Google Tag Manager

Google Tag Manager (GTM) is a tag management system (TMS) that manages the execution of tags, which are snippets of code that execute based on events that occur while your experience runs for end users.

Over 90% of businesses have Google Tag Manager installed on their websites to offer personalized marketing experiences to their customers.

GTM is the recommended deployment path for DataGrail Consent :

• Deploy DataGrail's Consent Banner and configuration to your website without any code.
• Control consent preferences for tracking services deployed as GTM tags. Tags are automatically synced to DataGrail for easy classification and proactive notification of new services.

Consider Using Google Tag Manager if You Are Not Already

Even outside DataGrail, adopting GTM is a widely accepted web development best practice because it centralizes tracking services, simplifies audits, and supports stronger compliance.

If you are not using GTM yet, implementing it early reduces future migration effort. Whenever possible, deploy all tracking scripts through GTM. With the DataGrail integration, GTM tags are automatically imported, kept in sync, and surfaced for classification; new tags in GTM trigger updates in DataGrail for review.

Key Concepts

Understanding the following key concepts will help make your Consent implementation easy.

Term	Definition
Script	Any client‑side JavaScript resource that can set cookies, call external services, or perform tracking.
Tag	A discrete tracking unit (often in Google Tag Manager) that loads a script or pixel
Inline Script	Tracking or functional code placed directly in page source outside a tag manager
Cookie	Small text file stored on your computer by a website to remember information about your visit or facilitate tracking
Container	The deployment wrapper that serves DataGrail consent.js and applies published consent rules (e.g. a GTM container or embedded snippet).
Publish	Action that deploys the latest consent configuration (script categorization, policy configuration, banner settings, etc.) to the selected container.

Prerequisites

• You have a Google Tag Manager account setup and connected to your website.
• You must have publish permissions in your Google Tag Manager environment.
• Relevant containers have at least one published and live version available.
• You have the Consent Management Admin or Consent Management Edit role in DataGrail. The Connections Manager role is also required to establish the connection to Google Tag Manager.

Connect Google Tag Manager

When your DataGrail environment is enabled to use DataGrail Consent, the first step prompts you to connect the Google Tag Manager Integration.

If you are already using Consent, navigate to Integrations in the left-hand sidebar and select Configure New Integration.

1. Select Add Google Tag Manager or Configure.
2. Enter a name for the Integration, select Login to Configure, and then Sign in with Google.
3. Select the appropriate Google account.
4. Select Allow to grant DataGrail the necessary permissions for the connection.

Configure Containers

A container represents a unique destination (website) where DataGrail's Consent code will be deployed.

If you are just getting started with Consent, you will immediately be prompted to select the GTM containers you wish to manage.

If you are an existing Consent User, navigate to Consent Management, Settings, Containers, and select Add a Container.

Added containers are immediately available to deploy DataGrail Consent. Tags within added containers will be synced to DataGrail, if you wish to manage them with Consent.

Configure DataGrail Consent on a Staging Site

Implementing a Consent Management Solution is a major change on your website. Consent interacts with your other third-party scripts and cookies, so we always recommend configuring and testing DataGrail on a staging site before doing so on your production one. If you do not have a staging site, ensure you read the Test Mode Documentation.

Categorize GTM Tags

With GTM integrated and your tags synced, you must categorize all tracking services on your site, otherwise known as purposes.

By assigning every GTM tag a category, you ensure only those aligned with a user's banner selections are activated.

To categorize your GTM tags:

1. Navigate to the Tracking Services section of the Consent Management page.
2. For each uncategorized service (highlighted in yellow), select the relevant category from the dropdown.
3. Optionally, use Google Consent Mode to manage Google-owned tracking services, like Ads and Analytics.
4. Publish changes to your connected containers.

Automatic Classification of Trackers

When you connect Google Tag Manager to DataGrail Consent, we auto-classify some tags based on our internal models.

Categorize Additional Services

While we recommend bringing all tracking scripts in to GTM, DataGrail can additionally manage a wide range of tracking services implemented through other mechanisms on your site.

• Inline Scripts
• Cookies
• Facebook Pixels
• Shopify Tracking Services
• Webflow Tracking Services
• Custom Services Through Callback Functions

Scripts vs. Cookies

Prioritize managing trackers at the script level first. Scripts are the source that load or set most cookies; if you block a tracking script until consent is granted, its downstream cookies and network calls never occur.

After all scripts are audited, categorized, and gated by consent, perform a secondary review to identify any residual cookies that were not set from scripts. This top‑down approach reduces compliance risk and simplifies maintenance versus chasing individual cookies.

Script Identification

While your tracking scripts should be deployed through Google Tag Manager, it's critical to identify any additional scripts that may be running on the page to ensure complete compliance.

The DataGrail Privacy Inspector is a Google Chrome extension for your organization to review the trackers running on your website that may be selling or sharing information with third parties.

The Privacy Inspector is the best way to find tracking scripts that run outside Google Tag Manager. If a script does not appear as a GTM tag, it is likely being loaded inline from your site's source.

For each script you discover that is not in GTM (or if you do not use GTM):

1. Move it into GTM whenever possible (preferred for centralized control and easier auditing).
2. If it must remain inline, manage it with DataGrail's ScriptControl Plugin.

Script Classification

By assigning every script, tag, cookie, and tracking service to a category, you ensure only those aligned with a user's banner selections are activated.

To categorize your tracking services:

1. Set up and connect all relevant tracking services.
2. Navigate to the Tracking Services section of the Consent Management page.
3. For each uncategorized service (highlighted in yellow), select the relevant category from the dropdown.
4. Publish changes to your connected containers.

Automatic Classification of Trackers

When you connect Google Tag Manager to DataGrail Consent, we auto-classify some tags based on our internal models.

Default Categories

DataGrail offers four default categories based on the purposes as defined by the GDPR, but you can rename or relabel these when customizing your banner.

Functional

Helps improve the website’s ease of use via performance and functionality for data subjects. Functional services/cookies store code on your device and/or browser that allows a website to remember selections that you have made during previous visits and how you interact with them on the website.

Example: Services use code to remember language settings or a username and password to an account on that website. The website would still load if you did not have these services running.

Marketing

Services/cookies, usually third-party, which store code on your device and/or browser that allows a website to track visitors’ web activity, creating a profile used for targeted advertising. These services, unlike similar analytics services, are used for online marketing by collecting information about data subjects to channel partners for extra revenue and a targeted ad experience.

Example: Services that use code to remember things a data subject has viewed or clicked on when browsing the website. This information is then passed to other organizations or used internally to market other-like products or services to the data subject. The website would still load if you did not have these services running.

Performance

Similar to Marketing and Functional Services. Analytics, is an optional category that organizations are utilizing in attempts to maintain business intelligence to improve the website function and UX by looking into general trends of how people use the website, and not how a user interacts with the website or to market to them.

Example: Volume of traffic on a website throughout the week, how long data subjects browse certain pages, and which parts of the website they frequent. The website would still load if you did not have these services running.

Essentials

Allows the loading and ability for data subjects to interact with websites. Essential services are automatically loaded when data subjects access a website and use its features and functionality. These services are only used to send the data online and are strictly necessary to make a website operational.

Example: Services that are utilized to allow a website to be loaded and navigated by data subjects. They serve no other functions and without them the website would not load.

Cookie Identification & Classification

After categorizing all scripts, review any cookies that do not originate from those managed scripts.

DataGrail automatically scans environments where consent is deployed to discover first‑party cookies. Each entry shows the first date seen and a total observation count to help determine relevance. Low counts often indicate a cookie set by a browser extension or a user customization and it is usually out of scope for consent management.

Learn more about managing cookies in DataGrail!

Third-Party Cookies Cannot Be Scanned and Managed

Third‑party cookies (set on domains you do not control) cannot be discovered or blocked directly by any consent management solution. Control them by gating or removing the scripts or pixels that create them.

Configure Policies & Plugins

Consent Policies determine which consent categories are enabled on initial page load and whether the banner appears, based on the visitor’s automatically-detected location.

DataGrail provides a set of default policies for major global privacy regulations. Review and adjust these settings before launch to ensure they reflect your organization’s privacy posture.

Learn more about Consent Policies!

Subdomain Sharing

In the Plugins page under Consent Management Settings, DataGrail provides the option to store and apply visitor's consent preferences across your primary domain and subdomains wherever DataGrail Consent is published.

Customize The Banner

With your tracking services categorized and managed, the last step is configuring consent is to customize the banner to ensure the language/styling matches your brand and privacy posture. You can construct location-specific banner notices that appear on your website to data subjects using the Layouts feature.

Learn more about Layouts!

Advanced Customization Options

If you want to customize the layout to match your brand's design patterns, including using custom fonts and colors, you can follow our CSS Customization Guide. And if you need to localize the banner, you can check out our Localization Guide.

Publish & Test

In order to deploy or "go live" with DataGrail's Consent banner and configuration, you must publish your changes from within the app to your site.

All changes made in the DataGrail app require a publish action to take effect on your site. Consent policy updates, banner styling changes, script classifications, etc. must always be published to relevant containers.

When publishing, DataGrail will create a tag ("Consent Banner Tag Template") within your container that includes the JavaScript code that powers DataGrail Consent, including the configurations necessary to set the appropriate Consent behavior based on the user's location and where that maps to the policies defined in the settings page.

To publish to a Google Tag Manager container:

1. Select Review and Update in the upper-right of the page.
2. You'll see two options for reviewing and updating your container(s):
   • Create and publish: Pushes DataGrail Consent's banner software (consent.js) and all necessary configurations to control GTM tags as a new, published and live container version. This means sites with the corresponding GTM container code installed will have DataGrail consent live for all visitors to the site.
   • Create version(s): Creates a new GTM container version (with DataGrail Consent consent.js and configuration) for each selected container while leaving the currently published version live on your site. The new version(s) appear in the Versions tab for review and testing before you publish them.
3. Complete the publishing process and monitor the status from within the Review and Update window.

Once your first publish is complete on a staging site or site in test mode, you can follow this guide to validate a successful implementation.

Always Deploy to a Staging Site or Test Mode Site First

Implementing a Consent Management Solution is a major change on your website. Consent interacts with your other third-party scripts and cookies, so we always recommend publishing DataGrail on a staging site before doing so on your production one. If you do not have a staging site, ensure you read the Test Mode Documentation.

Footer Links

As a best practice, you may want to include a footer link that reopens the consent banner so users can make or update their selection after it’s closed or if it doesn’t appear by default.

The California Attorney General has developed a recognizable and uniform opt-out icon that businesses can use on their website.

Example Implementation:

<a href="#" onclick="window.DG_BANNER_API.showConsentBanner();">My Privacy Choices <img width="30" height="17" src="path/to/icon" style="display:inline-block; vertical-align:middle; margin-left:.25rem; margin-bottom:.2rem;" ></a>

Marketing Impact

Implementing a Consent Management Platform for the first time introduces deliberate controls that prevent certain scripts, tags, and cookies from loading until appropriate preferences are established.

This typically creates an immediate, visible shift in familiar marketing and analytics metrics.

What To Expect

• Fewer total events (pageviews, sessions, conversions) in analytics tools when region policies require prior consent
• Lower remarketing audience sizes until users provide choices
• Attribution model volatility (channel mix may appear to change temporarily)
• Delays in firing of pixels that previously executed earlier in the page lifecycle

Previously, certain tracking services may have run despite a consent choice, or region-specific defaults were not respected. In some cases, a Consent Management Platform may not have been implemented at all.

After Consent implementation, tracker execution is controlled by the Consent Policy’s region‑specific defaults (including whether signals like GPC are honored) or explicit user choice.

Troubleshooting

Sometimes there can be issues with permissions or container configurations that interfere with DataGrail's ability to create managed container versions within your Google Tag Manager account.

Why don't I see my container in DataGrail?

In order to be eligible for management in DataGrail, your container must be accessible to the Google User who integrated Tag Manager. The container must also have at least one published and live version.

Why did my publish fail?

After selecting to create or create & publish a container version to the containers selected, you will see the status of the process within DataGrail Consent:

DataGrail Consent creates updates for each container individually, which means you may only have an error at the end of the process on one of the containers. We usually provide the resulting error which can be for the following reasons:

1. The account does not have publish rights for the container. While DataGrail Consent only requires read access to retrieve the tag information from GTM, you must have publish access for DataGrail to create our version updates within the respective containers. You can verify your permissions by container within GTM.
2. The account has reached the limit of workspaces. Workspaces are staging areas to create versions within the container. DataGrail creates a temporary workspace to stage the updates before writing these as a new version. Free/Starter GTM accounts can have up to three workspaces, so be sure to delete extra workspaces that are not required before executing the creation process within DataGrail.
3. API rate limiting. Rarely, DataGrail may not be able to complete the version creation process due to hitting a rate limit with Google. You can try the process again in a few minutes.

Why is the Consent Mode default command executed after other tags?

If you configure DataGrail using our built in publishing flows, we will control the firing order of events within your GTM container as a result.

If you are migrating from an alternative tool or attempted a custom implementation of GTM and Consent Mode, you may see a warning in your browser console if you have tag events firing prior to the default command set by DataGrail Consent:

Consent Mode default command executed after other tags

If you see this warning, please double check your GTM configuration to ensure no additional firing triggers or events are impeding DataGrail's CMP and GTM integration from operating successfully.

Why don't GTM Tags don't reflect the correct consent type?

If tags within GTM are not reflecting the correct consent type behavior as a result of the preferences sent by the data subject, it may be that the region-specific settings capability is not enabled in your server-side container implementation.

You can enable the region specific settings feature in your Server-Side GTM setup using the clients tab and selecting the option to enable region-specific settings. By default, the variable {{Visitor Region}} will be populated, which is what DataGrail Consent needs to apply the correct behavior by region.