Module 5
Consent Mode v2 default-deny baseline
Inject a default-deny consent baseline before GTM loads. Covers all regions globally plus an explicit EEA/UK region list.
What this does
Before the GTM snippet runs, two gtag('consent','default',...) calls must already be in the dataLayer. The first covers all regions globally. The second explicitly names EEA and UK country codes. Belt-and-suspenders that ensures correct Consent Mode v2 behaviour in GTM's consent validation.
Without this, GTM will fire tags before consent is established, which is a GDPR violation.
The code
Paste this before your GTM <script> snippet, directly in <head>:
// Consent Mode v2 - default-deny baseline
// Paste BEFORE the GTM snippet. Must run before any tags fire.
window.dataLayer = window.dataLayer || [];
function gtag() {
window.dataLayer.push(arguments);
}
// 1. Global default - covers every region not explicitly listed
gtag('consent', 'default', {
ad_storage: 'denied',
analytics_storage: 'denied',
ad_user_data: 'denied',
ad_personalization: 'denied',
wait_for_update: 2000,
});
// 2. EEA / UK explicit - ensures correct CM2 behaviour for regulated regions
gtag('consent', 'default', {
ad_storage: 'denied',
analytics_storage: 'denied',
ad_user_data: 'denied',
ad_personalization: 'denied',
region: [
'AT',
'BE',
'BG',
'HR',
'CY',
'CZ',
'DK',
'EE',
'FI',
'FR',
'DE',
'GR',
'HU',
'IS',
'IE',
'IT',
'LV',
'LI',
'LT',
'LU',
'MT',
'NL',
'NO',
'PL',
'PT',
'RO',
'SK',
'SI',
'ES',
'SE',
'GB',
],
wait_for_update: 2000,
});Why two calls
GTM's Consent Mode processing requires an explicit region-specific call for the EEA and UK. A single global default call is not sufficient on its own. GTM will still trigger certain built-in consent checks based on the visitor's detected region. The double-call pattern satisfies both the global and regional requirements.
wait_for_update
The wait_for_update: 2000 value (milliseconds) tells GTM to hold all consent-gated tags for up to 2 seconds while the CMP loads and fires the gtag('consent','update',...) call. Increase to 3000 on slow connections; do not exceed 4000 or you will delay page performance.
Next step
Pair this with Consent Mode v2 update on banner consent to complete the implementation.
The free GA4 + Consent Mode v2 Starter Container includes a GTM container with this baseline pre-configured.
Free container for this module
GA4 + Consent Mode v2 Starter Container
A pre-built GTM container that implements the Consent Mode v2 default-deny baseline, region-aware EEA/UK settings, and a GA4 Configuration Tag gated on analytics_storage. Drop it into any GTM account and connect your CMP.
Get the container →