GTM fires tags — CookieHug decides which ones are allowed to. Consent Mode v2 signals are set before the container loads, so no tag fires ahead of consent.
The problem
Tags fire faster than visitors click "Accept". Without proper consent defaults, GA4 and Google Ads set cookies before anyone consented — a straight path to GDPR trouble and to failing Google's EEA consent requirements.
The solution
The CookieHug snippet loads before GTM and emits gtag('consent','default') with regional values (denied for the EEA); after the visitor decides, it sends a consent update with signals derived from the chosen categories. GTM and your tags read a ready state from the dataLayer.
The CookieHug script must be the first tag in <head> — before the GTM container and before gtag.js.
CookieHug sets the defaults for you. A second gtag('consent','default') in GTM would overwrite the regional setup.
In each tag's advanced settings, declare the required signals (e.g. ad_storage for Ads). GTM holds the tag until consent is given.
No rewrites — you only add consent requirements in each tag's Consent Settings. The tag configuration itself stays untouched.
Give them required consent signals in Consent Settings just like Google tags — GTM will hold them until consent. On top of that, CookieHug's ScriptBlocker blocks known tracking scripts loaded outside GTM.
Tag Assistant shows consent default on page load and consent update after the decision. A full verification checklist is in our docs.
GDPR- and Consent Mode v2-compliant consent plus an anomaly radar — in a single script.