Cookie banners that actually block tracking until people say yes

Here’s an uncomfortable test: open your site in a private window, don’t touch the cookie banner, and watch the browser’s network tab. On a surprising number of sites, analytics and ad tags fire before anyone clicks anything.

How it should work

• A consent management platform shows the banner and records the visitor’s choice.
• Tags in Google Tag Manager wait for the right consent before firing.
• Google’s own tags read the choice through Consent Mode and adjust what they collect.
• Changing your mind later actually changes what fires.

Set defaults first

Consent defaults have to be set before any tag loads, usually “denied” for analytics and ads where opt-in is required. The consent platform then updates them when the visitor chooses.

// Runs before Tag Manager loads: deny by default, let the banner update it
window.dataLayer = window.dataLayer || [];
function gtag(){ dataLayer.push(arguments); }
gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied'
});

Gate the other tags too

Consent Mode only covers Google’s own tags. Ad pixels, heatmaps, chat widgets and other third-party scripts need Tag Manager triggers that check consent before they fire.

Test it like a skeptic

• Private window, no click: nothing tracking-related should load.
• Accept all: the tags should fire.
• Reject: they should stay off on every page, not just the first one.
• Change your choice later and confirm it sticks.