Google Tag Manager and Consent Mode v2

Shortbread sets Consent Mode v2 before GTM loads, then updates it when the visitor decides. Google tags (GA4, Google Ads, Floodlight) read it automatically. For third-party tags, use the events below as triggers.

Order on the page

<head>
  <script src="https://tryshortbread.com/shortbread.js" data-site="YOUR_SITE_KEY" async></script>
  <!-- GTM container after Shortbread -->
  <script>(function(w,d,s,l,i){…})(window,document,'script','dataLayer','GTM-XXXX');</script>
</head>

Shortbread pushes gtag('consent','default',{…denied…, wait_for_update: 500}) immediately, so even if GTM wins the race, Google tags wait up to half a second for the stored or implied decision.

Signals Shortbread sends

gtag('consent', 'update', {
  analytics_storage:       statistics ? 'granted' : 'denied',
  ad_storage:              marketing  ? 'granted' : 'denied',
  ad_user_data:            marketing  ? 'granted' : 'denied',
  ad_personalization:      marketing  ? 'granted' : 'denied',
  functionality_storage:   preferences ? 'granted' : 'denied',
  personalization_storage: preferences ? 'granted' : 'denied',
  security_storage: 'granted'
});

dataLayer events

| Event | When | |---|---| | shortbread_consent | Every decision, with shortbread_statistics, shortbread_marketing, shortbread_preferences, shortbread_method | | cookie_consent_update | Every decision (Cookiebot-compatible) | | cookie_consent_statistics | Statistics granted | | cookie_consent_marketing | Marketing granted | | cookie_consent_preferences | Preferences granted |

If you migrated from Cookiebot, your existing triggers on cookie_consent_* events keep firing. For new setups, trigger on shortbread_consent with a condition on the matching variable.

Google's additional consent checks

In GTM, open each non-Google tag → Advanced settings → Consent settings and require the matching consent type. Then the tag waits for Shortbread regardless of trigger.