Setting up consent-aware tracking, step by step

This guide shows how to set up your tracking so tags respect each visitor's cookie choice, while ad platforms can still see that your tags are installed. It's the set-up we use on our own website. For the rules behind it, see Tags and cookie consent.

What you're aiming for

• Before a visitor chooses: no cookies, and no data sent to any ad platform.
• Analytics only: your analytics runs, but no advertising tags.
• Accept all: everything runs.

1. Use a cookie banner with real choices

Offer Accept all, Reject, and a way to choose analytics and advertising separately. Most consent tools do this, and many connect to Google Consent Mode for you.

2. Set Google Consent Mode to "denied" first

Before any Google tag loads, set all four consent types to denied: ad_storage, analytics_storage, ad_user_data and ad_personalization. This needs to be the first thing in your page's head code, or Google may report Consent Mode as missing.

When the visitor makes a choice, your banner sends an update. It should also re-apply the saved choice on every later page, as an update rather than a new default.

3. Let Google see your tag, without it sending data

If your Google tag only loads after consent, Google's own checks will report that it isn't installed, because they never click your banner.

The fix is to load the Google tag library on every page while consent is still denied, but hold back the part that sends data (the "config" command) until the visitor accepts. Until then, the tag sets no cookies and sends no Analytics or Ads data. Visitors' browsers do still download the script from Google, so name Google in your cookie policy.

4. Keep advertising pixels behind advertising consent

Only load the Meta Pixel, TikTok Pixel, Microsoft UET tag and LinkedIn Insight Tag once the visitor has accepted advertising cookies. Accepting analytics alone isn't enough.

5. If you use Google Tag Manager, set consent on every tag

Tag Manager only knows which tags need which consent if you tell it. Google's own tags check Consent Mode for themselves, but other tags, especially ones pasted in as Custom HTML, don't.

1. Open each tag and go to Advanced Settings, then Consent Settings.
2. Choose Require additional consent for tag to fire.
3. Add ad_storage for advertising tags, or analytics_storage for analytics tags.
4. Submit and publish the container.

Without this, a TikTok or Meta tag in Tag Manager can fire for someone who only agreed to analytics.

6. Check how Google Analytics is linked

If your Google Analytics property is linked inside your Google Ads tag, Analytics may only run when the Ads tag does. Visitors who accept analytics but not advertising then aren't counted. In Tag Assistant, check whether your Analytics ID (starting G-) is listed as a destination of your Ads tag. If it is, make sure Analytics is also triggered for analytics-only visitors, without counting anyone twice.

7. Don't load tags twice

If you load your tags another way, leave your website builder's built-in tag fields empty. Those fields usually load tags straight away, before the visitor has chosen. See Tracking tags in practice.

Test all three choices

Open a private browser window, then open your browser's developer tools on the Network tab.

1. Don't touch the banner. You may see the Google tag library load, but there should be no requests to Google Analytics or Google Ads, and nothing from Meta, TikTok, Microsoft or LinkedIn.
2. Choose analytics only. You should see Google Analytics, and no advertising tags.
3. Accept all. Everything should now load.

Type a platform's name, such as "tiktok" or "facebook", into the Network tab's filter to check one at a time. Use a new private window for each test, so your earlier choice doesn't carry over.

Changed something in Tag Manager and it doesn't seem to work? Your browser may still have the previous version of your container saved. Wait a few minutes, or test in a fresh private window.

Warnings you can expect

• "Tag stopped sending data" in Tag Manager. Tag Manager only loads for people who accept cookies, so during quiet spells Google may not see it for a day or two. It clears once visitors start accepting again.
• "No conversions recorded" in Google Ads. Conversions only count from people who accept advertising cookies, so expect lower numbers than your real enquiries or sales.
• Lower figures overall. Anyone who rejects cookies isn't tracked. That's working as intended.

Still stuck? See My pixel or tag isn't firing.