Cookiebot in Google Tag Manager with Consent Mode v2
Cookiebot is one of the most common consent banners on European sites, and Google Tag Manager is the most common way to install it. Set up well, the banner loads before every other tag, sets the four Consent Mode v2 signals to denied, and tells your tags the moment a visitor answers. Set up badly, tags fire before the banner is answered, or never fire on the first page someone sees. This guide follows Cookiebot's own Tag Manager template from an empty tag to a tested setup, then covers the dataLayer events, the privacy trigger and logo, and subdomains.
Template or page script: pick one
Cookiebot can be loaded two ways. The Cookiebot CMP tag template loads the banner from your Tag Manager container and sets the Consent Mode defaults for you. The alternative is Cookiebot's script in the <head> of every page, usually with automatic cookie blocking, which also holds back scripts outside Tag Manager. Cookiebot is clear that you use one or the other. This guide uses the template, the cleaner choice when all your tracking runs through Tag Manager; for the page script, see the section on automatic blocking further down.
1Prepare Cookiebot and the container
In Cookiebot, add every domain the banner will run on: the banner does not appear on a domain missing from the domain group, which is the usual reason it shows on the shop but not on the blog. Copy the domain group ID, the 36-character code Cookiebot also calls the CBID.
In Tag Manager, switch on Admin › Container settings › Enable consent overview. A shield icon then appears on the Tags list with the consent settings of every tag.
2Add the Cookiebot CMP template
Go to Templates › Tag Templates › Search Gallery, search for "Cookiebot", choose Cookiebot CMP and click Add to workspace. The template is maintained by Usercentrics, the company behind Cookiebot, and its source is public on GitHub.
3Create the tag on Consent Initialization
Create a tag of the type Cookiebot CMP, paste the domain group ID into Cookiebot ID, and choose the trigger Consent Initialization - All Pages. Every web container has this trigger built in, and Google designed it to fire before every other trigger. That is the point: tags are checked against the defaults, so the defaults must exist first. Putting the Cookiebot tag on All Pages is the "defaults that come too late" mistake from Tags that fire before consent.
Of the other fields, Language can follow a Tag Manager variable on multilingual sites, CDN Region picks .com or .eu for the banner script, and Add Geo Region(s) shows a different domain group's banner to the regions you list.
4Set the default consent state
Enable Google Consent Mode is ticked by default; leave it on. Under Default Consent State, each row is a region with a default per category. A row with an empty region applies to everyone, and Cookiebot recommends always keeping one. Regions use ISO codes: NL for a country, US-CA for a US state, comma-separated when several share a row. Every column starts at denied; whether anything may be granted by default elsewhere is a legal decision for your organisation.
This is how Cookiebot's categories map to Consent Mode:
| Cookiebot category | Consent Mode signals |
|---|---|
| Necessary | security_storage (always granted) |
| Preferences | functionality_storage, personalization_storage |
| Statistics | analytics_storage |
| Marketing | ad_storage, ad_user_data, ad_personalization |
ad_user_data and ad_personalization have their own default columns, but a visitor's answer sets all three marketing signals together.
In the same group, Wait for update (2,000 milliseconds in the template) is how long Google tags wait for a stored answer before sending anything, and Redact ads data set to Dynamic removes ad click identifiers from Google Ads and Floodlight requests while marketing is denied.
5Decide how Google tags respond
Google's own tags (GA4, Google Ads, Floodlight, the Conversion Linker) have built-in consent checks. Left on All Pages, they load straight away and send cookieless pings while consent is denied: advanced mode. If nothing may reach Google before consent, give them an additional consent requirement as in step 6 (analytics_storage for GA4, ad_storage for Ads): basic mode. Consent Mode v2 in Google Tag Manager explains the difference.
6Gate other tags on cookie_consent_update
The Meta pixel, LinkedIn Insight, TikTok or a heatmap tool have no built-in consent checks. Each needs two changes:
- In Advanced Settings › Consent Settings, choose Require additional consent for tag to fire with the signal it needs:
ad_storagefor ad pixels,analytics_storagefor analytics and heatmaps. Cookiebot's scan report shows each tool's category. - Replace the All Pages trigger with a Custom Event trigger for the event
cookie_consent_update.
A consent update does not make Tag Manager look again at tags it already checked. On a visitor's first page, All Pages runs while the banner is still open, the check fails, and the tag stays silent for that page. Cookiebot pushes cookie_consent_update right after its Consent Mode update: the moment a visitor answers, and on every later page where it reads a stored answer, before the page view. Click and form triggers can stay; they happen after the answer.
Cookiebot also pushes cookie_consent_preferences, cookie_consent_statistics and cookie_consent_marketing, one for each accepted category, at the same moments. They work as triggers without consent settings, even with Consent Mode off. Use one approach per tag, not both, or it fires twice. And because cookie_consent_update fires again when a visitor changes their choice, set page view tags to Tag firing options › Once per page.
7Test it in Preview
Open Preview in a private window. In the Consent tab of the first event, the On-page Default column should list all four v2 signals as denied. The template registers the defaults inside Tag Manager, so you will not find them in the dataLayer.
Accept the banner: a cookie_consent_update event appears, the On-page Update column shows granted, and your gated tags fire on it. Start again and reject: they stay under Tags Not Fired. In the network tab, Google hits carry gcs=G100 before the answer and gcs=G111 after Accept all. How to read the gcs and gcd parameters explains every value.
The Measurebase tracking audit checks the same from outside: it loads your pages in a real browser, notes every tracker that sends hits before the banner is answered, then rejects and watches what still happens. The Domain statistics page shows how many hits arrived granted, denied or without any Consent Mode state.
With a server container
The consent state travels with every Google hit to your server container in the gcs and gcd parameters, and Google's server tags respect it. A Meta, TikTok or LinkedIn Conversions API tag there does not, and needs a trigger condition that checks it; see Consent Mode v2 in Google Tag Manager. To test those tags without clicking through your own banner, use Auto Grant Consent, and switch it off afterwards.
If you use automatic cookie blocking
With Cookiebot's script in the page and data-blockingmode="auto", pause or remove the Cookiebot CMP tag. Cookiebot's order is a Consent Mode default script, then the Tag Manager snippet, then the Cookiebot script, with data-cookieconsent="ignore" on the first two so automatic blocking cannot hold Tag Manager back. When you pick Cookiebot under Choose your consent banner on your domain's install page in Measurebase, every script tag Measurebase gives you carries that attribute; the WordPress plugin does the same.
The privacy trigger and the Cookiebot logo
The privacy trigger is the small icon Cookiebot shows once a visitor has answered; it opens their consent state with options to change or withdraw it. Because it only appears after an answer, there is no separate "hide when granted" setting: you keep it or switch it off. In the Cookiebot Admin that is Configuration › Privacy › Show privacy button; in the older Cookiebot Manager, Settings › Privacy trigger. The template has no field for it (the attribute data-widget-enabled="false" only works on the page script). On the free plan the trigger stays on, and its colours and position are paid-plan options.
If you switch it off, give visitors another way back, because withdrawing consent must be as easy as giving it. Cookiebot suggests a footer link:
<a href="#" onclick="window.Cookiebot.show()">Privacy settings</a>The "Cookiebot by Usercentrics" branding has no on or off setting either. Cookiebot publishes this CSS to hide it on the banner and in the privacy trigger:
a#CybotCookiebotDialogPoweredbyCybot,
div#CybotCookiebotDialogPoweredByText,
#CookiebotWidget .CookiebotWidget-body .CookiebotWidget-main-logo {
display: none;
}Subdomains and several domains
Cookiebot scans, and prices, every subdomain as a separate domain: shop.example.com and blog.example.com are each added on their own. example.com and www.example.com count as one, so add only one, or you pay twice. Paths such as /en belong to the same domain.
Domains in one domain group share the CBID and the banner, so one Cookiebot CMP tag works on all of them. Visitors still answer per domain unless you switch on Cross-domain Consent Sharing (paid plans). Since Chrome's storage partitioning, a consent given on a subdomain can carry over to the main domain, but not from the main domain down to its subdomains. For staging sites, paid plans have domain aliases, which show the banner marked TEST.
Frequently asked questions
What is cookie_consent_update?
A dataLayer event Cookiebot pushes right after its Consent Mode update: when a visitor answers the banner, and on every page where it reads a stored answer. Use it instead of All Pages for tags that require consent, so they also fire on the page where the visitor accepts.
Does the Cookiebot CMP template support Consent Mode v2?
Yes. It sets defaults for all four signals per region, ad_user_data and ad_personalization included, and sends the update when the visitor answers. Consent Mode is on by default.
Can I remove the Cookiebot logo?
There is no setting for it, but Cookiebot publishes CSS that hides the branding on the banner and in the privacy trigger. The privacy trigger itself can be switched off on a paid plan, as long as visitors keep another way to change their consent.
Do subdomains need their own Cookiebot setup?
Each subdomain is added, and priced, as a domain. In the same domain group they share one ID, one banner and one Tag Manager tag.
Why does my tag not fire on the first page after accepting?
It sits on All Pages with a consent requirement, so Tag Manager checked it before the visitor answered and does not look again. Switch the trigger to cookie_consent_update.