The Core GRC Cookie Consent tag shows your cookie banner and sets Google Consent Mode from Google Tag Manager. It sets default consent before the visitor chooses, then updates consent with the visitor's choice. Your Google tags (Google Analytics, Google Ads, Floodlight) then follow that choice.

Default consent and consent updates come from your website's Google Consent Mode settings in Core GRC, so you manage them in one place. When you change them and publish, Tag Manager picks up the change automatically, with no changes to the tag.

Before you start

You need:

  • A website set up in Core GRC Cookie Consent, published with your domain added.
  • Its Website ID and Site API key. In Core GRC, open Cookie Consent → Websites, choose your website, then Install Script → Google Tag Manager.
  • Permission to edit and publish your Google Tag Manager container.

1. Add the template

  1. In Google Tag Manager, open Templates.
  2. Under Tag Templates, click Search Gallery.
  3. Search for Core GRC Cookie Consent and click Add to workspace.

2. Create the tag

  1. Open Tags → New → Tag Configuration and choose Core GRC Cookie Consent.
  2. Fill in the fields. They're in four sections: Website, First-visit baseline, Cloudflare and Consent records.
Field What to enter
Website ID From Core GRC (Install Script → Google Tag Manager).
Site API key From the same screen. It lets the banner save consent records, and tells the tag which Core GRC environment your website is in.
First-visit baseline One checkbox per Consent Mode type; ticked means granted. Preset to everything denied except security_storage. Change any of them, security_storage included. See The first-visit baseline.
Warn about Cloudflare Rocket Loader, under Cloudflare Ticked by default. Shows a warning in Preview when Rocket Loader is delaying Tag Manager.
User ID (optional), under Consent records A variable with your logged-in user's ID, to link consent records to your users. It's only sent to Core GRC.

In Core GRC, open Cookie Consent → Geographic targeting, edit a configuration, and turn on Google Consent Mode. For each region you set:

  • The default for each storage type (granted or denied) before the visitor chooses.
  • The category each storage type follows when the visitor chooses.
  • Wait for update, Redact ads data and URL passthrough.

Publish the website after a change. The tag uses the new settings from each visitor's next page view. If Google Consent Mode is off for the website, the tag leaves Consent Mode alone and only shows the banner.

The first-visit baseline

Google needs default consent before any other tag runs. With the tag alone, the Core GRC script loads just after that, so the tag needs your settings saved in the visitor's browser first. The script saves them on every page. Until it has, the tag uses its baseline:

  • On a visitor's first page.
  • On the first page of each subdomain (browser storage isn't shared between subdomains).
  • When the browser blocks storage.

On those pages the script applies your region's defaults from Core GRC as soon as it loads, within the wait-for-update time. Ads data redaction is on until then.

The baseline isn't used when the Core GRC script is in your website's <head> (see below).

3. Add the trigger and publish

  1. Under Triggering, choose Consent Initialization - All Pages. This is the only trigger the tag needs.
  2. Save the tag, then Submit and Publish your container.

Don't add the tag to any other trigger.

How it works

On every page, the tag:

  1. Sets Google Consent Mode defaults from your Core GRC settings (or the baseline), before any other tag runs. Each region gets its own defaults.
  2. Updates Consent Mode with the visitor's saved choice, if they've chosen before, using your category settings. It skips a choice older than your reconsent period, or made before you asked visitors to choose again. On pages where it uses the baseline, the script applies the saved choice instead when it loads.
  3. Loads the Core GRC banner.
  4. Updates Consent Mode each time the visitor accepts, rejects or changes their choice. No extra triggers or events are needed.

It covers all seven Consent Mode types: ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, personalization_storage and security_storage. security_storage is always granted.

Using the tag with the Core GRC script in your website code

You can also add the Core GRC script to your website's <head>, above the Google Tag Manager snippet. Keep the tag in Tag Manager as well. With both:

  • Your Core GRC defaults apply from a visitor's very first page, because the script sets them before Tag Manager starts. The tag's baseline is never used.
  • Automatic Cookie Control can hold scripts that load outside Tag Manager until the visitor consents.
  • The tag doesn't load the script a second time, and still updates Consent Mode with each choice.

With Tag Manager alone, scripts that run before Tag Manager loads can't be held.

Single-page apps and other websites

The tag and the banner work the same on single-page apps (React, Next.js, Vue, Angular, Svelte) and on websites that swap pages without a full reload (Turbo, htmx, Astro view transitions):

  • Consent carries over between routes. The tag runs once per page load, and Tag Manager keeps the consent state for tags that fire on later routes, such as History Change triggers.
  • If your app re-renders or replaces the page body, the banner, preference centre and cookie settings button are put back.
  • Footer links with data-coregrc-preferences open the preference centre even when your app renders them later.
  • Scripts and iframes your routes add later are held until the visitor consents, when Automatic Cookie Control is on.
  • Add the Core GRC script once, in <head>. Don't add it again on each route. If it is added twice, it only starts once.

Other setups:

  • Content Security Policy with a nonce: add your nonce to the Core GRC script tag (<script nonce="…" src="…">). The banner's styles and scripts use the same nonce. Allow https://cdn.core-grc.com in script-src and connect-src.
  • Cloudflare Rocket Loader: Rocket Loader delays scripts, which can let other scripts run before consent. Exclude from Cloudflare Rocket Loader (in the Publish dialog, on by default) adds data-cfasync="false" to the install snippet; if you change it, copy the snippet into your website again. With Tag Manager, add data-cfasync="false" to your Tag Manager <script> snippet too. The tag warns in Preview when it's missing.
  • WordPress and other optimisation plugins: exclude cdn.core-grc.com from "delay JavaScript", "defer" and "combine" settings (for example in WP Rocket, LiteSpeed Cache or Autoptimize), so the script runs before other tags.

Check it's working

  1. In Google Tag Manager, click Preview and open your website.
  2. In Tag Assistant, select the first event and open the Consent tab. On-page Default should show your defaults. In a new private window (a first visit), it shows the baseline; reload and it shows your Core GRC defaults.
  3. Accept or reject cookies on the banner. The next event's On-page Update column should show the new values.
  4. Reload the page. The update should appear straight away, without the banner.

Troubleshooting

  • No banner: check the Website ID and Site API key, and that the website is published in Core GRC with this domain added.
  • The tag fails in Preview: the Website ID field is empty.
  • Consent updates: the tag sends an update only when a value changes, so a returning visitor's saved choice is applied once per page.
  • Defaults don't match Core GRC: publish the website in Core GRC, then load a second page. The first page of a visit uses the baseline.
  • No consent update after a choice: make sure the tag fires on Consent Initialization - All Pages and on no other trigger.
  • Google tags fire before consent: check that your Google tags use Consent Mode. Built-in Google tags do. For other tags, use Advanced Settings → Consent Settings to require the right consent.

For help, contact Core GRC support or open an issue on GitHub.