A cookie banner is not enough. The order matters.
GDPR has been in force since May 2018. Yet most websites I audit still have one critical mistake: GTM loads before consent is set. This means GA4 collects data before the user has made a choice — a GDPR violation, even if a cookie banner is displayed. I fix this, properly.
⚠️ The most common error: GTM loads before the Consent Mode default is set in the <head>. This means tags fire immediately on page load — before the visitor has consented to anything. Your banner is decoration; the tracking is already happening.
What I deliver
Consent Mode v2 correctly implemented
Correct head sequence: Consent Default → CMP script → GTM. All 7 consent signals properly configured.
wait_for_update set to prevent race conditions.
CMP integration (Cookiebot, Usercentrics, Borlabs etc.)
Your Consent Management Platform connected to GTM: consent signals passed correctly to GA4 and Google Ads. No gaps in the signal chain.
Consent checks on every GTM tag
Analytics tags only fire on
analytics_storage: granted. Ads tags only on ad_storage: granted. No exceptions.
Network-level audit
I verify the setup using Chrome DevTools: which requests fire before consent, which fire after. The only acceptable answer is: nothing before consent.
Tools & platforms
Consent Mode v2
Cookiebot
Usercentrics
Borlabs Cookie
Google Tag Manager
Chrome DevTools
GA4 DebugView