Vuzo
Back to blog

When the cookie crumbles: How to Diagnose (and Fix) Consent Mode Issues

Peter

Written by Peter ·

 

TL;DR: After a consent banner change, a steep drop in consented analytics events often points to implementation issues (hybrid CMP remnants, trigger timing, or Consent Mode v2 gaps) rather than user sentiment. This guide shows how to triage and fix the most common pitfalls.

Why this matters

For UK e-commerce and finance teams, reliable consent data is non-negotiable for both measurement and compliance. The ICO expects first-layer banners to make it as easy to Reject All as it is to Accept All, with equal prominence (see the ICO’s practical checklist and examples here). If your stack misfires, you’ll either drop identifiers you’re entitled to collect or, worse, set non-essential cookies without valid consent.

A typical scenario we see

A brand migrates from one consent platform to another (sometimes different editions of the same vendor). Post-launch, GA4 BigQuery shows more events without consent (no user_pseudo_id/session identifiers). This usually signals:

  • Hybrid CMP remnants – legacy dataLayer events (e.g., OneTrustGroupsUpdated) still firing alongside the new setup. See OneTrust’s developer docs on dataLayer events and cookies: GTM integration, SPA notes.
  • Consent timing – CMP updates occur after tags try to fire (race condition). GTM provides a dedicated Consent Initialization trigger so consent is set before anything else runs: GTM consent mode support, Page view & consent triggers.
  • Consent Mode v2 gaps – missing/late updates to consent types like ad_user_data or ad_personalization, or updates not applied on the page where the user makes the choice. See: Set up consent mode and the consent types reference here. Technical parameters (gcs, gcd) explained here.

The 30-minute triage

  1. Check banner UX against ICO guidance. First-layer must present Reject All with equal prominence to Accept All (no “tiny close X” detours). ICO overview here and practical checklist/examples here.
  2. Verify GTM’s consent sequence. Your CMP/default-consent tag must fire on Consent Initialization – All Pages (the earliest possible moment) before any other trigger: GTM consent mode support.
  3. Kill the hybrid. Remove all legacy CMP scripts and GTM tags. You should have a single source of truth for consent events/cookies. For OneTrust/CookiePro, reference: GTM integration, SPA events.
  4. Confirm signal paths. Some CMPs expose a dataLayer event (e.g., OneTrustGroupsUpdated) and a cookie (e.g., OptanonConsent). Your tags should read consent and let GTM’s Tag consent settings gate firing—don’t try to “set consent” in custom HTML. Docs: OneTrust × GTM.
  5. Look for race conditions in GTM Preview. Accept/deny and watch the event stream. If GA4/pageview fires before consent updates, tags will be blocked or run in limited mode. Fix by moving CMP logic to Consent Initialization: GTM triggers.
  6. Validate network requests & Consent Mode params. On the page where the user clicks, check that requests send updated consent. See Consent Mode developer notes on gcs/gcd: overview. Set-up guide: integration.
  7. Cross-check in BigQuery. In GA4 export, review privacy_info.* (e.g., analytics_storage). Docs: GA4 BigQuery export schema. Practical querying guides: GA4BigQuery.com, Optizent.

A clean architecture (that actually works)

  • Single CMP, single source of truth. Run only one consent script. For OneTrust/CookiePro, rely on its documented dataLayer event(s) and/or OptanonConsent cookie—don’t duplicate logic. Docs: GTM integration, SPA events.
  • Consent Initialization first. Fire your CMP/default consent tag on Consent Initialization – All Pages, then let GA/Ads tags inherit Tag consent settings: GTM consent mode support.
  • Apply updates on the page of interaction. Google’s guidance emphasises updating consent before navigating so subsequent hits reflect the new state: Consent mode setup.
  • Mind Consent Mode v2 types. Ensure analytics_storage, ad_storage, ad_user_data, and ad_personalization are handled correctly: consent types reference.

How we measure “fixed”

  1. Consent rate. In BigQuery, track the share of events with privacy_info.analytics_storage = 'Yes' (and ads fields for ad consent). Schema docs: GA4 export.
  2. Attribution health. Compare modeled vs observed conversions before/after the fix. Consent Mode v2 adapts collection to user choice (including limited signals when storage is denied): setup, concepts, consent types.
  3. UX A/B tests. Within ICO rules, test banner copy/layout to lift informed opt-in while maintaining equal prominence of choices: ICO checklist & examples.

Quick troubleshooting checklist

Thanks for signing up.

Your signup request has been sent to the Vuzo team.