Cookie consent for Google tag and Tag Manager plugins

In basic Consent Mode, the Cookie Rocks default, the Google tag added by Google Analytics for WooCommerce is held until consent; after Accept all, _ga and _ga_<ID> are set, alongside WooCommerce's sbjs_ attribution cookies. The plugin sends nothing from the server.

GTM4WP's Google Consent Mode option is off by default. When on, it prints gtag('consent','default') before the container with all seven signals denied except those ticked, with no region and no wait_for_update. It never sends an update after the choice: that is left to the consent plugin. The filter gtm4wp_consent_mode_default_enabled (false) removes this default, and gtm4wp_overwrite_consent_mode_flag changes one signal.

GTM4WP always loads the Tag Manager container (gtm.js from www.googletagmanager.com or a custom domain) in the head of every page once a container ID is set: wp_head priority 10 (2 with its load-early option), after its data layer block at priority 1. It has no wait-for-consent setting and does not read WP Consent API. Its inline blocks carry data-cfasync="false" and data-pagespeed-no-defer.

GTM4WP's media events options are off by default. When on, the player SDKs (YouTube iframe_api, Vimeo, SoundCloud, Wistia, Twitch, Dailymotion and others) are requested by JavaScript only when the provider's iframe is found by its src address, so a banner that moves src to data-src or shows a placeholder prevents the request. The filter gtm4wp_media_sdk_blocked (true) holds all SDK requests, and the gtm4wp-media-gate script can be blocked.

GTM4WP's WooCommerce integration writes small first-party values only after an action: gtm4wp_item_list_attr (cookie, 3 days, when a product is clicked in a list), gtm4wp_orderid_tracked (localStorage on the order received page, or a 365-day cookie if localStorage is unavailable) and gtm4wp_readded_to_cart (localStorage). Its cache-safe data layer option (off by default) adds gtm4wp_woo_event (2 days), gtm4wp_login (logged-in users) and sessionStorage gtm4wp_visitor_session.

GTM Kit sets Consent Mode defaults only when its Default Consent State setting is on (off by default): seven categories, denied by default, wait_for_update 500, optional regions, and only if window.gtag does not exist yet. A banner that keeps its gtag function out of window.gtag does not stop this second default. The free version does not read WP Consent API (a source priority is reserved for Premium).

GTM Kit sets no tracking cookie by default. With Stape Cookie Keeper on, PHP sets _sbp for 2 years on the root domain from the first page; after a login or sign-up it sets gtmkit_engagement_event for 300 seconds. With its Google tag gateway (off by default) the loader comes from /wp-content/plugins/gtm-kit/gtg/measurement.php, relayed by the server, with no googletagmanager.com in the address. Its scripts carry data-cfasync="false" and data-nowprocket.

GTM Kit's script gating mode is always_load by default: the container loads whatever the choice. In strong_block mode the container is written as type="text/plain" with data-gtmkit-gated="1" and is released only by window.gtmkit.consent.update() with analytics_storage and ad_storage granted, a function that exists only when GTM Kit's own defaults are on; a banner's plain gtag('consent','update') does not release it.

In GA Google Analytics' gtag (GA4) mode, the display advertising, link attribution, IP anonymization and force SSL boxes have no effect; they apply only to the Universal and legacy codes. Its option to hide tracking from logged-in users only covers the administrator role.

GA Google Analytics prints gtag.js and its inline config directly in wp_head (or wp_footer), without a script handle or any data-cfasync or no-optimize attribute. It sets no Consent Mode default, does not use WP Consent API and sets no cookie itself; the only way to add a consent default is its custom code field, printed after the async gtag.js tag. Its attribute filters escape quotes with esc_attr, so they cannot add type="text/plain".

MonsterInsights tracks outbound links, downloads (doc, pdf, ppt, zip, xls, docx, pptx, xlsx), mailto, tel and /go/ or /recommend/ links by default through the same tag. On a tracked click its script writes a temporary _gd<timestamp> cookie and deletes it at once to find the root domain. gaOptout() sets ga-disable-<G-ID> until 2099. IP anonymization is off by default and has no effect with GA4.

With the Pretty Links plugin, MonsterInsights reports each short-link redirect to Google Analytics from the server (Measurement Protocol), with ad_personalization set to GRANTED by default and a client ID taken from the _ga cookie or generated. A cookie banner cannot block it.

MonsterInsights (free) prints gtag.js directly in the head at wp_head priority 6, without a script handle, followed by an inline config script; it sets no Consent Mode default and does not read WP Consent API. All its tags carry data-cfasync="false" and data-wpfc-render="false". Logged-in administrators and editors get no tag by default. Its admin consent check recognises only a fixed list of four consent plugins, so it may suggest installing another one while a consent plugin is active.

ExactMetrics tracks outbound links, downloads (doc, pdf, ppt, zip, xls, docx, pptx, xlsx), mailto, tel and /go/ or /recommend/ links by default through the same tag. On a tracked click its script writes a temporary _gd<timestamp> cookie and deletes it at once to find the root domain. gaOptout() sets ga-disable-<G-ID> until 2099. IP anonymization is off by default and has no effect with GA4.

With the Pretty Links plugin, ExactMetrics reports each short-link redirect to Google Analytics from the server (Measurement Protocol), with ad_personalization set to GRANTED by default and a client ID taken from the _ga cookie or generated. A cookie banner cannot block it.

ExactMetrics (free) prints gtag.js directly in the head at wp_head priority 6, without a script handle, followed by an inline config script; it sets no Consent Mode default and does not read WP Consent API. All its tags carry data-cfasync="false" and data-wpfc-render="false". Logged-in administrators and editors get no tag by default. Its admin consent check recognises only a fixed list of four consent plugins, so it may suggest installing another one while a consent plugin is active.

Google Analytics for WooCommerce prints its own gtag('consent','default') before gtag.js: analytics_storage, ad_storage, ad_user_data and ad_personalization denied, wait_for_update 500, limited to 32 regions (EU, EEA, UK, Switzerland). Elsewhere it sets no default, so Google treats storage as granted. Its inline script declares a global function gtag(), replacing any existing one. Returning an empty array from the woocommerce_ga_gtag_consent_modes filter removes its defaults. gtag.js loads on every public page for non-admin visitors once an ID is entered; administrators are never tracked.

In Google Analytics for WooCommerce, allow_google_signals follows the display advertising setting, which is on by default, so Google signals (advertising features) are enabled unless turned off. A gaOptout() function writing ga-disable-<ID> until 2099 exists but runs only if the site calls it. The plugin's code contains no sbjs_ cookie: those come from WooCommerce order attribution.

Google Analytics for WooCommerce reads WP Consent API in the browser from main.js, loaded in the footer: statistics drives analytics_storage, marketing drives ad_storage, ad_user_data and ad_personalization, sent with gtag('consent','update') at load and on each wp_listen_for_consent_change. If no consent type is declared it sets window.wp_consent_type = 'optin'. Between the head config and main.js, gtag.js runs with the plugin's defaults. Its WP Consent API registration filter names includes/class-wc-google-analytics.php instead of the main plugin file.

With Google for WooCommerce's enhanced conversions on (off by default), every page of a known customer's session prints gtag('set','user_data') with the email, first name, last name and phone hashed (SHA-256), but the street, city, region, postal code and country in clear text in the HTML.

When WP Consent API is present and Google Analytics for WooCommerce is not, Google for WooCommerce loads wp-consent-api.js, which reads the WP Consent API statistics and marketing cookies and sends gtag('consent','update') at DOMContentLoaded (statistics to analytics_storage; marketing to ad_storage, ad_user_data, ad_personalization), and listens for wp_listen_for_consent_change. It sets wp_consent_type to optin if empty and does not register with WP Consent API.