How to set up Google Tag Manager with CookieFlame

Google Tag Manager runs your tags. Tags are small pieces of tracking code, such as Google Analytics, Google Ads or the Facebook Pixel. CookieFlame tells Tag Manager what each visitor has agreed to. This guide shows you how to set it up so each tag follows the visitor’s choice, and how to check that it works.

You’ll need:

CookieFlame 5.5.0 or newer. Update CookieFlame from Plugins in WordPress if you’re on an older version.
your Tag Manager container ID (it looks like GTM-A1B2C3D)
access to your container at tagmanager.google.com

1. What CookieFlame tells Google

CookieFlame sorts cookies into categories. Each category switches on one or more of Google’s “consent types”:

When the visitor allows…	Google is told…
Preferences	`functionality_storage` and `personalization_storage` are granted
Analytics	`analytics_storage` is granted
Marketing	`ad_storage`, `ad_user_data` and `ad_personalization` are granted
Site statistics	nothing changes (this category doesn’t involve Google)
Necessary (always on)	`security_storage` is granted (it keeps the site secure)

Until the visitor chooses, every type except security_storage is set to “denied”.

If the visitor’s browser sends a Global Privacy Control signal, the three advertising types stay denied, even after Accept All. They change only if the visitor switches Marketing on in their preferences, or opens Do Not Sell or Share My Personal Information on the US notice and clicks Allow selling or sharing. The opt-out is remembered on later visits, even if the signal is turned off.

What visitors see depends on their country:

EU, EEA, UK, Switzerland, Brazil and South Africa: a banner that asks first. Preferences, Analytics and Marketing wait until they choose. Site statistics runs unless they switch it off. In Advanced mode Google’s own tags load before they choose, with consent set to denied (section 2).
United States: a notice they can opt out from. Everything is allowed from the first page (Marketing stays off if their browser sends a Global Privacy Control signal).
Everywhere else: no banner. Everything is allowed (again, Marketing stays off with a Global Privacy Control signal).
If CookieFlame can’t tell the country: it goes by the visitor’s time zone. A European time zone gets the banner that asks first, and a US time zone gets the US notice. Any other time zone gets the banner that asks first.

2. Basic or Advanced: what they mean

You choose this in WordPress under CookieFlame → Tag Managers → Google Consent Mode.

Basic (the default)

Tag Manager and the Google tags CookieFlame knows wait until the visitor allows Analytics or Marketing. Until then Tag Manager isn’t loaded, so none of its tags run.
If the visitor declines, Tag Manager doesn’t load for them at all.
If they allow Analytics only, Tag Manager and Google Analytics load. Google Ads, Floodlight and AdSense scripts wait for Marketing.
If they allow Marketing only, Tag Manager and your advertising tags load. Google Analytics waits for Analytics.

Advanced

Tag Manager, Google Analytics and Google Ads conversion tags load before the visitor chooses (as soon as CookieFlame knows which banner to show), with consent set to “denied”.
If you moved a Google Analytics or Tag Manager cookie to a stricter category in the Cookie Manager, Tag Manager and Google’s tags (including the Google tag and Google Ads) wait for that category, even in Advanced mode.
While consent is denied, Google’s tags send measurements without cookies (Google calls them “cookieless pings”). Google uses them to estimate the visits and conversions it can’t measure in full.
When the visitor chooses, Google’s tags switch to full measurement for what they allowed.
Some Google ad scripts still wait for Marketing in Advanced mode: AdSense and some Floodlight (Campaign Manager) requests.

In both modes

CookieFlame holds back the other tracking scripts it knows until their category is allowed, even when Tag Manager adds them. Examples are the Facebook Pixel, LinkedIn, TikTok, Pinterest, Hotjar, Microsoft Clarity and Microsoft Ads.
Other scripts are held back only if you’ve sorted their cookies in the Cookie Manager, added a blocking rule for them, or given them a consent setting in Tag Manager (sections 3 and 4).

How to choose

That’s your decision.

Basic is the simplest. Tag Manager doesn’t run until the visitor agrees.
Advanced gives Google more to work with, for example to estimate the Google Ads conversions it can’t measure (Google calls this conversion modelling). It only behaves the way you expect once every tag in your container has a consent setting.
If you’re not sure what your container holds, start with Basic.

3. Set up: Basic (the common case)

Put Tag Manager on your site in one place only. In WordPress, go to CookieFlame → Tag Managers, enter your container ID and click Save Tag Manager Settings. Then remove the Tag Manager code from everywhere else: your theme’s header, Elementor custom code, Rank Math, Site Kit, or a “header and footer” plugin.
If you’d rather keep Tag Manager where it is, leave the ID blank. CookieFlame holds that copy back too. Just don’t do both.
Leave Google Consent Mode on Basic.
Check Google’s own tags. The Google tag, Google Analytics, Google Ads, Floodlight and Conversion Linker tags have Built-In Consent Checks. For each one, open Advanced Settings → Consent Settings and choose No additional consent required. This marks the tag as checked.
Give every other tag a consent setting. Open the tag, then Advanced Settings → Consent Settings → Require additional consent for tag to fire. Click + Add required consent and add:
- for an advertising or remarketing tag (Facebook Pixel, LinkedIn, TikTok, Pinterest and so on): ad_storage
- for an analytics or session-recording tag (Hotjar, Clarity, Mixpanel and so on): analytics_storage
- for a chat widget, or a tag that remembers settings: functionality_storage
Not sure? Require ad_storage: the tag then runs only when the visitor allows Marketing.
Keep your usual triggers. In Basic mode Tag Manager only starts once the visitor has chosen, so All Pages works. You don’t need a separate consent trigger.
Publish your container, then clear your page cache (see “Old pages in the cache” in section 7).

What visitors get in Basic mode (EU, UK and other banner-first countries)

The visitor…	What runs on that page
Hasn’t chosen yet (banner showing)	Tag Manager isn’t loaded, so none of its tags run
Clicks Accept All	All your tags
Allows Analytics only	Analytics tags. Advertising tags wait.
Allows Marketing only	Advertising tags. Google Analytics waits. A tag with no consent setting runs too, because Tag Manager is loaded.
Allows Preferences only, or clicks Decline All (or saves with everything switched off)	Tag Manager isn’t loaded, so none of its tags run
Allows more later on the same page	Tags Tag Manager has already skipped start on the next page
Comes back later	Their choice applies from the start of every page

In the US and in countries with no banner, everything is allowed from the first page (Marketing stays off with a Global Privacy Control signal), so Tag Manager loads straight away. A US visitor who opts out turns off Marketing only, and your tags follow their consent settings.

4. Set up: Advanced

Do steps 1, 3, 4 and 6 of section 3 first, then:

Turn on the consent overview. In Tag Manager, go to Admin → Container Settings → Additional Settings and tick Enable consent overview. Back in Tags, click the shield icon. Every tag listed under Consent Not Configured needs a setting before you switch to Advanced.
Google’s own tags: leave the trigger as it is. The Google tag, Google Analytics, Google Ads, Floodlight and Conversion Linker change how they measure when the visitor chooses. They don’t need a new trigger.
Other page-view tags: fire them when the visitor chooses. In Advanced mode Tag Manager loads before the visitor chooses. A tag on All Pages that needs consent is skipped on that page, and it doesn’t come back by itself. This applies to tags that run once when a page opens, such as the Facebook Pixel “PageView” or the LinkedIn Insight tag. For each one:
- Create two variables. Go to Variables → New → Variable configuration → Data Layer Variable. In Data Layer Variable Name type cookie_consent_marketing, and give the variable the same name. Save. Repeat for cookie_consent_statistics (it follows CookieFlame’s Analytics category).
- Create a trigger: Trigger type: Custom Event, event name cookie_consent_update. Choose Some Custom Events, with the condition cookie_consent_marketing equals true for advertising tags, or cookie_consent_statistics equals true for analytics tags.
- Give the tag this trigger instead of All Pages (not as well as), and keep its Require additional consent setting.
- You can set these page-view tags to Once per page (Advanced Settings → Tag firing options). This applies only to tags whose trigger is cookie_consent_update.
- CookieFlame sends cookie_consent_update right after each choice, and at the start of every page once a visitor has chosen. So the tag runs on the page where they agree, and on every page after that.
Click, form and other event tags: keep their own triggers. A tag that fires on a button click, a form sent or a purchase keeps that trigger and its consent setting. It runs when that happens, if the visitor has allowed it by then. Don’t move these to cookie_consent_update, and don’t set them to Once per page, or they’ll miss the second click.
Switch the mode. On CookieFlame → Tag Managers, choose Advanced and save. Then clear your page cache.

What visitors get in Advanced mode (EU, UK and other banner-first countries)

The visitor…	Google’s own tags	Other tags with a consent setting
Hasn’t chosen yet	Load with consent denied and send measurements without cookies. AdSense and some Floodlight requests wait.	Wait
Clicks Accept All	Full measurement from that moment	Page-view tags run on the same page (through `cookie_consent_update`)
Allows Analytics only	Google Analytics measures in full. Google Ads keeps measuring without cookies.	Analytics tags run, advertising tags wait
Clicks Decline All (or saves with everything switched off)	Keep sending measurements without cookies	Don’t run

In the US and in countries with no banner, everything is allowed from the first page, so both modes behave the same.

5. Tag by tag

Tag	Consent setting	Trigger in Basic	Trigger in Advanced
Google tag (GT- / G-)	No additional consent required	Keep the trigger it has (usually All Pages)	Unchanged
Google Analytics event tags	No additional consent required	Unchanged	Unchanged
Google Ads conversion and remarketing	No additional consent required	Unchanged	Unchanged
Conversion Linker	No additional consent required	All Pages	Unchanged
Floodlight	No additional consent required	Unchanged	Unchanged. Some Floodlight requests still wait for Marketing.
Facebook (Meta) Pixel PageView	Require `ad_storage`	All Pages	`cookie_consent_update` where `cookie_consent_marketing` equals `true`
LinkedIn Insight, TikTok, Pinterest, Snap or X page-view tags	Require `ad_storage`	All Pages	Same as the Meta PageView
Microsoft Clarity, Hotjar	Require `analytics_storage`	All Pages	`cookie_consent_update` where `cookie_consent_statistics` equals `true`
Click, form or purchase tags (any platform)	The same as that platform’s page-view tag	Their own trigger	Their own trigger, unchanged
Anything you’re unsure about	Require `ad_storage`	All Pages	Same as the Meta PageView

Microsoft Ads (UET)

Enter your ID in Microsoft Ads tag ID (UET) on the Tag Managers tab instead of adding UET in Tag Manager. CookieFlame starts Microsoft’s tag only when Marketing is allowed, in both modes. In the EU, UK and other banner-first countries, that means once the visitor allows Marketing. In the US and in countries with no banner, Marketing is allowed from the first page, so the tag starts straight away, unless the visitor opts out or their browser sends a Global Privacy Control signal. Microsoft may show a warning about a missing consent signal.

Google ad click details (Tag Managers tab)

Hide ad click details until visitors agree (ad data redaction) (on by default) removes ad click details from Google’s requests while the visitor hasn’t allowed Marketing.
Pass ad click details between your pages (URL passthrough) (off by default) adds ad click details to links between your own pages while the visitor hasn’t allowed Marketing. It can make page caching less effective.

6. Test it

Open a private window (incognito) and don’t log in to WordPress in it. That makes you a new visitor. If Don’t track my team is ticked on CookieFlame’s Settings tab (in the Stop tracking you and your team card), you and anyone else who can edit posts don’t see the banner, and Tag Manager never starts while you’re logged in. The same goes for a browser where you ticked Don’t track this browser.
Start Preview from inside that private window. In the private window, go to tagmanager.google.com, sign in with your Google account, open your container and click Preview. Enter your site address and click Connect. Your site opens in a new tab or window of the same private session. (You can also go to tagassistant.google.com in the private window.)
If the banner doesn’t appear, you’re probably logged in or already chose. Close every private window and start again.
Basic mode: Tag Assistant says it couldn’t connect until you click Accept All. That’s expected, because Tag Manager isn’t on the page yet. Click Accept All and it connects. If it doesn’t, click Retry. After Decline All (or saving with everything switched off), Tag Assistant can’t connect at all. That’s expected too.
Advanced mode: Tag Assistant connects straight away. If you moved a Google Analytics or Tag Manager cookie to a stricter category in the Cookie Manager (section 2), it connects only once you allow that category.
In the left column, click the first Consent event, then open the Consent tab.
- On-page Default should show Denied for ad_storage, analytics_storage, ad_user_data and ad_personalization. security_storage shows Granted.
- After Accept All, click the last Consent event in the left column. Its On-page Update should show Granted.
- After Decline All (or saving with everything switched off) in Advanced mode, they stay Denied.
- If your browser sends a Global Privacy Control signal, ad_storage, ad_user_data and ad_personalization stay Denied even after Accept All, and your advertising tags don’t run. Firefox private windows, Brave and DuckDuckGo send this signal by default. To see Granted, test in a Chrome or Edge private window.
Click cookie_consent_update in the left column, then the Data Layer tab. cookie_consent_marketing and cookie_consent_statistics should match what you chose. (If you created the two variables in section 4, you can also see them on the Variables tab.)
Open the Tags tab. A tag set to require consent you didn’t give is listed as not fired. Google’s own tags (the Google tag, Google Analytics, Google Ads, Floodlight, Conversion Linker) can be listed as fired even while consent is denied. That’s expected: they change what they send instead of waiting.
To test again as a new visitor, close every private window and open a new one.

Seeing the US notice, or no banner? CookieFlame went by your country. Tag Assistant tests what a visitor from your own country gets. To test the banner that asks first from outside Europe, you need to browse from a European connection, for example with a VPN. CookieFlame remembers your country, and the choice it saved for you, until every private window is closed. So close all your private windows, connect the VPN, then open a new private window. The Preview tab in CookieFlame only shows how each banner looks.

7. Common mistakes

Tag Manager installed twice. It’s on the Tag Managers tab and in your theme or another plugin (Site Kit, Rank Math, Elementor, GTM4WP, a header-and-footer plugin). CookieFlame skips a second copy of the same container when it can. A different container, or Google Analytics added separately by another plugin, still counts visits twice. Use one place.
Another plugin sends its own consent settings. Site Kit, GTM4WP and some analytics plugins can send Google their own consent defaults. These can clash with what CookieFlame sends. If one of them has a consent mode option, turn it off there and let CookieFlame send the consent signals. Then check the Consent tab in Tag Assistant (section 6).
Tags with no consent setting in Advanced mode. They run as soon as Tag Manager loads, before the visitor chooses. Use the consent overview (section 4, step 1) to find them.
Page-view tags left on All Pages in Advanced mode. A tag that needs consent never runs on the page where the visitor accepts. Use the cookie_consent_update trigger instead (section 4, step 3).
All Pages and cookie_consent_update on the same tag. A returning visitor sends both on every page, so the tag can fire twice. Use one or the other.
Once per page on a click or form tag. It then fires only for the first click on each page. Keep Once per page for page-view tags on cookie_consent_update.
Tracking code that turns itself off. Some pasted code denies its own consent, for example fbq('consent','revoke'). It stops that tag even after the visitor accepts. Remove that line.
Testing while logged in. If Don’t track my team is ticked on CookieFlame’s Settings tab (Stop tracking you and your team), you don’t see the banner and Tag Manager never starts while you’re logged in. The same goes for a browser where you ticked Don’t track this browser (section 6, step 1).
Old pages in the cache. CookieFlame clears the cache of common caching plugins after you change a setting, usually within a few minutes, and within an hour if it cleared the cache recently. A cache at your host or a service like Cloudflare needs clearing too. Until then, cached pages keep the old Tag Manager setup.
Forgetting to Publish the container after changing consent settings. Preview shows your draft. Visitors see the published version.

For developers

CookieFlame pushes cookie_consent_update to the dataLayer with three values, each true or false:

cookie_consent_preferences
cookie_consent_statistics (CookieFlame’s Analytics category)
cookie_consent_marketing (false while a Global Privacy Control opt-out applies)

It’s sent:

after every choice
at the start of every page once a choice exists, including the automatic US and no-banner choices
again if the choice changes in another tab

It isn’t sent before a choice in the banner-first countries (section 1), or on excluded devices. When a visitor takes consent back, the page reloads and the new page sends it.

When CookieFlame adds Tag Manager (ID entered on the Tag Managers tab), CookieFlame’s Google consent default is in place before Tag Manager loads. When a visitor has already chosen (and always in Basic mode), cookie_consent_update comes just before Tag Manager’s own start event. In Advanced mode, Tag Manager starts before a new visitor chooses, and the event follows when they choose. So you don’t need a consent tag on the Consent Initialization – All Pages trigger. If Tag Manager is added by your theme or another plugin instead, CookieFlame holds it back, but entering the container ID on the Tag Managers tab is the most reliable way to keep this order.

Your settings are in WordPress under CookieFlame → Tag Managers (/wp-admin/admin.php?page=cookieflame&tab=tagmanagers on your own site).