Cookie consent implementation, from CMP selection to the signals your tags read.

What this covers

The banner is the visible part and the smallest part. The work is the mapping underneath it and the evidence that every tag obeys it.

What the build has to handle in the United States. The driver is state privacy law: California under the CCPA as amended by the CPRA, and the state laws that followed. In a container that comes down to an opt-out of the sale of personal information, and of sharing it for targeted advertising, plus the Global Privacy Control browser signal handled as an opt-out with no click involved. Which of those apply to you is a question for your counsel. This is measurement work and not legal advice.

What an opt-out does at the vendor. A US opt-out is not the same instruction as a European denial. Google’s tags take a restricted data processing flag and Meta’s take a limited data use flag, each set per event from the state the visitor is in. Which flag fires on which signal goes in the mapping table with everything else, so an opt-out changes what a vendor may do with the event rather than only what the container sends.

Consent Mode v2 where it applies. Consent Mode v2 is Google’s requirement for EEA and UK traffic. It is not a US legal requirement. Plenty of US stores have European visitors anyway, so most builds carry both models at once through region rules rather than one global behavior. A permissive default in the wrong market and a denied default across your US audience are both expensive, which is why each region rule is exercised on its own rather than inferred from the default one.

Choosing the platform. Selection is a technical decision made against your stack. Whether it can express all four of the signals Google’s tags read, or only the two that predate v2. Whether it holds different rules per region from one install. Whether it exposes the stored choice to your own code. Whether it reads Global Privacy Control, and whether it records consent in a form you can retrieve later. If you already license a platform, the same questions get put to it before anything is rebuilt around it.

Mapping categories to the signals that decide behavior. Consent Mode carries more types than most builds use. Four decide what Google’s ads and analytics tags do: analytics_storage, ad_storage, ad_user_data and ad_personalization. The deliverable is a table: every CMP category against those four, with the regional variant on each row and the vendor-side flag where one applies, signed off before anything is built. All four signals carry in both the default and the update, including on the templates that ship with only the first two wired.

Default before update. The default consent call goes on the trigger that runs ahead of everything else, and the update is wired to send the stored choice on every page load rather than only on the click that first set it. Both are ordering problems, and ordering is the one thing a CMP dashboard cannot show you, so it is read off the network timeline instead.

Every tag gated, not only the Google ones. A Custom HTML tag with no consent requirement, a pixel hardcoded into a theme, and a server-side forward that never checks the state all sit outside the mechanism. They get brought into the container or gated where they live, and the inventory that says which is which is built before any gating starts.

Basic or advanced, decided before the build. Advanced keeps the Google tag loading for a visitor who declines. Basic does not, and the choice changes what goes in the container, so it is settled at scoping with your counsel’s position in hand rather than discovered in testing. Where advanced is chosen, the build confirms the cookieless ping actually leaves on a declined load. Whether modeling then returns anything is a function of your own volumes, so nothing here is scoped on the assumption that it will.

How it runs

Scoping call, then a fixed-price quote. The call establishes which platform you run or want, which markets you serve, and what is on your pages today.

A consent map before a single tag moves. Every vendor on the page, the category it belongs to, the signals that category sets, the vendor flag it drives, and where the regional rule differs.

Built in a separate GTM workspace, tested against the live site, never in your published container.

Tested state by state. The three states, the returning visitor, and the whole set again throttled. Then the two passes that decide whether a US build is real: a session with Global Privacy Control switched on, followed through to the vendor flag rather than stopping at the container, and each region rule exercised on its own.

Published with your approval, as one named version that can be reverted in a single action.

Re-verified after CMP template updates, which is where working implementations quietly break. It hands over as a written instruction, or gets picked up under ongoing maintenance.

What you get

A CMP installed and configured. Or the one you already license, rewired to the mapping.

The category to signal mapping written down. Region rules included, as the document the build was signed off against.

Default and update calls in the right order. All four signals present in both.

Every tag in the container carrying a consent requirement. Hardcoded pixels either moved in or gated where they sit.

Global Privacy Control handled as an opt-out signal. Read and acted on rather than read and ignored.

Vendor-side opt-out flags set from the consent state. An opt-out reaches Google and Meta as an instruction rather than stopping at the tag.

Consent state carried to any server-side forwarding. Enforced there, not merely declared.

Evidence for each state. What fired and what did not, before and after, on live loads.

A recorded walkthrough and documentation. Written so your developer can maintain it.

When this is the wrong fit

You want an opinion rather than an implementation. Whether your banner meets a given standard, which categories you must offer, how your policy should read: those belong with your counsel.

You want the banner tuned for a higher accept rate. Consent design and consent engineering are different jobs. This is the second one.

Nobody will own the vendor inventory. A consent build is exactly as accurate as the list of what runs on your pages. If nobody keeps it current, the mapping goes stale the next time someone installs a marketing tool.

You are expecting the numbers to come back. A correct implementation stops the losses that were faults. It does not turn a refusal into data.

If you already know which platform you want and what has to be gated, a scoping call is enough to quote the build. If nobody can say what the tags currently do in each state, the Missing Conversions Audit is the cheaper way in, and the $900 is credited in full against the build.