Set up Consent Mode v2 via GTM step by step

What does setting up Consent Mode v2 via GTM step by step mean?

This is how to configure Google Tag Manager so that Google tags receive the user’s consent status before sending or processing data for each purpose. For Vietnamese businesses, this approach is often used to clearly separate the default and update states, helping the cookie banner and the measurement stack speak the same “language”.

From a PDPL compliance perspective, you should not treat this as just tracking technique. It is part of the consent management process, logging, and evidencing the acceptance status as required. If the implementation involves personal data, review your notice, processing purposes, and consent evidence.

What should you prepare before setting up Consent Mode v2 via GTM?

You need four minimum items: a banner/CMP that can fire consent events, a GTM container already installed on the website, GTM edit permissions, and a clear list of the consent types you want to use. For ecommerce or lead-gen websites in Vietnam, common categories include analytics, ads, functionality, and security.

Define beforehand: when users haven’t chosen anything, which tags are allowed to run in a “denied” state, which must wait for “granted”, and what data will be logged for later reconciliation. This is where many marketing and dev teams tend to get out of sync.

How to set up Consent Mode v2 via GTM step by step?

You can follow the process below to avoid tags firing before consent or updates being applied to the wrong place.

How should default and update be configured in Consent Mode v2?

Default is the initial state before you know the user’s choice; update is the change after they have chosen. The important principle is that default must be set early enough, and update must occur immediately after a valid interaction with the banner/CMP.

A real example: if a user lands on a page from an ad, GTM should not let marketing tags run and then “make up” consent afterward. Instead, tags must read the default state first, then switch to the appropriate state only after a consent signal exists.

Some teams mistakenly set the default too late, causing the first pageview to be sent contrary to expectations. If you use many tags, check load order and prioritize the consent tag before all measurement tags.

How to link consent signals from the banner into GTM?

The most robust approach is for the banner/CMP to fire a standardized event into the dataLayer, for example consent_update, along with fields that represent the user’s choices. GTM will catch that event and turn it into consent updates for the relevant tags.

You should standardize the payload instead of having a different shape on each page. A real example:

{
  "event": "consent_update",
  "analytics_storage": "granted",
  "ad_storage": "denied",
  "ad_user_data": "denied",
  "ad_personalization": "denied"
}

If your system has a “Reject all” button, it must also fire a similar event to update consent clearly, not just close the popup. If you only close the banner without storing state, GTM won’t know how to handle subsequent loads.

What should you check when testing Consent Mode v2 in GTM?

You shouldn’t just assume the banner rendering correctly is enough. Check three layers: execution order, consent states in GTM, and actual browser requests.

In Preview mode, check:

• Whether default consent is set before other tags
• Whether the update event appears when the user clicks
• Whether GA4/Google Ads tags honor consent states
• Whether any tags fire early before consent

In Chrome DevTools, inspect network requests to confirm what is sent, what is held back, or what changes behavior according to consent. If the site is multilingual or uses multiple templates, test on at least 2–3 key pages: homepage, product page, checkout/lead form.

Common error checklist when setting up Consent Mode v2 via GTM

The most common errors are: setting the default too late, CMP and GTM using different variable names, inconsistent update events, and forgetting to test on mobile. Another error is finishing configuration but failing to store evidence of what the user chose and when.

If your website has multiple data sources such as GA4, Google Ads, server-side tagging, or a CRM form, verify synchronization logic across systems. Consent is not just “turning tags on/off”, but also the data flow from the banner to analytics and advertising.

Should you store consent evidence in your system?

Yes. For real-world websites, you should at least store the timestamp, the banner version, the user’s choices, and the source of the consent event. This helps with operational reconciliation or regulatory explanations.

If you’re building a cookie banner, consent logging, or DSAR, consent.vn can help you standardize the process and technical logs so the dev team can implement more easily.

Source: the Personal Data Protection Law (Law 91/2025/QH15) (thuvienphapluat.vn); Decree 13/2023/ND-CP (thuvienphapluat.vn); Ministry of Public Security – Department of Cybersecurity and Hi-tech Crime Prevention (A05) (bocongan.gov.vn)