Technical

Why Google Tag Manager Fires Tracking Cookies Before Your CMP Loads

Fabio Cerullo  ·  2 September 2026

If you have a consent management platform (CMP) — CookieYes, OneTrust, Cookiebot, or any of the dozen others — and Google Tag Manager (GTM) is also on your site, there is a good chance you are violating GDPR and the ePrivacy Directive right now. Not because your CMP is wrong. Not because your cookie policy is wrong. Because of a fundamental timing problem baked into how GTM and CMPs interact by default.

The timing gap

When a browser loads your page, it encounters your GTM snippet early — usually in the <head> or just before </body>. GTM is a synchronous script. It executes immediately and starts firing tags.

Your CMP, on the other hand, almost always loads asynchronously. It fetches its own configuration from a remote CDN, renders the consent banner, waits for the DOM to settle, and then — only then — is it ready to signal consent state to other scripts. That process typically takes between 300 and 800 milliseconds on a fast connection. On a slow mobile network, it can take two seconds or more.

In that window — before your CMP has drawn its banner and certainly before the user has had any opportunity to accept or reject — GTM has already fired every tag configured on an "All Pages" trigger. That includes Google Analytics 4, the Meta Pixel, Google Ads remarketing, Hotjar, LinkedIn Insight, and whatever else your marketing team has added. All of those tags set cookies. All of those cookies were set without consent. That is a violation.

Why "All Pages" is the villain

GTM's default trigger is "All Pages", meaning "fire on every page view, immediately, with no conditions". When you install GA4 through GTM and accept the default trigger, you are telling GTM: fire this before anything else has a chance to run. That is exactly what it does.

There is no built-in concept of "wait for consent" in GTM's trigger system. GTM does not know what a CMP is. It does not pause to check whether a user has seen a banner. Unless you explicitly configure it to wait, it will not wait.

Google Consent Mode v2: what it promises versus what it delivers

Google introduced Consent Mode to address exactly this problem. The idea: GTM can operate in a cookieless "ping" mode until consent is given, and then switch to full measurement once consent is granted. In theory, this means Google tags still fire — but without setting persistent cookies or sending personal data — until the user decides.

In practice, it is more complicated. Consent Mode v2 has two modes:

  • Basic mode: tags do not fire at all until consent is given. This is the compliant approach for new visitors.
  • Advanced mode: tags fire immediately but in a restricted state (no ad cookies, no personalisation). Google sends modelled conversion data in place of real cookie-based data.

The problem is that most implementations get this wrong. Advanced mode is often set up without properly restricting ad_storage and analytics_storage to "denied" as the default state before consent. If the default is left as "granted" — or the CMP integration fails to push the denied state before GTM fires — you are back to square one. Additionally, Consent Mode only governs Google's own tags. Third- party tags for Meta, LinkedIn, TikTok, and others have no awareness of Consent Mode whatsoever.

The tag sequencing myth

A common workaround suggested in GTM forums is "tag sequencing" — configuring GTM to fire your CMP initialisation tag before any other tag. This sounds reasonable but does not solve the timing problem. Tag sequencing controls the order in which GTM fires its own tags, but by the time GTM fires any of them, the issue is already the gap between the GTM snippet loading and the CMP being ready. Sequencing inside GTM cannot add latency to GTM's own startup.

Even if you fire a CMP initialisation tag first in GTM, that tag simply tells GTM "load the CMP script", which then begins its asynchronous journey. Meanwhile, other tags configured with "All Pages" triggers fire in the same synchronous batch. You need consent signals to be available before GTM processes its trigger queue — and tag sequencing cannot achieve that.

What a proper fix looks like

There are three layers to a correct implementation:

  1. Consent Mode v2 in advanced mode with correct defaults. Push gtag('consent', 'default', { ad_storage: 'denied', analytics_storage: 'denied', ... }) directly in your HTML, above the GTM snippet, before the page loads. This ensures Google tags operate in restricted mode from the very first millisecond. Your CMP then updates these states when consent is given.
  2. Consent-based triggers for Google tags. Replace "All Pages" triggers with triggers that fire on a custom event pushed by your CMP when consent is granted — for example, consent_update_analytics. This way, the tag never fires at all until the user has acted.
  3. Blocking triggers for non-Google tags. For third-party tags — Meta Pixel, LinkedIn Insight, TikTok Pixel — add a "blocking trigger" in GTM that suppresses the tag unless a specific consent condition is met. This is the only reliable mechanism for non-Google tags because Consent Mode has no effect on them.

This combination — Consent Mode v2 defaults set above GTM, consent-based triggers, and blocking triggers — is the current industry-standard approach that satisfies both GDPR and ePrivacy requirements for new and returning visitors.

How to verify your implementation

Manual browser testing is unreliable here because your own browser likely already has consent stored from a previous visit. You need a fresh-session test that simulates a brand-new visitor arriving on your site with no prior consent state — and checks exactly what cookies are set and what network requests are made before the banner appears and before any interaction takes place.

ConsentScan runs precisely this test. It loads your site in an isolated, cookie-free browser session, captures every cookie and tracking request made in the first few seconds of the page load, and flags anything that fired before consent could realistically have been given. If GA4, the Meta Pixel, or any other tracking tag is firing in that window, you will see it in the report.

Not sure what your site is firing before consent?

ConsentScan checks your site in a fresh browser session and shows exactly which cookies and tracking requests fire before any interaction.

Scan your site free →