Google tags (Google Analytics, Google Ads, Floodlight) follow Google Consent Mode, which the Core GRC tag sets for you. Most other tags don't, so they need a trigger that only fires once the visitor has allowed them.

Core GRC gives you one trigger per consent group. Put each tag on the trigger for its group, and it only runs for visitors who have allowed that group.

The triggers

Trigger Fires when this group is allowed Use it for, for example
Core GRC - Essential granted Essential (COR1). Always allowed. Tags your website needs to work.
Core GRC - Functionality granted Functionality (COR2) Chat widgets, embedded maps and video.
Core GRC - Analytics granted Analytics (COR3) Hotjar, Microsoft Clarity, Matomo.
Core GRC - Personalization granted Personalization (COR4) Personalisation and A/B testing tools.
Core GRC - Advertising granted Advertising (COR5) Meta Pixel, LinkedIn Insight Tag, TikTok Pixel.
Core GRC - Uncategorized granted Uncategorized (COR6) Tags you haven't put in a group yet.

The groups are the cookie categories on your banner in Core GRC. A trigger never fires for a group your banner doesn't have.

How they work

The Core GRC script pushes this event to the data layer:

{
  event: "core_grc_cookie_consent_updated",
  categories: {
    COR1: "granted",
    COR2: "denied",
    COR3: "granted",
    COR4: "denied",
    COR5: "denied",
    COR6: "denied",
    // the same values by name, e.g. analytics: "granted"
  },
  consentStatus: "partial",
  source: "user",
  websiteId: "…"
}

It's pushed:

  • On every page, as soon as the script loads, with the visitor's saved choice. If they haven't chosen yet, it has your region's defaults from Core GRC.
  • Each time the visitor makes or changes a choice, with their new choice.

Each trigger is a Custom Event trigger on core_grc_cookie_consent_updated, with one condition: its group's value is granted. So Core GRC - Advertising granted fires on every page for a visitor who has accepted advertising. For a visitor who hasn't, it fires straight after they accept, on the same page. It never fires for a visitor who rejects advertising.

In regions where you've set a group to on by default (for example, opt-out regions), its trigger fires before the visitor chooses, because that's the consent that applies to them.

Fire each tag once per page

A visitor who changes their choice on a page causes a second push. The trigger fires again if the group is still allowed. To avoid duplicate pixels or page views, set each tag that uses these triggers to fire once per page: open the tag, go to Advanced Settings → Tag firing options, and choose Once per page.

A trigger stops a tag from running on later pages. It can't undo a tag that already ran on the current page. If you need tags to stop straight away when a visitor withdraws, set Reload the page after a choice to When something is turned off in Core GRC's Publish dialog.

Option A: import the ready-made container

The container adds the 6 triggers and the 6 variables they read, in a folder called Core GRC consent triggers. It has no tags and doesn't change any of yours.

  1. Download core-grc-consent-triggers.json. It's also in Core GRC under Install Script → Google Tag Manager, and on GitHub.
  2. In Google Tag Manager, open Admin → Import Container and choose the file.
  3. Choose your workspace, then Merge and Rename conflicting tags, triggers, and variables. Don't choose Overwrite: it replaces your whole container.
  4. Check the preview shows 6 triggers and 6 variables being added, then click Confirm.
  5. Open each tag that isn't from Google. Under Triggering, remove All Pages (or whatever it fires on now) and add the trigger for its group, for example Core GRC - Advertising granted for Meta Pixel.
  6. On the same tags, set Advanced Settings → Tag firing options to Once per page.
  7. Check it works (see Check it's working below), then Submit and Publish.

Delete any triggers you don't need.

The tag template can't include these, because a tag template can't add triggers. That's why this is a separate container file.

Option B: set them up by hand

Set up only the groups you need. For each group:

1. The variable

In Variables → User-Defined Variables → New, choose Data Layer Variable:

  • Name: for example Core GRC - Advertising consent
  • Data Layer Variable Name: categories.COR5 (use the group's code from the table above)
  • Data Layer Version: Version 2

2. The trigger

In Triggers → New, choose Custom Event:

  • Name: for example Core GRC - Advertising granted
  • Event name: core_grc_cookie_consent_updated
  • This trigger fires on: Some Custom Events
  • Condition: Core GRC - Advertising consent equals granted

3. The tags

Put each tag on the trigger instead of All Pages, and set Tag firing options to Once per page, as in Option A.

Check it's working

  1. In Google Tag Manager, click Preview and open your website in a new private window, so the banner shows.
  2. In Tag Assistant, find the core_grc_cookie_consent_updated event. Before you choose, only the triggers for groups that are on by default in your region should have fired. Check the tags under Tags Fired and Tags Not Fired.
  3. Accept only analytics (or another single group) in the preference centre. A new core_grc_cookie_consent_updated event appears, and only that group's tags (and Essential's) fire.
  4. Reload the page. The same tags fire straight away, without the banner.

Troubleshooting

  • No core_grc_cookie_consent_updated event: check the Core GRC tag fires on Consent Initialization - All Pages, and the website is published in Core GRC.
  • The event appears but a trigger doesn't fire: select the event, open Variables, and check the group's variable shows granted. If it's empty, your banner doesn't have that group.
  • A tag fires twice on one page: set its Tag firing options to Once per page.
  • Import added duplicates: you imported twice with Rename conflicting. Delete the renamed copies in the Core GRC consent triggers folder.

For help, contact Core GRC support or open an issue on GitHub.