Install through Google Tag Manager

The tag belongs in your page's <head> whenever you can put it there, because Shortbread sends Consent Mode's "denied" defaults the moment it runs. When Tag Manager is the only thing you can edit, this works too.

1. In your container, open Tags → New.
2. Choose Custom HTML and paste:

<script src="https://tryshortbread.com/shortbread.js" data-site="YOUR_SITE_KEY" async></script>

3. Under Triggering, pick Consent Initialization - All Pages. GTM runs this trigger before every other tag.
4. Name the tag "Shortbread", save, and Submit the container.
5. In Shortbread, click Verify my site. The verifier reads the rendered page, so it finds the tag even though GTM injected it.

Gating your other tags

Nothing else to block by hand. Every other tag in the container waits for Shortbread's Consent Mode update, and you can add a Consent condition to any tag under Consent Settings. The Tag Manager guide covers the dataLayer events and the Cookiebot-compatible ones.