How do I ensure my event tracking with a tag manager is compliant with cookie consent requirements?

To make event tracking with a tag manager compliant with cookie consent requirements, the key principle is:

Don’t fire any non-essential tags until the user has given valid consent.

Here’s a practical checklist.

1) Classify your tags correctly

Separate tags into categories such as:

• Strictly necessary: security, fraud prevention, basic site functionality
• Analytics: page/event tracking, behavior measurement
• Marketing/advertising: retargeting, ad conversion tracking, audience building
• Preferences: language, saved settings

Only strictly necessary tags can usually run before consent.

2) Use a consent management platform (CMP)

Use a CMP that collects and stores user consent and passes the consent state to your tag manager.

Make sure it:

• shows consent choices before non-essential tracking starts
• allows granular choices by category
• records consent proof and timestamp
• supports consent updates and withdrawals

3) Block tags by default

Configure your tag manager so that:

• analytics, marketing, and other non-essential tags are disabled by default
• they only trigger after the relevant consent category is granted
• no cookies or tracking identifiers are set before consent

If your tag manager supports a consent mode or consent API, use it.

4) Pass consent signals to the tag manager and platforms

Ensure your CMP updates the tag manager with the user’s choice, and the tag manager forwards that state to vendors.

Typical consent states include:

• analytics consent granted/denied
• advertising consent granted/denied
• personalization consent granted/denied

5) Avoid firing “harmless-looking” events too early

Even if an event seems anonymous, it may still be considered tracking if it:

• writes cookies
• uses device identifiers
• sends unique IDs or other persistent identifiers
• is tied to analytics/advertising platforms

So don’t assume “event tracking” is exempt just because it’s not a pageview.

6) Check whether server-side tracking is still tracking

Server-side tag management does not remove consent obligations. If the server receives identifiers or processes user data for analytics/marketing before consent, that can still be non-compliant.

7) Minimize data collection

For compliance, collect only what you need:

• avoid unnecessary personal data in event payloads
• don’t send email addresses, full IPs, or unique identifiers unless necessary and lawful
• truncate or anonymize where appropriate
• set retention limits

8) Make consent withdrawal as easy as giving consent

Users should be able to:

• change their preference later
• withdraw consent
• have tracking stop after withdrawal

When consent is withdrawn, stop firing non-essential tags and, where applicable, delete related cookies.

9) Document your lawful basis and tag inventory

Keep records of:

• what tags fire on each page/event
• what cookies each tag sets
• what consent category each tag requires
• legal basis for processing
• vendor list and data sharing details

10) Test it carefully

Before launch, verify that:

• no analytics/marketing cookies are set before consent
• tags only fire after the right consent is granted
• changing preferences immediately changes behavior
• no hidden scripts load prematurely

Use browser dev tools and tag assistant/debug modes to confirm.

---

Simple rule of thumb

If an event tracking setup helps measure behavior, optimize marketing, or identify users, assume consent is needed before it runs unless you’ve confirmed it’s strictly necessary and legally exempt.

If you want, I can also give you:

1. a Google Tag Manager consent setup checklist, or
2. a cookie-consent testing checklist you can use in QA.