Recommended Setup for Proper Script & Consent Management
1️⃣ Implement Default Deny (Mandatory)
In GTM:
Configure Consent Mode
Set a Consent Initialization – All Pages tag
Default all storage types to
denied:
‘ad_storage’: ‘denied’,
‘analytics_storage’: ‘denied’,
‘ad_user_data’: ‘denied’,
‘ad_personalization’: ‘denied’
});
This ensures no marketing or analytics scripts execute before user consent.
2️⃣ Proper CMP Integration
The CMP (cookie banner) must:
Send a consent update event to GTM
Explicitly trigger:
‘analytics_storage’: ‘granted’
});
Without this integration, Consent Mode is ineffective.
3️⃣ Apply Consent Checks to ALL Tags (Not Only Google)
For every non-Google script (Meta, LinkedIn, TikTok, Hotjar, custom JS):
Configure Built-in Consent Checks in GTM
OR
Add trigger conditions based on consent variables
No script should fire on “All Pages” without consent validation.
4️⃣ Introduce a Tag Governance Policy
Define internal rules:
No “All Pages” trigger unless strictly necessary
Prefer event-based triggers (interaction, scroll, conversion)
Avoid duplicate tracking platforms
Maintain a tag inventory list
Test all changes in Preview before publishing
5️⃣ Monitor Performance Impact
After configuration:
Run Lighthouse before and after consent acceptance
Measure Total Blocking Time and JS execution time
Identify heavy third-party scripts
This creates technical transparency and prevents performance regressions.
Strategic Outcome
With this setup:
Scripts do not degrade performance before consent
Tracking remains compliant
GTM becomes controlled instead of uncontrolled
Performance responsibility becomes measurable