Analytics integration
Google Tag Manager (GTM) on Shopify, made compliant
Container script that loads other tags — common Shopify approach for managing GA4, Google Ads, and third-party pixels in one place.
Why consent applies to Google Tag Manager (GTM)
GTM itself doesn't set tracking cookies, but every tag it loads (GA4, Meta Pixel, Floodlight) does. The compliance trap: setting Google Consent Mode v2 defaults inside GTM is too late — GTM loads asynchronously, so by the time the consent default-deny fires, GA4 has already sent its first pageview ping. Defaults must be set inline in `<head>` before GTM.
Cookies / scripts Google Tag Manager (GTM) sets
(no cookies of its own; loads other tags that set cookies)
Step-by-step compliance setup
- 1
Set GCM v2 defaults inline — NOT inside GTM
Add a tiny inline script in `<head>` before the GTM snippet that pushes `gtag('consent', 'default', { ... 'denied' ... })`. This is the single most-missed step on Shopify stores using GTM — even otherwise-compliant CMPs get this wrong if they configure consent inside GTM itself.
- 2
Block the GTM container script until consent
GTM at `https://www.googletagmanager.com/gtm.js?id=GTM-XXX` loads everything else. Blocking it until consent is the cleanest pattern — but you lose the ability to fire any tags pre-consent (including non-tracking utility tags). The hybrid approach: load GTM, but use Consent Mode v2 to gate all tracking tags inside it.
- 3
Use Consent Mode in tag triggers
Inside GTM, set every tag's 'Consent Settings' to require the relevant signal (`analytics_storage` for GA4, `ad_storage` for Google Ads). Tags wait for consent to be granted before firing, even though the GTM container is loaded.
How Consentico handles Google Tag Manager (GTM)
Consentico sets GCM v2 defaults inline before any other script via the theme app extension — this is the load-order GTM-using stores need. No GTM configuration required on the merchant's side; existing GTM containers continue to work, with their tags gated by the consent signals Consentico sets.
- Default-deny before any tag fires
- Three-layer script blocking (createElement + MutationObserver + content-type)
- Audit-ready consent log
Related concepts
- GTM (Google Tag Manager)A container that loads other tracking scripts. Common pitfall: setting consent defaults inside GTM is too late.
- GA4 (Google Analytics 4)Google's current analytics product. Triggers consent obligations because it sets a client identifier and tracks behaviour across sessions.
- Google Consent Mode v2Google's framework for sending consent signals to GA4 and Google Ads. Mandatory for EU/EEA traffic since March 2024.
Related integrations
Block Google Tag Manager (GTM) until consent — in five minutes.
Free for stores under 5,000 banner views per month. No code, no theme edits.