Google Tag Manager makes it easy to add tracking tags without touching code — which is exactly why it's also one of the most common places a consent setup silently breaks. The container loads fine, every tag fires, and the one thing missing is a trigger condition nobody remembers to add.
GTM doesn't know about consent unless you tell it, per tag
Installing a CMP doesn't automatically make every tag inside Tag Manager respect it. Most CMPs integrate with GTM one of two ways: pushing consent state into the dataLayer for custom trigger conditions, or (more recently) GTM's own built-in Consent Mode settings per tag. Either way, the gating is opt-in per tag, not a container-wide default. A tag added without that condition — by anyone, at any point — fires unconditionally.
Why this happens even on well-maintained sites
- A new tag gets added by a marketer or agency copying the pattern of an existing tag, but the consent trigger condition doesn't get copied along with it
- A tag is duplicated for A/B testing or a staging version, and the duplicate loses its trigger configuration in the process
- GTM's built-in Consent Mode settings get configured for "new" tags added after a certain date, but older tags were never retroactively updated when the feature was first set up
None of these show an error in GTM's own preview/debug mode in an obviously flagged way — the tag just fires, which is what it's supposed to do when its trigger condition is met. The condition itself being missing isn't something GTM warns you about.
How to actually audit this
GTM's own "Preview" mode is useful but has a blind spot here: it shows you what fires and when, but it's easy to run it in a state where you've already accepted cookies in that browser session, making everything look correctly gated when it isn't. The actual test needs a clean, no-prior-consent state:
- Open an incognito window (guarantees no stored consent)
- Open DevTools → Network tab
- Load the site without clicking anything on the banner
- Every third-party request you see here is a tag that fired without a consent trigger — or whose trigger condition didn't actually block it
The fix
For each tag found firing, check its trigger in GTM: does it reference the CMP's consent dataLayer variable, or GTM's built-in Consent Mode category? If not, add it, following whatever pattern your other correctly-gated tags already use — this is almost always a 2-minute fix per tag once it's actually been found.
Bannerproof runs exactly the clean-incognito-network-check above, automatically, for every scan — catching ungated GTM tags without you needing to dig through the container manually. The first scan is free.
This article is informational, not legal advice. Bannerproof is an independent scanning tool, not a law firm or a data protection authority — see our Terms of Service for details.