Google Consent Mode v2 Setup with Enzuzo

Quick summary:

Google Consent Mode v2 is Google’s API for passing a visitor’s cookie choices to Google tags, so those tags adjust what they collect rather than being blocked outright. A complete Google Tag Manager Consent Mode v2 setup with the Enzuzo CMP runs in six steps: audit hard-coded pixels, enable Consent Mode v2 in Enzuzo, install the GTM template on Consent Initialization, declare region-aware default states, set per-tag consent settings plus the enzuzo_consent_update trigger, then verify five consent paths.

Two traps: the region parameter takes ISO 3166-2 codes only, so 'EU' and 'EEA' match nothing and every EEA visitor falls through to your permissive default; and ticking Require additional consent for tag to fire on GA4 or Google Ads tags downgrades advanced mode to basic.

Why Are Tags Firing Before Consent in Google Tag Manager?

Google Tag Manager Consent Mode v2 only works when tracking is properly gated by user consent. If your cookie consent banner is live but DevTools still shows _ga, _fbp, and _gcl_au cookies written on first paint, before anyone has clicked anything, the banner is cosmetic. Nothing behind it is gated.

That gap is the most common finding in the GTM Consent Mode audits our team at ScriptsHub Technologies runs, and it traces to one of three causes. The CMP loader sits on All Pages instead of Consent Initialization, so tags evaluate before defaults exist. Or a pixel is hard-coded in a theme file and never passes through the container. Or tags have consent settings but no trigger re-evaluating them when the visitor accepts, so first-page conversions vanish.

All three produce the same exposure: GDPR cookie consent complaints under the ePrivacy Directive, degraded Google Ads signal quality, and – in California, where CCPA and CPRA set opt-out duties and CIPA supplies the private right of action – regulatory scrutiny and litigation over tracking technologies. This guide walks a complete Google Tag Manager Consent Mode v2 implementation end to end using Enzuzo, a Google Consent Mode Gold Partner that ships a first-party GTM template.

How Does Google Consent Mode v2 Sequence Tag Firing?

The phases below run on every page load, each one depending on the last.

Phase 1 – GTM Consent Initialization. GTM fires everything on the Consent Initialization trigger before any other trigger, including All Pages. Default state and CMP loader both belong here.

Phase 2 – Default state declared. A default call declares, per category, what tags may do before the visitor chooses. In a compliant EEA configuration everything sensitive starts denied, with only security_storage granted.

Phase 3 – Banner interaction. The visitor accepts, rejects or customises. Enzuzo pushes enzuzo_consent_update to the dataLayer alongside an update call mapping those choices to Google Consent Mode v2 signals.

Phase 4 – Re-evaluation. Tags whose categories are now granted fire immediately. Tags still denied stay blocked, while Google tags continue sending cookieless pings for modelled measurement.

What Should You Check Before Your Consent Mode v2 Setup?

Consent Mode v2 needs five things in place before the data it reports can be trusted.

You need an Enzuzo account with a completed cookie scan against your production URL, a GTM container with publish rights, a full inventory of every tag currently firing, and repository or CMS access to strip hard-coded pixels. In most organisations that means marketing and engineering both in the room.

A complete Google Tag Manager Consent Mode v2 setup runs in six steps:

Step 1 – scan for hard-coded pixels. Before touching the container, search your codebase and CMS theme files:

They hide in platform-specific places: theme.liquid or an app block on Shopify; header.php or Site Kit on WordPress; the custom code panel on Webflow. Check injection points, not only the repository.

Why the audit comes first:Consent gating can only govern tags that GTM loads. A Meta Pixel in theme.liquid or a gtag block in header.php executes independently of the container, so no consent setting reaches it. Every match outside the GTM snippet must be rebuilt as a GTM tag first.

How Do You Install the Enzuzo Google Tag Manager Template?

Step 2 – enable Consent Mode v2 in Enzuzo. Start in Enzuzo, not GTM. Open Compliance → Cookie Banners, select your banner, open its Settings or Integrations tab, toggle Google Consent Mode v2 on, then save and publish. Skip this and the template installs but stays mute – it loads and never pushes a consent update, which looks identical to a broken trigger.

Step 3 – install the template. In GTM, open Templates → Tag Templates → Search Gallery, add the Enzuzo Cookie Manager template, create a tag from it, paste in the Enzuzo Script URL, and set the trigger to Consent Initialization – All Pages. Name it legibly, like CMP - Enzuzo Loader. Do not also paste the script into your <head>; two loaders produce race conditions and duplicate banners.

Step 4 – declare default consent states. The Enzuzo CMP template sets default consent states for you, and its region controls are the first place to look for EEA, UK or state-level variation. Reach past the template only if it cannot express the logic you need.

If you do, do not put this in a GTM Custom HTML tag. Google cautions specifically against calling the gtag consent command that way: commands issued from Custom HTML are queued and are not guaranteed to run before the next trigger evaluates – the precise failure this whole setup exists to prevent. Put the block in page source above the GTM snippet, or build a custom template using the setDefaultConsentState API. The values look like this:

Why this works:Google applies the most specific matching region rule per visitor, so three default calls give opt-in behaviour across the EEA, UK and Switzerland, an opt-out variant in California, and a permissive baseline elsewhere — from one configuration. Place the block above the GTM snippet so defaults are set before anything reads them.

Two details that bite:wait_for_update holds Google tags for 500ms so a returning visitor’s stored consent is restored first. It sits only on the blocks that deny something – the permissive baseline has nothing to wait for. And declare all seven consent types in every block, or the ones you omit stay undefined for those visitors.

Common mistake – there is no 'EU' shorthand. The region parameter accepts ISO 3166-2 codes only. 'EU' and 'EEA' match nothing, so every EEA visitor falls silently through to your permissive default – the exact opposite of what the rule was written to do. Enumerate the countries.

Which Google Tag Manager Consent Settings Does Each Tag Need?

Step 5 – configure per-tag consent. First enable Admin → Container Settings → Consent Overview: it lists every tag against its consent configuration, the fastest way to find ones you missed. Then two jobs. Create a Custom Event trigger named CE - Enzuzo Consent Update on the event enzuzo_consent_update (exact match, case-sensitive), and add it to every gated tag alongside its existing trigger – without it, a visitor who accepts on their landing page is only tracked from page two.

Google Tag Manager consent settings live under Advanced Settings → Consent Settings on each tag – the per-tag controls that tell GTM which consent types must be granted before that tag is allowed to fire. What you put there depends on who owns the tag:

When to use which: Built-in consent checks are read automatically by Google’s own tags – GA4 Consent Mode, Google Ads Consent Mode and Floodlight all rely on them. Additional consent checks exist for third-party tags, where GTM has no built-in behaviour to fall back on. Choose basic mode deliberately if your legal position is that no Google request may leave the browser pre-consent; choose advanced mode if you want modelled conversions to survive a high decline rate.

Advanced mode only returns modelled data above a traffic floor. Google requires 1,000 daily events with analytics_storage denied for seven days, plus 1,000 daily consented users across seven of the previous 28, before GA4 behavioural modelling activates – and notes those thresholds “don’t guarantee eligibility”. Smaller sites can still implement advanced mode successfully: it passes consent signals correctly either way, and there is nothing to re-implement once traffic grows into eligibility.

A correction worth flagging. Several widely-cited CMP setup guides, and the AI-generated summaries that draw on them, instruct you to tick Require additional consent for tag to fire on GA4 and Google Ads tags. Do not. Google’s documentation states that blocking its tags stops them sending anything at all, and recommends letting Google tags load in every case. Ticking that box converts advanced mode into basic mode and forfeits the cookieless conversion modelling you implemented Consent Mode v2 to preserve.

As of mid-2026, ad_storage is the primary control for advertising data reaching Google Ads: Google Signals no longer acts as a fallback, and GA4 consent settings cannot override Google Ads behaviour.

If nobody can point to the last time your GTM consent settings were formally verified, our web engineering practice runs a Cookie Consent & Tag Compliance Audit – a structured GTM consent settings review that inventories every pixel inside and outside the container.

How Do You Test Google Tag Manager Consent Mode v2 Before Publishing?

Step 6 – verify. Enable GTM Preview, open the site in a fresh incognito window, and keep the DevTools Network and Application tabs visible. Run every path: acceptance, rejection, partial consent, no interaction, and a return visit with a stored preference.

Google’s Tag Assistant consent debugging guide confirms the default state and update call independently of the GTM interface, and GA4’s own consent settings check verifies the signals reach the property. In Tag Assistant, open the Consent tab: defaults should read denied before interaction, flipping to granted only after the visitor accepts.

Once it passes, see the companion piece on publishing safely, rolling back a broken container, and the mistakes that break compliance.

Get your consent flow verified before it becomes a legal question

Our web engineering practice has audited GTM and CMP integrations across client engagements in e-commerce, B2B SaaS and regulated industries, alongside our data analytics services. The tag inventory differs every time; the failure modes rarely do. Request a Cookie Consent & Tag Compliance Audit – contact ScriptsHub Technologies or email info@scriptshub.net.

Frequently Asked Questions

Q. Does a cookie consent banner alone make my site compliant?

No. A banner only matters if the choice reaches your tags. Plenty of sites record the preference correctly, then fire the same pixels anyway because nothing downstream reads it. Tags that ran before interaction were never consented to.

Q. Why do my tags only fire from the second page onward?

They are missing the enzuzo_consent_update custom event trigger. With only All Pages attached, they never re-evaluate after the visitor accepts, so the landing page – usually the highest-intent one – goes unmeasured.

Q. How long does a Consent Mode v2 setup take?

A few hours for a single-domain site with a documented tag inventory – mostly auditing hard-coded pixels and testing consent paths. Multi-domain estates take several days. Enzuzo’s free tier covers setup, so the cost is engineering time.

Q. Which consent signals do I actually need to configure?

In practice you’ll set ad_storage, analytics_storage, ad_user_data, and ad_personalization. Declare functionality_storage, personalization_storage and security_storage in your default state too, but Google’s ads and analytics products key on the first four.