Features

When you need this guide

By default, CookiePal sets your Google Consent Mode defaults for you. Before a visitor answers the banner, the CookiePal script tells Google that advertising, analytics, functionality and personalization storage are all denied, that only strictly necessary (security) storage is allowed, and that Google should wait a moment for the visitor's real answer before sending anything. It also sets the related Google tag options that go alongside those defaults.

Settings > Google consent mode (GCM) in your CookiePal dashboard has two switches, and the difference between them matters. Support GCM turns the whole Google Consent Mode integration on or off. Enable default GCM controls only the defaults CookiePal sends before the visitor answers.

This guide is for people who have turned Enable default GCM off. That switch stops the default consent settings entirely, not just the one setting you wanted to change, so setting them becomes your responsibility.

Leave Support GCM switched on. It is what makes CookiePal report the visitor's actual choice to Google once they answer the banner. If you turn that off as well, the update is never sent, and the defaults you are about to add in Google Tag Manager will hold every category on denied forever, even for visitors who accept.

A quick way to check: Enable default GCM is greyed out whenever Support GCM is off. If you cannot click it, GCM support is off and you need to turn it back on before continuing.

Does this apply to me? Only if you installed CookiePal using its script on your website and manage your Google tags in Google Tag Manager. If you installed CookiePal through the CookiePal CMP tag inside Google Tag Manager, the dashboard switch does not affect you, because that tag carries its own consent default fields. See GCM Setup Guide and Integrate CookiePal with Google Tag Manager.

Before you start

Google Tag Manager must not be blocked before consent. CookiePal can hold third-party scripts back until a visitor accepts. If Google Tag Manager is on that list, it does not load until consent is given, so a tag inside it cannot set your consent defaults in time and this approach will not work.

To check, open Cookie Manager > Scripts in your dashboard and look for a googletagmanager.com entry. Its Effect column should read Never blocked. If it reads Blocked until consent, change its category to Necessary so Google Tag Manager can load on every page.

If your site is WordPress and uses the CookiePal WordPress plugin, stop here and contact our support team. The plugin writes its own consent default block into your pages and the Enable default GCM switch does not stop it, so the tag below would be ignored.

Create a Custom HTML tag

In Google Tag Manager, open your container and go to Tags in the left-hand menu, then click New.

Click the Tag Configuration box and choose Custom HTML from the list of tag types.

Give the tag a clear name at the top of the screen, for example Consent Mode - Defaults. A descriptive name makes it obvious later why the tag exists.

Add the consent default code

Paste the following into the HTML field of your Custom HTML tag, exactly as shown:

1<script>
2window.dataLayer = window.dataLayer || [];
3function gtag() {
4  dataLayer.push(arguments);
5}
6gtag('consent', 'default', {
7  'ad_personalization': 'denied',
8  'ad_storage': 'denied',
9  'ad_user_data': 'denied',
10  'analytics_storage': 'denied',
11  'functionality_storage': 'denied',
12  'personalization_storage': 'denied',
13  'security_storage': 'granted',
14  'wait_for_update': 2000,
15});
16gtag('set', 'ads_data_redaction', true);
17gtag('set', 'url_passthrough', false);
18</script>

Keep the surrounding <script> tags. Google Tag Manager expects Custom HTML tags to contain complete HTML, so removing them will stop the code from running.

What the code does, line by line: the consent command tells Google that nothing except strictly necessary storage is allowed until the visitor chooses, and wait_for_update gives your banner 2000 milliseconds to report that choice first.

ads_data_redaction strips ad click identifiers from Google Ads requests while advertising storage is denied. It is set to true here, matching what CookiePal does automatically.

url_passthrough controls whether Google carries measurement information from page to page in URL parameters when storage is denied. It is set to false here. Set it to true only if you want Google to keep passing that information.

Review the values before you save and change only the ones your setup requires. Setting any consent category to granted by default would tell Google it may use that storage before the visitor has agreed.

Fire the tag on Consent Initialization

Consent defaults must be set before any other tag runs, so this tag needs a special trigger type rather than the usual All Pages page view.

Still inside your tag, click the Triggering box and choose Consent Initialization - All Pages from the list.

If that trigger is not in the list, click the + button in the top-right corner to create it. Click Trigger Configuration, choose Consent Initialization under the Initialization heading, leave it set to fire on all pages, name it Consent Initialization - All Pages and save it.

If you have other tags on the same trigger, open Advanced Settings > Tag firing priority on this tag and enter a high number such as 100. Tags with a higher priority fire first, which keeps your consent defaults ahead of everything else.

Click Save to store the tag and its trigger.

Publish your container

Saving a tag does not make it live. Nothing you have configured affects your website until the container is published.

Click Submit in the top-right corner of Google Tag Manager.

Add a short version name and description so your team can see what changed, then click Publish.

Check that it worked

Open Tag Assistant and connect it to your website, then look at the Consent tab for the very first event on the page.

You should see all seven consent parameters listed with an On-page Default value, with only security storage granted. If any are missing, the tag is either not firing or firing too late.

Now accept the banner and look at the Consent tab again. An update should follow the defaults, with the categories the visitor accepted switched to granted. If the defaults appear but no update ever follows, Support GCM is switched off in your dashboard and Google will stay on denied for every visitor.

For a fuller checklist, see our Verify GCM implementation guide.

What happens if you skip this

If you turn off Enable default GCM and add nothing in its place, no consent defaults are set at all. Google tags then load without ever being told what the visitor has or has not agreed to.

In practice this usually shows up as the Tag Assistant error A tag read consent state before a default was set, and as Google Analytics or Google Ads tags firing with no consent signal attached to their requests.

Advertising and analytics tags may then set cookies and send data before the visitor has answered your banner, which is exactly what consent mode exists to prevent.

So treat the two changes as a pair: if the automatic defaults are switched off, the manual configuration above needs to be live in your container.