Works with your stack
Cookie consent for GTM Kit
always load is the default
GTM Kit adds your Tag Manager container to every page. By default it loads whatever the visitor chooses. Cookie Rocks holds the container until the visitor agrees, then loads it on the same page.
By GTM Kit ApS · gtmkit.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
GTM Kit
WordPress plugin
- Tested version
- 2.23.1
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 2.23.1 tested
- Active installs
- 30,000+
What GTM Kit adds to your visitors’ browser
Trackers it loads
- Google Tag Manager →Statistics, Marketing1 browser storage key
- Google Analytics / Google Ads (gtag.js) →Statistics, Marketing1 browser storage key
Also from your server Only with its Google tag gateway option (off by default): relays browser requests through the server. A banner holds what runs in the visitor’s browser. What GTM Kit sends from your server is set in GTM Kit itself.
What matters for consent with GTM Kit
It loads whatever the choice
Out of the box GTM Kit loads the Google Tag Manager container on every page. Its stricter blocking mode only reacts to its own consent function, not to a plain Consent Mode update from a banner.
Held until the choice
Cookie Rocks holds the container before the choice and loads it after Accept all, without a reload. GTM Kit set no cookie of its own on that page.
A second set of defaults
GTM Kit can set its own Consent Mode defaults, off by default. When on, it may add them even if your banner already set some. Keep one source of defaults: your consent plugin.
Server options to check
Two options are off by default and work from your server. One sets a long-lived cookie from the first page, which no banner can hold. The other serves Google’s loader from your own site address.
Cookie Rocks with GTM Kit
- Holds the scripts it adds to your pages, such as tags, pixels or a chat, until the visitor consents. In advanced Consent Mode, Google’s tags load with consent denied instead.
What our tests found on GTM Kit
Good to know · GTM KitGTM Kit free loads only the Google Tag Manager container
The container is one inline script. Its other scripts are local and made no third-party request in the test.
Seen in our tests, 18 October 2026, GTM Kit 2.22.0.
Full detail
GTM Kit (free) loads one third-party service in the browser: the GTM container, printed as one inline script with the id gtmkit-container-js-after. Its other scripts (gtmkit settings, data layer, engagement-events.js) are local and made no third-party request in the test.
Good to know · GTM KitCookie Rocks holds the GTM Kit container until Accept all
On a test WordPress with GTM Kit 2.22.0 and a dummy container ID, Cookie Rocks holds gtm.js before the choice and loads it after Accept all, without a reload. GTM Kit set no cookie or browser storage of its own on that page.
Seen in our tests, 17 October 2026, GTM Kit 2.22.0.
Depends on a setting · GTM KitGTM Kit's default consent setting can add a second default
setting “Default Consent State (gcm_default_settings)” · by default: off
Off by default. When on, it denies seven categories unless window.gtag already exists; a banner that keeps its own function elsewhere does not stop it. The free version ignores WP Consent API.
Read in its code, 16 October 2026, GTM Kit 2.22.0.
Full detail
GTM Kit sets Consent Mode defaults only when its Default Consent State setting is on (off by default): seven categories, denied by default, wait_for_update 500, optional regions, and only if window.gtag does not exist yet. A banner that keeps its gtag function out of window.gtag does not stop this second default. The free version does not read WP Consent API (a source priority is reserved for Premium).
Sent from your server · GTM KitGTM Kit sets no tracking cookie by default, but some options do
setting “sgtm_cookie_keeper, google_tag_gateway” · by default: off
- Stape Cookie Keeper: _sbp for 2 years from the first page, set by the server.
- After a login or sign-up: gtmkit_engagement_event for 300 seconds.
- Google tag gateway (off by default): the loader comes from the site, not googletagmanager.com.
Read in its code, 16 October 2026, GTM Kit 2.22.0.
Full detail
GTM Kit sets no tracking cookie by default. With Stape Cookie Keeper on, PHP sets _sbp for 2 years on the root domain from the first page; after a login or sign-up it sets gtmkit_engagement_event for 300 seconds. With its Google tag gateway (off by default) the loader comes from /wp-content/plugins/gtm-kit/gtg/measurement.php, relayed by the server, with no googletagmanager.com in the address. Its scripts carry data-cfasync="false" and data-nowprocket.
Depends on a setting · GTM KitGTM Kit loads Tag Manager whatever the choice by default
setting “consent_gating_mode” · by default: always_load
Its strong block mode holds the container, but only GTM Kit's own consent call releases it, and only when its own defaults are on. A banner's ordinary consent update does not.
Read in its code, 16 October 2026, GTM Kit 2.22.0.
Full detail
GTM Kit's script gating mode is always_load by default: the container loads whatever the choice. In strong_block mode the container is written as type="text/plain" with data-gtmkit-gated="1" and is released only by window.gtmkit.consent.update() with analytics_storage and ad_storage granted, a function that exists only when GTM Kit's own defaults are on; a banner's plain gtag('consent','update') does not release it.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- GTM Kit 2.23.1, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Its own tags, set with a test ID, do not load before the choice and load after “Accept all”.
- Settings of the test: GTM container ID (test value).
- Last run: GTM Kit 2.23.1 on 7 November 2026, with WordPress 7.1.3.
Other plugins of the same kind.
Questions
Should I use the strict blocking mode?
Only if GTM Kit’s own defaults are on, since that mode waits for GTM Kit’s own consent function. With Cookie Rocks holding the container, the default mode is enough.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For GTM Kit users
Keep GTM Kit, hold the container.
gtm kit stays on
Every feature of the complete plugin for 30 days, no card. GTM Kit keeps working as it does today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.