How to Use Cookiebot for Consent Mode v2 in Tag Manager

The short answer: if GA4 and Google Ads run through Tag Manager on a site with fewer than 50 subpages, build this on Cookiebot's Free plan, where Google Consent Mode is included; a bigger domain pays from €7 a month on Premium Lite (pricing page, checked on 5 November 2026). Add the domain and let the scan run, classify what it could not, load the consent defaults, Tag Manager and Cookiebot in that order with automatic blocking on, leave Google's tags on All pages and move the rest to Cookiebot's consent events, publish the declaration with a renew link, then run the Consent Mode check and read the consent log.

Disclosure: I may earn a commission through some links on this site. It does not change what this page says.

Without consent signals for EU visitors, Cookiebot's own article lists the outcome as "limited data, reduced targeting and restricted Google Ads"; version 2 added ad_user_data and ad_personalization, both mapped to the marketing category (About Google Consent Mode). Plans, the scanner's pricing and the company are in the Cookiebot entry.

Before the first scan:

1. Price the page count first. The scan starts the moment a domain is added and finishes within 24 hours, and its page count decides the tier (WordPress install guide). For example, 48 pages plus a blog of 20 posts is 68 subpages, over the Free limit of 50, so that domain is Lite at €7 x 12 = €84 a year (pricing page).
2. Sort the container into two lists. Tags with built-in consent, Google Ads, GA4, Floodlight and Conversion Linker, keep the All pages trigger; a Meta pixel, a LinkedIn tag or a chat widget needs a Cookiebot trigger, per the trigger section of the implementation article.
3. Take the baseline now. Four weeks of Google Ads conversions and GA4 sessions from before the banner, so the drop that follows is measured rather than felt.

What you need

• A Cookiebot account. Every account opens as a 14-day Premium trial with no card (pricing page).
• Publish rights on the Tag Manager container, and access to the site's head or to the person who has it.
• A page for the cookie declaration, usually the privacy policy.
• A decision from counsel on the default consent states, because the snippet in step 3 sets them.

Step 1: Add the domain and let it scan

In the Cookiebot Admin, open Domains and Aliases, click Add domain and enter the address without the protocol. The scan runs at once and the report arrives by email; the cookies it found sit under Cookies and Reports (install guide). If a firewall blocks bots, allow the user agent token Cookiebot/1.0 or the 11 listed IP addresses (whitelisting article). Pages behind a login are scanned once you send the login URL and credentials through the support form (scan behind a login).

Step 2: Classify what the scan did not recognise

Open Cookies and Reports, the Cookies and Trackers tab, then Discovered cookies and trackers, and give every row marked Unclassified a category and a purpose; the report shows where in the source the setting script sits. Unclassified cookies are not blocked in automatic mode, and Cookiebot's advice for a cookie nobody can explain is to file it as marketing (unclassified cookies).

Step 3: Load three scripts in Cookiebot's order

With the script in the page head the order is fixed: the Consent Mode default snippet, then the Tag Manager snippet, then Cookiebot's uc.js with your domain group ID and data-blockingmode="auto". Mark the first two with data-cookieconsent="ignore" so automatic blocking leaves them alone, and make sure no Cookiebot CMP tag inside the container still fires, or the script loads twice (Tag Manager and automatic blocking). The default snippet sets every consent type to denied except security_storage, with wait_for_update at 500 and ads_data_redaction on, and it can carry a region list so the denial applies to EU and UK visitors while everyone else defaults to granted (implementation article). Loading Cookiebot from the container instead, through the Cookiebot CMP tag with Consent Mode ticked, gives up automatic blocking, so every non-Google tag then needs its own trigger (conditional loading).

Step 4: Trigger the other tags on consent

Cookiebot pushes three events after a choice, cookie_consent_preferences, cookie_consent_statistics and cookie_consent_marketing, and the gallery holds a Cookiebot Consent State variable that returns "|preferences|statistics|marketing|" for a full opt-in and "|" for none (conditional loading). A Meta pixel goes on cookie_consent_marketing; a heatmap tool on cookie_consent_statistics.

Step 5: Choose Basic or Advanced, on paper

In Advanced mode Google's tags load before consent and send cookieless pings while it is denied; in Basic they are blocked until the visitor chooses, and which you get depends on how the tags are configured rather than on a switch (About Google Consent Mode). For GA4 linked to Ads, the same article notes that from 15 June 2026 ad_storage is the sole control for ad data shared from Analytics, so keep its default at denied. Write down who chose the mode and why.

Step 6: Publish the declaration

The declaration script is the second of the two under Your scripts; paste it into the body of the policy page at the spot where the list should appear, not in the head. It lists cookies by category with purposes, updates itself after every scan and carries the change and withdraw links; a custom XSLT template is Premium only (declaration article). Add a footer link that calls Cookiebot.renew() so a visitor can reopen the banner from any page (developer documentation).

Step 7: Run the check

In Domains and Aliases, pick the domain, scroll to Google Consent Mode Check and click Start GCM check. It takes 10 to 15 seconds, keeps the report for 30 days and flags defaults that are not set, signalling that does not reach the data layer, and Google trackers set before consent; a "no risk" result reads the browser data layer only and is not a finding of compliance (Consent Mode Checker). In Tag Manager's preview, the Consent tab should show On-page Defaults including ad_personalization and ad_user_data (checking article).

Step 8: Read the log

In the Manager, User Consents, pick the domain and interval and click Download Log; in the Admin, the domain's Analytics tab, Read More, then Download User Consent Log (consent log). Opt-ins per category and country are also available by API for the trailing 12 months (consent data API).

Step 9: On WordPress, let an agent run the install

The WordPress plugin ships an AGENTS.md with the setup flow and WP-CLI commands such as wp cookiebot set-cbid, wp cookiebot toggle-gcm and wp cookiebot compliance (AGENTS.md). On a staging copy, hand the file to Claude Code and ask for the install plus its six-point checklist with what it observed. The human check is item six: a person submits a test consent in a private window, confirms it shows in the consent log within minutes, then runs the GCM check from step 7 before anything reaches production.

Where Cookiebot's articles say it breaks

• Cookiebot loaded twice, inline or by plugin and again by a firing CMP tag in the container (Tag Manager and automatic blocking).
• The default snippet below the Tag Manager snippet. The defaults must precede gtag.js or GTM, and a renamed dataLayer needs its new name in the snippet's first line (implementation article).
• Removing the script to stop paying. It does not; cancel the domain in the Admin (cancellation article).

The free plan is shaped around Google. Consent Mode signalling costs nothing on any tier, while the automatic blocking that holds a Meta pixel or a chat widget until consent is a Premium feature, so a site whose only tags are Google's stays free and a site with anyone else's tags pays from €7 a month (pricing page).

FAQ

Is Consent Mode v2 in the Free plan?

Yes. Cookiebot's article says Consent Mode is included in any subscription, the free one included, and the v2 parameters map to the marketing category (About Google Consent Mode).

Why does GA4 show a traffic spike once a month?

The monthly scan visits every page. Filter it out on the user agent, which contains Cookiebot/1.0, rather than on IP addresses, which Cookiebot says can change (whitelisting article).

Can the GCM check replace a legal review?

No. The checker reads the data layer in the browser and cannot see the Tag Manager backend, and Cookiebot asks you to have counsel judge whether a flagged risk applies to your market (Consent Mode Checker).