Cookiebot is installed but tags still fire before consent. Here's why.
The most common CMP misconfiguration we see: Cookiebot is live, the banner shows, and Google Analytics fires anyway. A practical guide to why it happens and how to fix it.
You installed Cookiebot. The banner appears. You assumed that meant your tags wait for consent. Then a scan shows _ga and _gcl_au being set on page load, before anyone clicks anything.
This is the single most common consent problem we see, and it's almost always one of a handful of causes.
Cause 1: Auto-blocking isn't actually on
Cookiebot's automatic cookie-blocking works by rewriting script tags on the page. If your tags are injected through Google Tag Manager, Cookiebot often can't see or rewrite them — GTM loads them dynamically after Cookiebot has already scanned the DOM.
The fix isn't Cookiebot's auto-blocking. It's Consent Mode + GTM triggers.
Cause 2: GTM tags fire on "All Pages" with no consent check
Open your GTM container and look at your GA4 and Ads tags. If their trigger is "All Pages — Page View" with no consent condition, they fire the instant GTM loads. The banner is irrelevant to them.
A cookie banner controls the UI. It does not control your GTM tags unless you explicitly wire consent into them. These are two separate systems, and installing the first does nothing to the second.
Cause 3: Consent Mode default state is missing
Google Consent Mode expects a default command to run before any tags — telling Google to assume consent is denied until the user says otherwise:
gtag('consent', 'default', {
ad_storage: 'denied',
analytics_storage: 'denied',
ad_user_data: 'denied',
ad_personalization: 'denied',
wait_for_update: 500,
});
If this doesn't run first — as a Consent Initialization trigger in GTM, ahead of everything — tags behave as if consent were granted.
The correct setup, in order
- Consent Initialization trigger fires the Consent Mode
default(all denied). - Cookiebot updates the consent state when the user chooses, via
gtag('consent', 'update', …). - Your GA4, Ads and Meta tags are configured with built-in consent checks (Additional Consent Checks in GTM) so they respect the state.
- Nothing non-essential fires until consent is granted.
Verify it
Don't trust that it worked — prove it. Reload the page with a clean profile and confirm no analytics or ads cookies appear before you interact with the banner. Then accept, and confirm they appear after.
You can run this check automatically: our Consent Mode v2 detector loads your site, inspects the dataLayer, and tells you whether the default state and the v2 signals are actually present.
When to get help
If your tags are hardcoded into the theme (common on WordPress builders) rather than in GTM, Cookiebot and GTM consent checks can't reach them — those need to be removed at the page level. That's the half of cases where a scan says "still leaking" even after the GTM side looks right.
If you'd rather not spelunk through your own container, we fix exactly this — including the hardcoded-tag cases — and prove it with a before/after scan.