Google Consent Mode with tapp cookie

1. What Consent Mode is and why

Google describes consent mode as a mechanism that “allows web and app developers to adjust tag and app SDK behavior based on user consent choices” (Consent mode overview). In practice your page tells Google tags (Google Analytics 4, Google Ads, Floodlight, Tag Manager) which storage and data uses are allowed: first with a default command before any Google tag runs, then with an update command after the visitor decides. Google’s implementation reference is Set up consent mode on websites; this page follows its wording and explains what tapp cookie does for you.

tapp cookie sends both commands without any code of your own. The default is set as the first script in <head> (denied, fail-closed, even if the banner script never loads), and gtag('consent', 'update', …) is sent after every decision (accept all, reject all, custom selection, change, withdrawal) and again on every page load for a returning visitor, so tags always see the current choice on the page where it was made. Every command carries all seven consent types. Google requires the update “as soon as a user interacts with your consent management solution” and “before any page transition”, which is exactly what the banner does.

2. The seven consent types and tapp cookie categories

Google’s descriptions are quoted from the Consent mode overview, abridged for the web where the original also covers apps. The right column is the banner category that controls each type.

The mapping lives in one place in the SDK and is identical in the JavaScript snippet, the Tag Manager template, the WordPress plugin and the React package. A visitor who accepts only Analytics therefore produces analytics_storage: granted with the three advertising types denied. If your site does not offer the Preferences category, functionality_storage and personalization_storage stay denied; enable the category in the admin (Settings) if you use tools that need them.

3. Set-up paths

All four paths set the default before Google tags and send updates automatically. Choose the one that matches how your site is built.

A) JavaScript snippet from the admin (any CMS)

Open your site in the tapp cookie admin, tab Installation script, and copy the generated code. It has two parts and must be the first script in <head>, before Google Analytics, the Google tag or Tag Manager:

<script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}
gtag("consent","default",{"ad_storage":"denied","ad_user_data":"denied","ad_personalization":"denied","analytics_storage":"denied","functionality_storage":"denied","personalization_storage":"denied","security_storage":"granted","wait_for_update":500});
gtag("set","ads_data_redaction",true);</script>
<script src="https://cmp.tappcookie.cz/v/0.1.7/tappcookie.js" integrity="sha384-…" crossorigin="anonymous"
  data-site="your-site" data-tenant="your-account" data-cmp="https://cmp.tappcookie.cz"></script>

The inline part is the Consent Mode default. It reflects the Consent Mode options of your site (section 5) and works even when an ad blocker or a CDN outage prevents the second part from loading. The second part loads the banner, which sends the updates. The admin generates the current SDK version with its integrity hash; copy the code again after a settings change. Google’s guide stresses that “the order of the code here is vital”, so keep the snippet above every Google tag. Optional attributes: data-locale (banner language) and data-blocking="manual" (turns off automatic script blocking). Then publish the site in the Publish tab. The Installation tab also has step-by-step notes for WordPress, Shoptet, Webflow, Wix and Squarespace.

B) Google Tag Manager template

In Tag Manager open Templates → Tag Templates → Search Gallery and add tapp cookie CMP by TAPP-STUDIO (source code and version history: github.com/TAPP-STUDIO/gtm-template-tapp-cookie). Create a tag from it, fill in Site ID and Tenant ID (the data-site and data-tenant values from the Installation tab), keep the default CMP URL and use the trigger Consent Initialization – All Pages.

The tag sets the default (always all denied with wait_for_update; for a returning visitor the stored choice follows right away through updateConsentState), sets ads_data_redaction and optionally url_passthrough, loads the banner if the page has not loaded it already, and after every decision calls updateConsentState with all seven types and pushes tapp_consent_update (with tapp_consent_analytics, tapp_consent_marketing and tapp_consent_preferences booleans) to the data layer. Leave Google tags on their built-in consent checks; for other tags use Consent Settings → Require additional consent for tag to fire (analytics_storage or ad_storage).

Recommended: keep the snippet from path A in <head> as well. Tag Manager injects scripts asynchronously and cannot block scripts that are already in the HTML; the template detects the banner and only registers the consent signal.

C) WordPress plugin

Install the tapp cookie plugin (ZIP from TAPP Studio), then Settings → tapp cookie and enter Site ID and Tenant ID. The plugin prints the inline default and the banner script at the very top of wp_head (priority 0), blocks known tracking scripts until consent (or lets you mark scripts manually), adds the [tapp_cookie_declaration] block/shortcode and [tapp_cookie_settings_link], and registers as a CMP with the WP Consent API when that plugin is present (statistics ← Analytics, marketing ← Marketing, functional and preferences ← Preferences). The plugin’s inline default is fixed: wait_for_update 500 ms, ads_data_redaction on, no url_passthrough; use the Tag Manager template parameter if you need URL passthrough on WordPress.

D) React / Next.js

Install @tapp/cookie-react. Put <ConsentDefaultScript config={config} cookieValue={…} /> in <head>: it is a server component that validates the stored cookie’s TTL and declaration version and renders the default before any Google script. The default is always all denied; for a returning visitor with a valid choice it renders a consent update with that choice right after it, so the default never changes after consent and the update carries the choice. Wrap the app in <ConsentProvider>, add <CookieBanner /> and load Tag Manager with <GtmLoader />, which loads gtm.js after consent. <ConsentGate category="marketing"> holds embeds and <ReopenConsentButton /> covers the footer link. The React package has no automatic script blocking: other third-party scripts are marked manually with type="text/plain" data-tapp-consent="…". Without the package, add the snippet from path A through next/script with strategy="beforeInteractive".

4. Basic vs advanced consent mode

Google distinguishes two implementations. In basic consent mode Google tags are blocked until the visitor interacts with the banner; no data is sent to Google before that, and after consent the tags load and receive the default followed by the update. Denials mean no data is transmitted and Google can only apply general conversion modeling. In advanced consent mode the tags load immediately with consent defaults set to denied; while consent is denied they send cookieless pings, after consent they write cookies and send full measurement, and conversion modeling uses an advertiser-specific model instead of the general model.

tapp cookie ships basic as the default. With the snippet and the WordPress plugin, automatic blocking holds the Tag Manager and Analytics hosts (googletagmanager.com, google-analytics.com, analytics.google.com) until Analytics is granted and the Google Ads hosts (doubleclick.net, googleadservices.com, googlesyndication.com) until Marketing is granted; in the React package GtmLoader loads gtm.js once either Analytics or Marketing is granted. In advanced mode these Google hosts are not blocked: they load at once, see the denied default from <head> and apply the restriction themselves. Every other tool (Meta, Seznam Sklik, Microsoft UET, Clarity) stays blocked until consent in both modes. The inline default is always present and ads_data_redaction is on by default, so switching modes never removes the consent signal.

Which to pick: basic is the fail-closed choice and what most EU data protection authorities expect (loading a script that sends data before the choice is treated as access to the device under ePrivacy Art. 5(3)); advanced recovers modeled conversions from visitors who decline. Advanced mode is switched on in the admin under Settings (card Google Consent Mode and Microsoft, toggle Advanced mode); the publish check warns when it is on and refuses it for sites declared as aimed at children. If you use only the Tag Manager template, the container is already running, so the mode is decided by your tags: built-in consent checks give advanced behaviour, Require additional consent for tag to fire gives basic behaviour. If the snippet is also in <head>, the site’s mode decides whether the container itself loads before or after consent.

5. Settings: wait_for_update, ads_data_redaction, url_passthrough, regions

These options are set per site in the admin under Settings (card Google Consent Mode and Microsoft) and appear in the generated snippet; the Tag Manager template exposes the same options as tag parameters. After a change, copy the snippet from the Installation tab again.

• wait_for_update — Google: the consent tool is given this many milliseconds “to call gtag('consent', 'update', ...) before tags fire”. tapp cookie sets 500 ms (allowed 0–5000) in every default command for a new visitor, so a tag that starts before the banner has finished reading the stored choice does not fire on the wrong state.
• ads_data_redaction — Google: “To further redact your ads data when ad_storage is denied, set ads_data_redaction to true”. tapp cookie sets it to true by default (gtag('set', 'ads_data_redaction', true) right after the default; the template calls gtagSet). It can be turned off per site.
• url_passthrough — Google: passes “ad click, client ID, and session ID information in URLs when users have not granted consent for cookies”. When on, Google tags may append gclid, dclid, gclsrc, _gl and wbraid to same-domain links; make sure your redirects keep these parameters. Off by default; turn it on per site or in the template if you want ad-click and session continuity without cookies (typically in advanced mode).
• Regional defaults — Google lets you “specify a region (according to ISO 3166-2) in your gtag consent default command” and states the best practice to “scope the default consent settings to the regions where you are surfacing consent banners”. tapp cookie reaches the same outcome without a region parameter in the snippet. The inline default is denied everywhere (fail-closed). The banner then resolves the visitor’s regime from edge geolocation (country or state) according to the preset chosen in Settings → Where your visitors come from: “From Europe” is opt-in for everyone (default); “Europe and USA” and “Worldwide” add opt-out for US states, with Global Privacy Control honoured, and notice elsewhere. In opt-out and notice regions the banner is not a consent gate: the script sends consent update with the regional state immediately on the first page (analytics and ads granted, ads denied when the browser sends GPC), so measurement is preserved where no consent banner applies. In an opt-out region only, restricted_data_processing: true is set for Google Ads whenever marketing is not granted. An undetected region always gets the strictest regime of the site. In the Tag Manager template you can additionally fill the Regional default state table (ISO 3166-1 or 3166-2 codes, for example US-CA); regions without a row keep denied, matching Google’s rule that a default without a region sets the default for all visitors. Keep the banner opt-in globally if you need the same behaviour for every visitor, for example during a certification review.

6. Banner text and the Google privacy link

Google’s programme expects the banner to say that data is collected for advertising personalization and analytics and to link, from inside the banner, to Google’s explanation of how it uses data from sites that use its services: https://business.safety.google/privacy.

tapp cookie covers both out of the box. The default first-layer text in all four languages (cs, sk, en, de) names traffic measurement and advertising personalization as purposes and the right to withdraw. Whenever a Google tool (Google Analytics 4, Google Ads, Tag Manager, YouTube, Maps, reCAPTCHA, AdSense) is in the site’s tool declaration, the banner shows the link How Google uses data next to the cookie and privacy policy links in both layers. Nothing to configure; if you must hide it, set the label googlePrivacyLink to an empty string in the site’s texts. The second layer additionally lists every tool with its provider and privacy policy under “Show tools”.

Banner copy is edited in the admin without code: tab Texts holds, per language, the title, the first-layer text (plain text, up to 1500 characters), the two button labels and the settings text; tab Appearance covers layout and colours. If you customize the first-layer text, keep the purposes and the withdrawal sentence in it. The cookie declaration rendered by [tapp_cookie_declaration] or TappCookie.renderDeclaration() lists every Google service with its privacy policy link.

7. Verifying the implementation

Follow Google’s Verify consent mode implementation with Tag Assistant (tagassistant.google.com): connect your site, pick the earliest Consent event, open the Consent tab and check the On-page Default column (all Denied except security_storage). Click Accept all in the banner, pick the most recent Consent event and check the On-page Update column for ad_storage, ad_user_data, ad_personalization and analytics_storage (Granted). In the summary the order must be consent default → Google tags → consent update; if a Google tag appears before the default, the snippet is not first in <head>. Reject all keeps every type denied, and a returning visitor shows the update on every page.

Additionally, in the network requests to google-analytics.com and Google Ads the gcs query parameter reflects ad_storage and analytics_storage: G100 both denied, G101 analytics only, G110 ads only, G111 both granted. The gcd parameter encodes all signals including ad_user_data and ad_personalization.

Debug mode. Open any page with ?tapp_debug=1 (or add data-debug="1" to the script tag) and the SDK prints a diagnostics object to the browser console: whether a consent default was already present when the SDK started, whether Tag Manager or the Google tag ran before it, the SDK version and the configuration source. The same data is available at any time from TappCookie.diagnostics(). Independently of debug mode, the SDK logs a console warning whenever it detects that the Consent Mode default came after a Google tag had loaded, so a wrong script order is visible on every page load.

Site check from the admin. The Installation tab shows when the banner was last seen on your site, and Verify now (also run automatically every week) visits the site as a new visitor and confirms that nothing is stored before consent. It also reports a missing default before Tag Manager (finding no-consent-default) and a default that arrived only after Tag Manager (consent-default-late) and a missing consent update for a visitor with a stored choice (consent-update-missing) under Site checks.

Google tag gateway for advertisers. If you serve the Google tag from your own domain (Cloudflare, Akamai, Fastly or another gateway), Google notes that enabling the gateway “affects Google tag firing behavior” and asks you to “adopt Consent Mode, and review your consent settings to ensure your preferences are respected”. tapp cookie’s default and update commands are unchanged by the gateway. Google also states: “If you use consent mode, you must turn off automated script set up” (Google tag with Cloudflare, Akamai). If you implement the gateway manually on a CDN, forward visitor-location headers, otherwise Google warns that “issues with region-specific consent defaults may arise”. Because tapp cookie’s automatic blocking recognizes Google by hostname, a tag served from your domain is not blocked in basic mode: gate it in Tag Manager with consent settings or mark it type="text/plain" data-tapp-consent="analytics" (or marketing). Verify the gateway in Tag Assistant under Summary → Output → Hits Sent and “verify that the hits are routed to your measurement path” (Google’s set-up guide).

A late consent signal on a tag served through the gateway. One-click set-up on a CDN injects the Google tag for you, so you no longer control the order in which scripts load - that is why Google asks you to turn automated set-up off when you use consent mode. If the debug mode reports consent-default-late, first check whether the tag is enrolled in the gateway (Tag Assistant, Summary → Output → Hits Sent, or the request host in the browser’s network panel). If it is, we recommend advanced consent mode (U+C): it is the mechanism compatible with a manual gateway set-up, and you then enable Data Transmission Controls and Global Consent Defaults according to your needs. The alternatives are to move every tag into a Tag Manager container and deploy the container through the gateway, or to set the gateway up manually on your CDN, where the import order stays under your control.

8. Microsoft UET and Clarity

tapp cookie derives Microsoft signals from the same choices, so there is nothing extra to configure once Microsoft UET or Clarity is enabled for your site (Settings, card Google Consent Mode and Microsoft; enable it when the tool is in your declaration). Before bat.js the banner pushes uetq.push('consent', 'default', { ad_storage: 'denied' }), and after every decision and on every page load it pushes consent update with ad_storage taken from the Marketing category. For Clarity it calls clarity('consentv2', { ad_Storage, analytics_Storage }) from the Marketing and Analytics categories, explicitly denied for a visitor who has not decided yet; if clarity.js is not loaded yet, the signal waits in the official queue. Microsoft states that bat.js and clarity.js also inherit Google Consent Mode signals from gtag; tapp cookie sends its own signals regardless, so the choice reaches Microsoft even on pages without the Google tag.

In basic mode UET itself stays blocked until marketing consent (bat.bing.com is in the built-in tracker list), which is the fail-closed default; a site that wants Microsoft’s advanced consent mode can allow-list bat.bing.com. If you load UET through the official Microsoft Advertising UET template in Tag Manager, keep Enable consent updates on and also enable Inherit initial consent, so the tag picks up a choice the visitor made before the tag loaded (Microsoft’s template notes). You can verify with the UET Tag Helper, which shows asc=G after consent.

9. Support

Write to info@tapp-studio.cz (TAPP Studio s.r.o., Hodonín, Czech Republic). Support is available on business days 9–17 CET and the first response comes within 1 business day. Include your Site ID, the page URL and, for Consent Mode questions, a Tag Assistant screenshot of the Consent tab or the output of TappCookie.diagnostics(). Issues with the Tag Manager template can also be reported on GitHub Issues. If a Google tag is missing a Consent Mode or TCF signal, start with us, not with Google support: for everything the banner sends we are your first point of contact, and Google support asks customers to show that they contacted their CMP first. Changes that affect the Consent Mode integration (SDK versions, template versions) are listed in section 10 of this page and in the template repository’s changelog.

10. Changes

• 13 October 2026, SDK 0.1.28 — a category without any declared tool (or embedded content) is no longer offered by the banner and “Accept all” does not grant it; an earlier consent to it is ignored as well. A site without a marketing tool therefore sends no ad_storage, ad_user_data or ad_personalization as granted after the visitor decides. Content marked by hand with a category the site does not offer stays blocked: the tool belongs in the declaration. On a site without an analytics tool, loading googletagmanager.com (GTM and gtag) follows consent to marketing. Embedded YouTube videos are always marketing, including youtube-nocookie.com. After consent to analytics is withdrawn, the banner sets ga-disable-<ID> for the GA4 measurement IDs on the page, so GA4 sends no further events.
• 24 September 2026, SDK 0.1.27 — ui.alignTo setting (“Align to the site block” in the banner appearance): a CSS selector of the site block whose edges the card and the bar content follow at every window width, either the block content or its outline. ui.maxWidth then only caps the width. The banner also puts itself back when the page removes it from the document (React 19 re-renders the whole document after a hydration error).
• 15 September 2026, SDK 0.1.24 and the Tag Manager template — the default is always all denied, including for a returning visitor. The stored choice follows the default right away as a consent update (the template through updateConsentState, the server component and the banner script through gtag). Until now the default carried the stored choice directly; tags behaved the same, but the gcd parameter reported “granted by default”. The same update is not pushed to the dataLayer twice.
• 7 September 2026, SDK 0.1.10 — on start, auto-blocking now also neutralises iframes and stylesheets that were already in the page before the SDK loaded (installs that run after hydration). The request of such an iframe has already left, though: embed maps and videos in server-rendered HTML with data-src and data-tapp-consent instead of src; the SDK activates them after consent.
• 7 September 2026, SDK 0.1.9 — fix: the banner no longer sends any consent update before the visitor makes a choice. Until now it pushed a safety update with denied values right on load (to override a foreign “granted” default in the site template), which broke the default → choice → update order. The safety update is kept only when the SDK actually detects a granted default (dataLayer or google_tag_data.ics).
• 7 September 2026, SDK 0.1.9 — auto-blocking now also holds maps embedded via www.google.com/maps (both ?q= links and /maps/embed) until consent; previously only maps.googleapis.com and maps.google.com were covered.
• 7 September 2026, SDK 0.1.7 — ui.maxWidth setting: maximum width of the banner (card, modal) so it aligns with the site content; “Maximum width” field in Appearance.
• 6 September 2026, SDK 0.1.6 — fix: for a returning visitor with a stored choice, a script inserted by activated code (typically gtm.js from a GTM snippet marked with data-tapp-consent) is no longer blocked again.
• 6 September 2026, SDK 0.1.5 — the banner shows the “How Google uses data” link whenever a Google tool is declared; debug mode (?tapp_debug=1, TappCookie.diagnostics()) and a console warning for a Consent Mode default that arrives after a Google tag; new site-check finding consent-default-late; explicit Clarity denied signal for an undecided visitor. Consent Mode settings (advanced mode, ads_data_redaction, url_passthrough, wait_for_update) and the Microsoft UET and Clarity bridges are in the admin under Settings.