Google Ads?.

Step-by-Step Implementation of Default Consent State in GTM

Implementing the default consent state involves both code and GTM configuration. Follow these steps to ensure compliance:

1. Choose a Consent Management Platform (CMP) A CMP is essential for collecting and signaling user consent. While you can build a custom solution, using a Google-certified CMP simplifies integration with Consent Mode. The CMP will handle the consent banner and update consent states when users make choices. Ensure your CMP supports Consent Mode v2 and can set the default consent state to `denied`.

2. Set the Default Consent State via Code Add the following script to every page of your website, placed **before** the GTM container snippet. This script must run synchronously to prevent tags from firing prematurely.

```javascript window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('consent', 'default', { 'ad_storage': 'denied', 'analytics_storage': 'denied', 'ad_user_data': 'denied', 'ad_personalization': 'denied', 'wait_for_update': 500 }); ```

• `ad_storage`: Controls cookies for advertising.
• `analytics_storage`: Controls cookies for analytics.
• `ad_user_data`: Controls sending user data to Google for advertising purposes.
• `ad_personalization`: Controls personalized advertising.
• `wait_for_update`: Time in milliseconds to wait for a consent update before tags fire. A value of 500ms is typical, but adjust based on your CMP’s response time.

3. Configure GTM Consent Settings In GTM, go to **Admin > Container Settings > Additional Settings** and enable **Consent Overview**. This activates consent-aware tag firing. Then, for each tag that requires consent, add built-in consent checks: - Edit the tag, expand **Advanced Settings > Consent Settings**. - Select **Require additional consent for tag to fire**. - Choose the relevant consent types (e.g., `analytics_storage` for GA4 tags).

This ensures that even if the default state is bypassed, the tag will not fire without the required consent.

4. Update Consent State on User Interaction Your CMP should call `gtag('consent', 'update', { ... })` when the user grants or denies consent. For example: ```javascript gtag('consent', 'update', { 'analytics_storage': 'granted', 'ad_storage': 'granted' }); ``` This updates the consent state and allows tags to fire accordingly. Ensure your CMP also handles the case where the user rejects all—then the state remains `denied`.

5. Test Your Implementation Use GTM’s Preview mode to verify that tags do not fire before consent. Check the `dataLayer` for the default consent event and subsequent updates. Also, use browser developer tools to confirm that no cookies are set until consent is granted.

For a complete walkthrough, see our Google Analytics GDPR Compliance guide.

Common Mistakes and How to Avoid Them

Even with careful setup, mistakes can undermine your compliance. Here are the most frequent errors and how to prevent them:

1. Setting Default to ‘granted’ This is the most critical mistake. If you set `ad_storage` and `analytics_storage` to `granted` by default, tags will fire before consent, likely violating GDPR. Always set defaults to `denied` for users in the EEA and UK. Some implementations mistakenly set region-specific defaults but fail to cover all required regions. Use `gtag('consent', 'default', { ... })` without regional restrictions to apply globally, or ensure your region detection is accurate.

2. Placing the Default Script Incorrectly The default consent script must run before GTM loads. If it’s placed after the GTM snippet, tags may fire with an incorrect state. A common error is loading the script asynchronously or via a tag manager itself—this defeats the purpose. Always hardcode it in the `<head>` before any other scripts.

3. Not Configuring Tags for Consent Setting the default consent state is only half the battle. Tags that don’t support Consent Mode natively (e.g., custom HTML tags, some third-party pixels) will still fire unless you add consent checks. In GTM, use the **Consent Initialization** trigger to fire a tag that sets defaults, and then use consent requirements on all other tags. For non-Google tags, you may need to build custom triggers that check consent state via the `dataLayer`.

4. Ignoring the ‘wait_for_update’ Parameter Without `wait_for_update`, tags may fire immediately with the default state, even if the user grants consent milliseconds later. This can lead to lost data. Set a reasonable timeout (e.g., 500ms) to give the CMP time to update consent. However, too long a delay can impact page performance and user experience.

5. Not Testing the Reject Flow Many implementations only test the “accept all” path. You must also verify that when a user rejects all, no cookies are set and no data is sent. Use GDPRChecker’s scanner to simulate both flows and check for pre-consent network requests.

6. Overlooking Policy Disclosures Your privacy policy must accurately describe how you use Consent Mode and what data is collected in each state. If you claim to not process data without consent but your default state allows cookieless pings, you must disclose this. Transparency is key under GDPR.

How to Validate Default Consent State with GDPRChecker

After implementing the default consent state, you need to verify that it works correctly. GDPRChecker’s scanner automates this process by checking for pre-consent network requests, banner behavior, and disclosure gaps. Here’s how to use it:

1. **Run a Pre-Consent Scan**: Enter your website URL and start a scan. GDPRChecker will load your site without accepting cookies and monitor all network requests. It flags any requests that occur before consent, including Google Analytics hits, ad pixels, or other tracking scripts.
2. **Check Consent Banner Behavior**: The scanner verifies that your consent banner appears before any tracking and that the default state is correctly set to `denied`. It also tests the reject flow to ensure no data leaks.
3. **Review Tag Manager Triggers**: GDPRChecker analyzes your GTM container (if publicly accessible) to identify tags that may fire without consent checks. It highlights tags missing consent requirements.
4. **Validate Consent Mode Signals**: The scanner checks that the `gtag('consent', 'default')` command is present and correctly configured. It also verifies that consent updates are sent when the user interacts with the banner.
5. **Get a Compliance Report**: After the scan, you’ll receive a detailed report with actionable recommendations. Use this to fix any issues and re-scan until your site passes.

Regular scanning is crucial because changes to your site, GTM container, or CMP can introduce new compliance gaps. Make GDPRChecker part of your ongoing compliance monitoring.

For more on scanning, see our Google Consent Mode v2 Checker.

Implementation Checklist

Use this checklist to ensure your default consent state is correctly implemented:

1. **Select a CMP** that supports Consent Mode v2 and can set default consent to `denied`.
2. **Add the default consent script** before the GTM snippet on every page.
3. **Set all consent types to `denied`** in the default script: `ad_storage`, `analytics_storage`, `ad_user_data`, `ad_personalization`.
4. **Include `wait_for_update`** with an appropriate timeout (e.g., 500ms).
5. **Enable Consent Overview** in GTM container settings.
6. **Add consent checks** to all tags that process personal data, using built-in consent settings or custom triggers.
7. **Configure your CMP** to call `gtag('consent', 'update')` on user action.
8. **Test the accept flow**: Verify that tags fire after consent is granted.
9. **Test the reject flow**: Verify that no tags fire and no cookies are set when consent is denied.
10. **Test region-specific behavior** if you use geo-targeting for consent.
11. **Update your privacy policy** to reflect Consent Mode implementation.
12. **Scan with GDPRChecker** to validate pre-consent requests and banner behavior.

FAQ

What is default consent state in GTM? The default consent state in Google Tag Manager defines how tags behave before a user makes a consent choice. It is set via the `gtag('consent', 'default')` command, typically to `denied` for GDPR compliance, ensuring no cookies are set or data sent until consent is obtained.

Do I need default consent state in GTM for GDPR? Yes, if you use Google tags (like GA4 or Google Ads) on your site and target users in the EEA or UK. Setting the default to `denied` is a key part of complying with GDPR’s consent requirements and avoiding unauthorized data processing.

How do I implement default consent state in GTM? Add a script before your GTM container that sets `gtag('consent', 'default', {'analytics_storage': 'denied', 'ad_storage': 'denied'})`. Then configure your CMP to update consent on user interaction, and add consent checks to tags in GTM.

How can I verify default consent state with a scanner? Use GDPRChecker to scan your site. It checks for pre-consent network requests, verifies the default consent command, and tests both accept and reject flows to ensure no data leaks before consent.

What are common default consent state mistakes? Common mistakes include setting defaults to `granted`, placing the default script after GTM, not adding consent checks to tags, ignoring the reject flow, and failing to update privacy policies. These can lead to GDPR non-compliance.

Conclusion

Understanding **what is default consent state in GTM** is fundamental to achieving GDPR compliance when using Google’s marketing and analytics tools. By setting the default to `denied`, you ensure that user privacy is respected from the first page load. However, implementation requires careful attention to script placement, tag configuration, and ongoing validation. Use the steps and checklist in this guide to close the Consent Mode gap, and regularly scan your site with GDPRChecker to catch any issues. For further reading, explore our guides on cookie banner requirements and Consent Mode v2 vs. Google Certified CMP.

Next step

Run a GDPRChecker scan to validate consent behavior, trackers, and disclosures after you implement the checklist above.

<!-- schema:faq ready -->

Copyright and editorial notice