Key takeaways.
- Check the default state for Google's four consent signals before other tags use consent.
- Test both a new visit and a returning visitor, then check the update after each banner choice.
- Use Tag Assistant to inspect which tags fired or were blocked; that check does not certify legal compliance.
Summarise with AI
Where I started.
I built a custom cookie banner for a Webflow site and spent far longer than I expected working out why the tags behaved differently for new and returning visitors. The four Google Consent Mode v2 signals I was watching were ad_storage, analytics_storage, ad_user_data and ad_personalization.
In this setup I placed the default consent state before the Google Tag Manager container. The important thing to test is the sequence: Google says the default should be set before tags or other code use consent. Its Tag Assistant troubleshooting guide shows how to inspect the earliest Consent event and the state of all four signals.
The returning visitor problem.
One discovery saved me hours of debugging. A visitor who had already made a choice was coming back, but the saved preference and the container were not lining up the way I expected on the first pageview.
I read the saved choice from localStorage and applied it in the page's consent setup. A fresh visit and a return visit need separate checks; a saved value by itself does not prove the tags saw the right state. I look at what Tag Assistant shows for the first consent event and what each tag did.
What happened when a choice changed.
My next sticking point was a preference change during a session. In my setup, some tags I expected to run did not run when the visitor changed their choice. I added a custom consent_refresh event to the banner workflow and used it for the relevant GTM triggers.
That event addressed the way my triggers were arranged; another site might need a different setup. The check is to try both granting and denying consent, inspect the most recent Consent event in Tag Assistant and look at which tags fired or were blocked. Google's guide recommends checking the update and tag behaviour rather than assuming a banner click has done everything.
Checking tags one by one.
GTM's Consent Overview helped me find tags that deserved another look. I checked the consent types each tag uses, any additional consent requirements configured for that tag and the trigger that could run it. A Google tag and a third-party Custom HTML tag may need different checks; I would not add the same additional-consent setting to every tag by default.
I chose a custom banner because I wanted control over its design and logic. That also meant owning the testing and maintenance. If you use a consent platform instead, check how it sets defaults and sends updates, and still test the result on the actual site.
What I took away.
Working through the default state, a returning visit and a changed choice gave me a much clearer picture of my setup. Tag Assistant was useful because I could inspect the sequence and tag behaviour rather than guess from the banner alone.
Those technical checks do not establish GDPR compliance. The site's scripts, cookies, notices and legal requirements need their own review, especially when a custom banner changes. Our SEO and PPC work includes checking what the measurement can actually support.
