Google Consent Mode, Tag Manager and Site Kit: Cookie Rocks documentation

Written for Cookie Rocks 2.9.14, checked on 5 November 2026. The current version is 2.11.2: some details may have changed.

Google Consent Mode is how Google tags (Google Analytics, Google Ads, Tag Manager) learn the visitor’s choice. Without it, they receive no consent signal, and Google Ads and Analytics lose most of their data from Europe.

The Audit finds your Google tags, reads what your current banner sends them, and recommends a mode for your site. A shorter guide: Set up Google Consent Mode.

The Google page of Cookie Rocks Audit: Google tags found, consent signals and recommended mode — Cookie Rocks 2.11.2 · Click to enlarge

Set it up in 3 steps

Open Cookie Rocks, Cookies, and click Scan my pages. The Audit finds your Google tags and reads your Tag Manager container.
Open the Google page. Under Your traffic, answer Google Ads campaigns and Daily visitors, then click Save Changes. I do not know is an answer.
In the settings of your current banner, turn on Google Consent Mode with the mode shown under Recommended for this site. Scan again, then check that Consent signals says Sent.

If you see “None found”. No Google tag was seen yet. Your traffic and Recommended for this site appear only once the scan has found one. Run Scan my pages first.

If you see “Not sent”. Your banner does not send the signals: its Consent Mode is off, or it is not in its free version. Turn it on in your banner, or add Cookie Rocks Pro.

What the Google page shows

The page starts with Google on your site. Each line is something the Audit saw or read:

Each Google tag found by the scan, with what it does before the visitor chooses: Waits for a choice, or Loads before any choice. In that case, Google receives the visitor’s address before any choice.
Consent signals: Sent or Not sent, read in the settings of your current banner, when the Audit recognises it and can read them.
Mode: basic mode or advanced mode, when your banner’s settings say it.
WP Consent API: Active or Not installed. See WP Consent API.
Recommended for this site: basic mode or advanced mode, with the reason. Shown once a Google tag is found.

Basic or advanced mode

Basic mode: Google tags wait for consent. Nothing is sent before the visitor decides.
Advanced mode: Google tags load at once and send signals without cookies until the visitor decides. Google can then estimate part of the missing data. Its legal basis is debated.

The recommendation follows Google’s own thresholds. Advanced mode is recommended only in two cases:

700 ad clicks a week or more: Google Ads estimates conversions above 700 ad clicks over 7 days per country.
2,000 or more daily visitors: Google Analytics needs about 1,000 visitors a day who accept statistics.

In every other case, including I do not know, basic mode is the safe choice.

Messages you may see on the Overview

These points appear under To fix when your pages use a Google tag:

“Google receives no consent signal: Consent Mode is off in …”. Turn it on in your banner.
“Google receives no consent signal: Consent Mode is not in the free version of …”. Your banner’s settings were read: the signals need its paid version, or Cookie Rocks Pro.
“Check that Google tags receive the visitor’s choice: Consent Mode is not in the free version of … (checked on …)”. The Audit could not read your banner’s settings. It only knows that its free version lacks Consent Mode. Check your banner by hand.

When the scan sees on your home page a “denied” signal that comes from another plugin, not from your banner, the Overview does not list a point to fix. Check yourself that the visitor’s choice reaches Google tags afterwards, for example through WP Consent API.

With Cookie Rocks Pro: the details of the signals

With Cookie Rocks Pro

By default, all seven signals start as “denied”, except security_storage. A returning visitor’s choice is sent in the same script, before the first Google tag. Each change of choice is sent at once.
In basic mode, Tag Manager, gtag.js, Google Analytics and Google Ads conversion scripts are held until statistics or marketing is accepted. Their <noscript> fallbacks are removed.
Ad data redaction: “Remove ad click identifiers when marketing is refused”, on by default. URL passthrough: “Pass ad click information through links when marketing is refused”, off until you tick it.
Cookie Rocks Pro sends no region setting to Google. With Rules by country off, which is the default, the same signals apply in every country. With it on, everything starts as “denied”, then follows the rules of the visitor’s country once it is known.

Google Tag Manager

Tools added through Tag Manager do not show in the code of your pages. The Audit reads your public container file instead. No Google account is needed.

On the Cookies page, find the Google Tag Manager line and click Read my Tag Manager. Each container shows the tools it loads, marked Declared or To declare.
If a tool is marked To declare, click Declare what it loads. Their cookies then appear in the cookie policy written by Cookie Rocks.
In Tag Manager, make every tag that is not from Google wait for consent (Meta, LinkedIn, Hotjar and so on). Cookie Rocks cannot hold a tag that runs inside your container.

If you see “Not watched by the scan”. A tool loaded through Tag Manager was not on the pages where the scan watches what loads before the choice. The Audit cannot say whether it waits. Check its trigger in Tag Manager.

How the Audit reads your container

It finds your container ID on the pages it scans, in Site Kit’s Tag Manager settings and in the settings of GTM4WP.
It reads the container at the end of each scan, once a day, and when you click Read my Tag Manager.
It recognises Google Analytics and Google Ads by their tag type. Hotjar, LinkedIn Insight, Microsoft UET and Pinterest are recognised by their Tag Manager template too. Other tools are found by their addresses in the tags.
Paused tags are left out: they do not run.
A tool found in the container for the first time is declared by itself. The News and alerts feed of the Overview says so.

With Cookie Rocks Pro: Tag Manager events

Site Kit by Google

Install and activate WP Consent API: Site Kit reads the visitor’s choice through it. The Overview offers Install WP Consent API when it is missing.
Scan your pages. The Tag Manager container set in Site Kit is read like any other.
On the Google page, check that Consent signals says Sent.

If you see “Site Kit and WooCommerce read the visitor’s choice through WP Consent API, which … does not support”. Your current banner does not pass the choice to WP Consent API. Site Kit then cannot follow it, even with WP Consent API installed.

With Cookie Rocks Pro: Site Kit’s own Consent Mode setting

With Cookie Rocks Pro

When Send consent signals to Google tags (recommended) is chosen, Cookie Rocks Pro sets Google’s consent for Site Kit’s tags too, and holds them in basic mode. Site Kit’s own “Consent Mode” setting (Site Kit, Settings, Admin settings) would set Google’s consent a second time, only for the regions chosen in Site Kit, and would let “functionality” storage start before the visitor chooses.

In that case only, the Overview shows a warning with Turn off this Site Kit setting and See the setting in Site Kit, and the Site Kit card says Set twice. Otherwise the card says Follows the choice.
The button turns off that setting only. Site Kit stays active and measurement continues. Site Kit may then warn that tracking may suffer: it cannot see that Cookie Rocks sends the same signals.
The check of your home page warns when a Google tag loads before Cookie Rocks, or when several tools set Google’s default consent.

Limits

Cookie Rocks is not certified for the IAB Transparency and Consent Framework (TCF). To show personalised Google ads in the EEA, the United Kingdom and Switzerland, Google requires a certified tool. On such a site, use Google’s own consent message or a certified tool.

The Obligations page says so under Google AdSense and other ad networks, when you answer Media with advertising (AdSense…) to What kind of site?

For site owners: Cookie Rocks for Site Kit and Cookie Rocks for Google Tag Manager.

Next step: WP Consent API.

Cookie Rocks helps you find your way through cookie and privacy rules. It does not replace a lawyer’s advice.