---
updatedAt: 2026-08-20T12:48:20.000Z
agentTools:
  projectIndex: https://developer.onetrust.com/onetrust/llms.txt
---

# Cookie Consent Integration with Google Tag Gateway for Advertisers

> This article explains how Google Tag Gateway (GTG) affects your OneTrust Cookie Consent implementation, how to detect a GTG enrollment, how to identify a “late consent signal” issue, and which remediation path is appropriate for your setup — including the recommended adoption of Advanced Consent Mode (U+C) with Geolocation Rules set to opt-in and Global Consent Defaults.

<Callout icon="⚠️" theme="warn">
  ### Banner Behavior Requirement - effective March 2026

  If your implementation uses an opt-in consent model or Global Consent Defaults (as recommended in this article), your OneTrust banner must present users with a genuine choice - including an equally prominent reject or decline option - before any data is transmitted. Confirm your banner template meets this requirement before enabling these features. See <Anchor target="_blank" href="https://my.onetrust.com/s/article/UUID-2b6cc670-059c-5342-275c-4a7d8da5630e">Banner Behavior Configuration&#x20;</Anchor>for guidance.
</Callout>

## What is Google Tag Gateway for Advertisers?

Google Tag Gateway (GTG) is a feature that allows you to serve Google tag scripts (such as `gtm.js `or `gtag.js`) through your own first-party domain, using a CDN, load balancer, or web server. Instead of scripts loading from `googletagmanager.com`, they load from a path on your own domain (for example, `example.com/gtag/js`).
This provides benefits including improved measurement durability, reduced third-party cookie exposure, and potential conversion uplift. However, GTG has a significant implication for CMP implementations: **when GTG is enabled via one-click CDN injection, the CDN injects the Google tag into the page automatically, which often prevents you from controlling the order in which scripts load**. This can cause the Google tag to fire before OneTrust has set consent defaults, resulting in a “late consent signal.”

For full details on GTG, see <Anchor target="_blank" href="https://developers.google.com/tag-platform/tag-manager/gateway">Google Tag Gateway for Advertisers - Google Developers</Anchor>

<Callout icon="📘" theme="info">
  ### How consent and GTG interact

  In a standard setup, your page controls the order of script execution — consent defaults are set first, then the Google tag loads. With CDN-injected GTG, the CDN inserts the tag independently of your page code. This means the tag may load and fire _before_ the OneTrust banner script has communicated the user’s consent state to Google.
</Callout>

## How to Verify if a tag is Enrolled in GTG

Before troubleshooting a consent issue, confirm whether your Google tag is enrolled in GTG. There are two ways to check:

### Method 1: Google Tag Manager or Google Tag Settings UI

1. Open [Google Tag Manager](https://tagmanager.google.com/) and navigate to the **Google tags** tab, or access your Google tag settings via Google Ads, Google Analytics, or Campaign Manager 360.
2. Select your tag and open the **Admin** section.
3. Click **Google tag gateway for advertisers**. An **Active** status indicator appears next to each domain<br />where GTG is running.

For step-by-step access instructions, see <Anchor target="_blank" href="https://support.google.com/tagmanager/answer/16816376?hl=en#Access_your_Google_tag_settings">Access your Google tag settings — Tag Manager Help</Anchor>.

### Method 2: Google Tag Assistant

1. Connect <Anchor target="_blank" href="https://tagassistant.google.com/">Google Tag Assistant </Anchor>to your website URL.
2. Navigate to **Summary → Output → Hits Sent**.
3. Check whether measurement hits are routed through your own domain rather than a Google domain (e.g. `googletagmanager.com`). GTG-served tags will show your domain as the measurement path.<br /> 

## Understanding “Late Consent Signal” Errors

A late consent signal occurs when Google tags load and begin executing *before* the `gtag('consent', 'default', {...})` command has been called. This means Google tags operate without knowing the user’s consent state, which can result in data being collected as if consent were granted.<br /><br />Common causes include:

* GTG enabled via one-click CDN injection (for example, Cloudflare, Akamai, or Fastly automatic setup), where the CDN injects the Google tag independently of your page’s HTML.
* The OneTrust banner script loading after the Google tag in page source.
* Consent defaults not being set in page source before GTM/gtag loads.

### How to detect a late consent signal

1. Open your browser’s developer tools and go to the **Console&#x20;**&#x74;ab.
2. Type d`ataLayer` and press Enter before interacting with the consent banner. A `gtag('consent', 'default', ...)` push should appear before any `gtm.js` or tag-firing events. If tag events appear first, you have a late consent signal.
3. Alternatively, run [OneTrust Consent Mode Diagnostics ](https://my.onetrust.com/s/article/UUID-d81787f6-685c-2262-36c3-5f1f3369e2a7)on your domain. A “late consent signal” or “consent initialized after tag load” error will surface in the scan results.
4. Confirm GTG enrollment using the methods above. If GTG is active and you have a late consent signal, proceed to the remediation section below.<br /> 

## Remediation Paths When GTG Is Enrolled

If a late consent signal is detected and GTG enrollment is confirmed, the GTG load order is the likely cause. Choose one of the following remediation paths based on your infrastructure and implementation approach.

| **Scenario**                                                          | Recommended action                                                                                                                                                       |
| --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| <span style="color: #1b5e20;">**Recommended (all GTG setups)**</span> | Adopt Advanced Consent Mode (U+C) and configure Geolocation Rules with an opt-in consent model and Global Consent Defaults. Compatible with CDN-injected and manual GTG. |
| **If using GTM**                                                      | Migrate all tags into a single GTM container and deploy GTM via GTG. Consent initialization is managed inside the container, resolving the load order issue.             |
| **Manual control preferred**                                          | Set up GTG manually (not one-click CDN injection) so you control the script import order. Load consent defaults and OneTrust banner script before the Google tag.        |

<Callout icon="🚫" theme="error">
  ### Blocking-based (Basic) Consent Mode is not reliable with CDN-injected GTG

  Basic Consent Mode relies on blocking tag execution until consent is given. When a CDN injects your Google tag, tag execution may occur before the block can be applied. Advanced Consent Mode (U+C) is the only approach that reliably handles consent for GTG-enrolled tags in CDN-injected environments.
</Callout>

## Option 1 (Recommended): Advanced Consent Mode with Opt-in Geolocation Rules and Global Consent Defaults

**<span style="background-color: #90EE90; color: #006400;">Recommended </span>**  Advanced Consent Mode, also called Unified Consent Mode or U+C, allows Google tags to load immediately with consent set to `denied `by default. The tags adjust their behavior dynamically as the user makes a consent choice. **This means a GTG-served tag that loads before OneTrust fires will not collect data as if consent were granted** — it waits for the consent update signal.<br /><br />This approach is compatible with manual and CDN-injected GTG setups alike, making it the most durable solution.<br />

### Step 1: Enable Google Consent Mode in OneTrust Geolocation Rules

1. &#x20;In OneTrust, go to **Cookie Consent → Geolocation Rules**.
2. Select your Geolocation Rule Group and open the relevant rule (e.g. your EU/EEA rule).
3. Click the **Edit** icon and enable the **Google Consent Mode** toggle. By default, the Performance category maps to `analytics_storage` and the Targeting category maps to `ad_storage, ad_user_data`, and `ad_personalization`.
4. Set the consent model to **Opt-in** (denied by default) for regions where privacy regulations require explicit consent before data collection.<br />&#x20;

### Step 2: Set the Consent Model to Opt-in in Geolocation Rules

The opt-in consent model is what prevents data from being transmitted to Google before a user has made a consent choice. When set to opt-in, all mapped Google Consent Mode storage types default to `denied` for that region until the user actively accepts. This is the OneTrust mechanism that controls whether data is held until consent is given — no separate feature is required.

1. In OneTrust, go to **Cookie Consent → Geolocation Rules&#x20;**&#x61;nd open the relevant Rule Group.
2. For each rule covering a region where GTG is active (e.g. EU/EEA, UK), click the **Edit** icon and set the **Consent Mode**l to **Opt-in.** This ensures all non-essential cookie categories default to disabled until explicit consent is given.
3. For regions using an opt-out model (e.g. some US states), review whether your legal basis permits data collection before consent. If so, reflect this in the Global Consent Defaults block in Step 3 using a region-specific `granted` override.
4. Save your changes and re-publish your OneTrust scripts (Production CDN, then Testing CDN) for the changes to take effect.

<Callout icon="⚠️" theme="warn">
  ### Banner behavior requirement - effective March 2026

  When the consent model is set to opt-in, your OneTrust banner must present users with an equally prominent way to decline data collection. Confirm that your banner template displays a Reject All (or equivalent) option at the first layer of the banner — not only inside the Preference Centre. See <Anchor target="_blank" href="https://my.onetrust.com/s/article/UUID-2b6cc670-059c-5342-275c-4a7d8da5630e">Banner Behavior Configuration</Anchor>.
</Callout>

### Step 3: Configure Global Consent Defaults

Global Consent Defaults set the baseline consent state for users in regions without specific geolocation rules, or before any user interaction has occurred. They work in conjunction with the opt-in model set in Step 2 — the geolocation rule controls OneTrust's behaviour, while the defaults block communicates the starting consent state directly to Google tags before OneTrust has loaded.

1. In the OneTrust CMP GTM template (or in your page-source consent defaults block), set all consent types to `denied `as the global default unless your legal basis permits a different starting state.
2. Include `wait_for_update: 500 `to give the OneTrust script time to communicate the user's prior consent state before Google tags proceed with cookieless pings.
3. Use region-specific overrides for jurisdictions with different default requirements (e.g. opt-out regions where `analytics_storage `may default to `granted`).

**Example Global Consent Defaults block (page source, before GTM/gtag script):**

```html
<!-- 1. Consent defaults — must appear before GTM/gtag and before OneTrust -->
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){ dataLayer.push(arguments); }
 
  // Global defaults — denied until consent is given
  gtag('consent', 'default', {
    'ad_storage':           'denied',
    'analytics_storage':    'denied',
    'ad_user_data':         'denied',
    'ad_personalization':   'denied',
    'functionality_storage':'denied',
    'security_storage':     'granted',
    'wait_for_update':      500
  });
 
  // Region-specific override: opt-out model for US (non-California)
  gtag('consent', 'default', {
    'analytics_storage': 'granted',
    'ad_storage':        'granted',
    'region': ['US']
  });
</script>
 
<!-- 2. GTG-served GTM or gtag script (loaded from your domain) -->
<script async src="https://YOUR-DOMAIN.com/gtag/js?id=G-XXXXXXX"></script>
 
<!-- 3. OneTrust banner script -->
<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js"
  type="text/javascript"
  data-domain-script="YOUR-DOMAIN-SCRIPT-ID"></script>
<script type="text/javascript">
  function OptanonWrapper() { }
</script>

```

 

<Callout icon="📘" theme="info">
  ### Note on CDN-injected GTG

  If your GTG setup uses one-click CDN injection (e.g. Cloudflare, Akamai), the CDN may inject the Google tag before your page’s <head> content is rendered. In this case, even a correctly placed consent defaults block in your HTML may not fire first. Adopting Advanced Consent Mode (U+C) with Global Consent Defaults is the reliable solution, as the tag will operate in a denied state by default regardless of load order.
</Callout>

### Step 4: Map OneTrust Categories to Consent Mode V2 Types

Whether using the OneTrust CMP GTM template or manual gtag implementation, ensure all six consent types are mapped. Consent Mode V2 requires the two additional fields introduced in 2024:

| Google Consent Storage Type | OneTrust Purpose (default)    | CM Version                                                                                      |
| --------------------------- | ----------------------------- | ----------------------------------------------------------------------------------------------- |
| `ad_storage`                | C0004 - Targeting/Advertising | v1                                                                                              |
| `analytics storage`         | C0002 - Performance           | v1                                                                                              |
| `ad_user_data`              | C0004 - Targeting/Advertising | <mark style="background-color: #FFFACD;"><span style="color: #8B7500;">**v2 New**</span></mark> |
| `ad_personalization`        | C0004 - Targeting/Advertising | <mark style="background-color: #FFFACD;"><span style="color: #8B7500;">**v2 New**</span></mark> |
| `functionality_storage`     | C0003 - Functional            | v1                                                                                              |
| `secruity_storage`          | C0001 - Strictly Necessary    | v1                                                                                              |

<br />For instructions on configuring these mappings in the OneTrust GTM template, see <Anchor target="_blank" href="https://my.onetrust.com/s/article/UUID-d81787f6-685c-2262-36c3-5f1f3369e2a7">Cookie Consent Integration with Google Consent Mode</Anchor>.

## Option 2: Migrate All Tags into GTM and Deploy GTM via GTG

<br />If you manage your tags in Google Tag Manager, you can resolve the load-order issue by deploying the entire GTM container through GTG, rather than injecting individual Google tags via GTG. When GTM itself is served via GTG and the OneTrust CMP tag fires on the **Consent Initialization — All Pages** trigger, consent initialization is handled entirely within the container sequence.<br />

1. Ensure all Google product tags (GA4, Google Ads, Floodlight) are contained within a single GTM web container — not loaded separately via `gtag.js`.
2. Set up GTG to serve the GTM container script from your first-party domain. See <Anchor target="_blank" href="https://developers.google.com/tag-platform/tag-manager/gateway/setup-guide">Set up Google Tag Gateway — Google Developer</Anchor>s.
3. In GTM, install the **OneTrust CMP** tag from the Community Template Gallery and configure it to fire on **Consent Initialization — All Pages** with Google Consent Mode enabled.
4. **Enable Consent Overview&#x20;**&#x69;n GTM Container Settings and configure each tag with the appropriate consent checks (**No additional consent required&#x20;**&#x66;or Google tags using Advanced Consent Mode).
5. Publish the container and verify the consent sequence using GTM Preview mode and Tag Assistant.<br /> 

***

## Option 3: Manual GTG Setup with Controlled Script Order

If you set up GTG manually (self-service, without one-click CDN injection), you can control the order in which scripts appear in your page source. This allows you to place the consent defaults block before the GTG-served tag URL.<br /><br />Use the manual setup guide at <Anchor target="_blank" href="https://developers.google.com/tag-platform/tag-manager/gateway/setup-guide?setup=manual">Google Tag Gateway — Self-Service Setup</Anchor> to configure your CDN or load balancer to proxy Google tag requests through your domain without automatic injection. Once configured, follow the script order shown in Option 1, Step 3.<br />

<Callout icon="📘" theme="info">
  ###

  Even with manual GTG and controlled load order, we recommend also enabling Advanced Consent Mode (U+C) as a defence-in-depth measure. Load order issues can be reintroduced by CDN configuration changes or CMS updates. Advanced Consent Mode ensures tags behave correctly regardless.
</Callout>

## <br />OneTrust Script and GTG: What Is Not Proxied

GTG proxies *Google* tag scripts through your first-party domain. The OneTrust banner script (`cdn.cookielaw.org`) is a separate, third-party asset and is not proxied by GTG. It continues to load from OneTrust’s CDN. This is expected and acceptable — OneTrust is a consent management platform, not a measurement script.

| Script                     | Loaded from                            | Proxied by GTG?  |
| -------------------------- | -------------------------------------- | ---------------- |
| gtm.js / gtag.js           | Your domain (e.g. example.com/gtag/js) | ✅  Yes           |
| Google measurement hits    | Your domain measurement path           | ✅  Yes           |
| OneTrust `otSDKStub.js`    | `cdn.cookielaw.org`                    | ❌  No (expected) |
| OneTrust Auto Block script | `cdn.cookielaw.org`                    | ❌  No (expected) |

## GTG Combined with Server-Side GTM (SGTM)

If you are using GTG alongside a server-side GTM container, note that the SGTM server container does not have visibility into browser-side consent state. Consent signals captured by OneTrust in the browser must be passed from the web container to the server container via event parameters or the `consent` object on hits.<br /><br />Ensure that:

* Your web container forwards consent signals to the server container in the data model sent with each event hit.
* Server-side tags in SGTM are configured to respect and act on the consent parameters received.
* Cookieless pings (sent when consent is denied) are correctly handled server-side and not enriched with identifiers before forwarding.

<br />For architecture guidance, see <Anchor target="_blank" href="https://developers.google.com/tag-platform/tag-manager/gateway/sgtm-and-cdn?option">Google Tag Gateway with CDN and SGTM — Google Developers</Anchor>.<br /> 

***

## <br />Verifying the Implementation

1. **dataLayer inspection:&#x20;**&#x4F;pen browser developer tools, type `dataLayer` in the console before interacting with the banner, and confirm that the consent `default `command appears before any tag-firing events.
2. **GTM Preview:** Use GTM Preview mode and check that the OneTrust CMP tag fires on the Consent Initialization trigger, and that other tags fire only after the appropriate consent is granted.
3. **Consent Mode diagnostics:** Re-run OneTrust Consent Mode Diagnostics on your domain after remediation to confirm the late consent signal error is resolved.
4. **Tag Assistant:&#x20;**&#x56;erify in Tag Assistant that consent events (`consent → default`, then `update`) appear in the correct sequence, and that Google tag hits show the expected consent state.

## <br />Summary: GTG + OneTrust Configuration Checklist

| Item                                                                | Required?                                                         | Notes                                                                                          |
| ------------------------------------------------------------------- | ----------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| Confirm GTG enrollment status                                       | **<span style="color: #8B0000;">Required</span>**                 | Check via GTM/Google tag settings or Tag Assistant before troubleshooting                      |
| Consent defaults set before Google tag loads                        | **<span style="color: #8B0000;">Required</span>**                 | Critical for non-CDN-injected setups; Advanced CM handles this for CDN-injected                |
| Advanced Consent Mode (U+C) enabled                                 | **<span style="color: #228B22;">Recommended</span>**              | Required if CDN-injected GTG; strongly recommended for all GTG setups                          |
| Geolocation Rules set to opt-in consent model                       | **<span style="color: #228B22;">Recommended</span>**              | This is how OneTrust holds data until consent is given — set per rule for each relevant region |
| Global Consent Defaults configured                                  | **<span style="color: #228B22;">Recommended</span>**              | Set all six consent types; include wait\_for\_update: 500                                      |
| Consent Mode V2 fields mapped (ad\_user\_data, ad\_personalization) | **<span style="color: #8B0000;">Required</span>**                 | Required for Google Ads network participation                                                  |
| Banner shows equal reject/decline option                            | **<span style="color: #8B0000;">Required from March 2026</span>** | Required when opt-in consent model or Global Consent Defaults are in use                       |
| OneTrust script still loads from cdn.cookielaw\.org                 | Expected                                                          | Not proxied by GTG — this is by design                                                         |

## <br />Related Resources

* <Anchor target="_blank" href="https://my.onetrust.com/s/article/UUID-d81787f6-685c-2262-36c3-5f1f3369e2a7">Cookie Consent Integration with Google Consent Mode</Anchor>
* <Anchor target="_blank" href="https://my.onetrust.com/s/article/UUID-d81787f6-685c-2262-36c3-5f1f3369e2a7#UUID-d81787f6-685c-2262-36c3-5f1f3369e2a7_section-idm231981224490148">Configuring Geolocation Rules for Google Consent Mode</Anchor>
* <Anchor target="_blank" href="https://my.onetrust.com/s/article/UUID-d81787f6-685c-2262-36c3-5f1f3369e2a7#UUID-d81787f6-685c-2262-36c3-5f1f3369e2a7_section-idm231981224490148"> Using the OneTrust CMP Template in Google Tag Manager</Anchor>
* <Anchor target="_blank" href="https://my.onetrust.com/s/article/UUID-d81787f6-685c-2262-36c3-5f1f3369e2a7">Advanced Consent Mode (U+C) Configuration Guide</Anchor>
* <Anchor target="_blank" href="https://developers.google.com/tag-platform/tag-manager/gateway">Google Tag Gateway for Advertisers — Google Developers</Anchor>
* <Anchor target="_blank" href="https://support.google.com/tagmanager/answer/16816376?hl=en#Access_your_Google_tag_settings">Access your Google tag settings — Tag Manager Help</Anchor>
* <Anchor target="_blank" href="https://developers.google.com/tag-platform/tag-manager/gateway/setup-guide?setup=">Set up Google Tag Gateway — Google Developers</Anchor>

<br />

# Sibling pages

* [Web CMP JavaScript Methods](https://developer.onetrust.com/onetrust/docs/javascript-api.md)
* [Web CMP Events Guide](https://developer.onetrust.com/onetrust/docs/javascript-events-guide.md)
* [Custom Geolocation Integration](https://developer.onetrust.com/onetrust/docs/custom-geolocation-integration.md)
* [Display Preference Center on Script Load](https://developer.onetrust.com/onetrust/docs/display-preference-center.md)
* [AMP Integration](https://developer.onetrust.com/onetrust/docs/amp-integration.md)
* [Cookie Consent Support for AMP Websites](https://developer.onetrust.com/onetrust/docs/cookie-consent-support-for-amp-websites.md)
* [Configuring a Content Security Policy with OneTrust CDN](https://developer.onetrust.com/onetrust/docs/content-security-policy-cdn.md)
* [IAB CCPA: Configuring the US Privacy String](https://developer.onetrust.com/onetrust/docs/iab-ccpa-us-privacy-string.md)
* [IAB TCF Developer Guide](https://developer.onetrust.com/onetrust/docs/iab-tcf-developer-guide.md)
* [Using TCF with Header Bidding (TCF Stub)](https://developer.onetrust.com/onetrust/docs/using-tcf-with-header-bidding.md)
* [Using TCF with Prebid](https://developer.onetrust.com/onetrust/docs/using-tcf-with-prebid.md)
* [Single Page Applications](https://developer.onetrust.com/onetrust/docs/single-page-applications.md)
* [Multi-Touch Consent](https://developer.onetrust.com/onetrust/docs/multi-touch-consent.md)
* [Google Consent Mode](https://developer.onetrust.com/onetrust/docs/using-google-consent-mode.md)
* [Custom Common CSS and JavaScript](https://developer.onetrust.com/onetrust/docs/common-custom-css.md)
* [Custom Common HTML](https://developer.onetrust.com/onetrust/docs/custom-common-html.md)
* [Server Side Rendering Performance & Availability](https://developer.onetrust.com/onetrust/docs/server-side-rendering-performance-availability.md)
* [PRA/DSAR - Web CMP Opt Out](https://developer.onetrust.com/onetrust/docs/dsarpra-web-cmp-opt-out.md)
* [Bulk Domain Management](https://developer.onetrust.com/onetrust/docs/bulk-domain-management.md)