Before You Start

GA4 consent mode makes Google Analytics respect each visitor's cookie choice, and setting it up on a charity or nonprofit website takes a tag manager and a consent platform. This guide covers a common setup: Google Tag Manager (GTM), GA4 and a consent banner, with CookieYes as the worked example. By the end, analytics and advertising tags wait for consent, Google receives the visitor's choice, and you have tests that show it working.

What Consent Mode V2 is, and whether you need it, is covered in Cookie Consent for Nonprofit Websites. This page is the setup.

What you need before starting:

  • A live site where you can add code to the head and body of every page
  • A GTM account
  • A CookieYes account (the free plan covers one site at 100 pages per scan and 5,000 pageviews a month, with paid plans starting at $10 a month, checked November 2026)
  • Access to your GA4 property
  • A clear list of every third-party tool your site uses that sets cookies or collects data

Two scenarios this guide covers:

Scenario A: analytics only. Your organisation runs no advertising. The setup is CookieYes, GTM and GA4. The advertising signals stay denied and nothing needs them.

Scenario B: analytics plus advertising (GA4 with Meta Pixel and/or LinkedIn Insight Tag). You run or plan to run paid advertising targeting European audiences. Add Step 6.

The law is the same in both. PECR regulation 6, since 5 February 2026, bars storing anything on a visitor's device, or reading anything from it, unless one of the Schedule A1 exceptions applies. Consent Mode is not itself a law: it is how you pass the visitor's choice to Google's tags. If you run Google advertising, Google's EU user consent policy separately requires valid consent from visitors in the EEA, the UK and Switzerland.

Check one thing separately. Built-in platform analytics may not obey your banner. A tracking feature that comes with your website platform may sit outside GTM altogether, so check yours in the platform's documentation.

Step 1: Create Your CookieYes Account and Scan the Site

Create an account at cookieyes.com and add your website domain. CookieYes scans your site for cookies and categorises them automatically. The scan is not exhaustive: it catches most common cookies but will not find everything, particularly cookies set by third-party scripts that load conditionally. Review the results and manually add any cookies you know the site sets.

CookieYes organises cookies into five categories:

  • Necessary. Session cookies, security tokens. Cannot be declined.
  • Functional. Preference cookies, language settings.
  • Analytics. GA4, Microsoft Clarity.
  • Performance. Measurement of the site's key performance indicators.
  • Advertisement. Meta Pixel, LinkedIn Insight Tag, Google Ads.

Confirm every cookie is in the correct category. An analytics cookie miscategorised as Necessary will fire without consent, which is a compliance failure.

Step 2: Style the Banner Without Weakening It

The default layout can stay as it is. Style the buttons to match your brand colours and leave the rest:

  1. Open the Customise section of your CookieYes dashboard and find the button colour settings
  2. Set the Accept button to your primary brand colour, and give Decline the same size, weight and placement rather than a quieter treatment
  3. Set the button text colour for sufficient contrast (WCAG 2.2 AA requires at least 4.5:1 for normal text)
  4. Apply the same logic to the Manage Preferences button

Equal prominence is the constraint here, not a style preference. The ICO's finalised guidance on storage and access technologies says a compliant mechanism "makes it as easy to refuse consent as it is to accept" (ICO, 2026). A brand-coloured Accept next to a greyed-out or text-only Decline fails that test however good it looks. Custom CSS or structural changes risk breaking consent flows, which is not worth it for aesthetic reasons.

CookieYes loads through GTM, using a template, rather than through a separate script on the site. Other consent platforms work the same way where they publish a template: Google lists featured platforms' templates in the Community Template Gallery.

First, if GTM is not already on the site: in GTM, create a container. GTM gives you two snippets, one for the head and one for the body. Add them through the site-wide head and body code settings, then publish the site.

Now install CookieYes via GTM:

  1. In your CookieYes dashboard, go to Advanced Settings and open Get Installation Code
  2. Select Install with Google Tag Manager and copy your website key
  3. In GTM, go to Tags, then New, then Tag Configuration, and search the Community Template Gallery for the CookieYes CMP template
  4. Add the tag and paste in your website key
  5. Set the trigger to Consent Initialization (All Pages), so CookieYes loads before any other tag attempts to fire
  6. In CookieYes's Advanced Settings, confirm Support GCM is on and leave Allow Google tags to fire before consent switched off

That last toggle is the one decision in this step that matters. Off is basic consent mode, where "you prevent Google tags from loading until a user interacts with a consent banner". On is advanced consent mode, where "Google tags load when a user opens the website or app" and send measurements without cookies while consent is denied. The checks later in this guide assume basic mode.

Nothing you configure in GTM is live until the container is published: click Submit, name the version, then click Publish.

Before any other tag fires, GTM needs to establish default consent states, and the default must be denied. PECR regulation 6 bars storing or reading anything on the device unless an exception applies. The statistical purposes exception added in February 2026 expressly does not cover advertising (ICO, 2026), and for analytics it demands aggregate information that cannot identify people, plus a free way to object.

CookieYes sets the defaults inside its own tag, so this needs no second tag. In the CookieYes tag in GTM, under the default consent settings:

  1. Click Add Setting
  2. Choose Disabled for every category that is not strictly necessary
  3. Enter All in the region field
  4. Click Add, save the tag and publish the container

That produces the state in Google's own sample: ad_storage, ad_user_data, ad_personalization and analytics_storage all denied. When a visitor makes a choice, CookieYes passes the update through GTM, so you write no code.

On another platform, the order rule is the same. Google says "the order of the code here is vital": defaults come before anything that sends measurement data. It prefers a template in Tag Manager, and where that is not possible, the default code goes on the page above the GTM snippet.

With consent defaults in place, install GA4 through GTM:

  1. In GTM, create a new tag and choose Google Tag
  2. Enter your GA4 Measurement ID
  3. Set the trigger to All Pages
  4. In the tag's Advanced Settings, open Consent Settings and require analytics_storage for the tag to fire

When analytics_storage is denied, the tag stays held back. When consent is granted, GA4 fires normally. Modelled data is not the automatic backstop it is often described as: Google requires advanced consent mode plus at least 1,000 events a day with analytics_storage denied for seven days, and at least 1,000 daily users with consent granted on 7 of the previous 28 days. A property that does not clear both thresholds gets no modelled data, and in basic consent mode nothing reaches Google when consent is denied, so there is nothing to model from.

Step 6: Hold Back Meta Pixel and LinkedIn Insight Tag (Scenario B Only)

Skip this step if your organisation does not run advertising on Meta or LinkedIn. These are not Google's tags, so GTM's additional consent check is what holds them back.

Meta Pixel: add the base code from Meta Events Manager to a new GTM tag, using a template if your container has one. Trigger it on All Pages and, in Advanced Settings, require ad_storage and ad_user_data.

LinkedIn Insight Tag: add a new tag from its GTM template, enter your LinkedIn Partner ID, trigger it on All Pages and require ad_storage.

Neither tag should fire until the visitor has accepted advertisement cookies.

Verification is not optional. A consent implementation that looks correct but is not blocking tags is worse than no banner at all: it gives the appearance of compliance without the substance.

Test 1: Load the site in an incognito window. Open your browser's developer tools (F12), go to the Network tab and filter by google-analytics.com. Load the page. Before touching the banner, confirm that no GA4 requests appear. If they do, the consent default is not configured correctly.

Test 2: Accept analytics and confirm GA4 fires. Click Accept on the banner and confirm GA4 requests now appear. That shows the consent update is reaching GA4.

Test 3: Read the consent state in Tag Assistant. Google's way to verify consent mode is a Tag Assistant session, which GTM's Preview button opens. Accept all on the banner, then check:

  • The earliest Consent event sets all four signals, shown in a tag's Consent tab under On-page Default
  • The most recent Consent event updates them, under On-page Update
  • The default comes before any tag uses consent
  • Each tag fired or was blocked as its consent settings say

An empty Consent tab means consent mode is not implemented on the page. CookieYes also has its own Check Now button beside Check GCM status, under Advanced Settings.

Test 4: Decline all and confirm nothing fires. Open a fresh incognito window, load the site and click Decline All. Confirm in the Network tab that no analytics or advertising requests appear. If any do, fix the configuration before the site goes live.

Common Problems and How to Fix Them

GA4 fires before consent is given

The defaults are not set to denied, the CookieYes tag is not on Consent Initialization, or the GA4 tag has no consent requirement. Read the actual order in Tag Assistant.

The banner appears but consent choices are not respected

Confirm the CookieYes tag uses the Consent Initialization trigger and that the GTM container has been published since the template was added.

The banner does not appear on the site

The GTM container has not been published since the CookieYes tag was added, or the GTM snippets were not saved on the site. Confirm both, then republish the site.

On Webflow? The platform-specific steps are in Platform Notes.

Next Step

With consent working, check what the regulator expects your site to say: Charity Commission Website Requirements: What UK Charities Must Publish.

Related resources: