By Marc Alexander

A site with visitors in the US, the UK and the EU is dealing with three sets of rules. It doesn't need three setups. One Tag Manager container can apply the right rules to each visitor.

In the EU, tracking waits for consent. In the UK, advertising waits for consent, but some analytics can run if visitors are told and can object. In most US states, tracking can start, and visitors can opt out. Treating everyone the same way is either too loose for Europe or needlessly strict for the US.

Google's Consent Mode lets you set different default consent states for different places. Each default can carry a region list, using country codes such as DE or GB, or state codes such as US-CA.

Google applies them in a clear order. A default for a visitor's region beats a default with no region. A more specific region beats a less specific one, so US-CA beats US. Order in the code doesn't matter, as long as all the defaults run before any Google tag fires.

An example setup.

Here are three defaults: denied for the EEA and Switzerland, advertising denied but analytics granted for the UK, and granted for everyone else. Whether each is right for your business is a legal decision; the mechanics are the same whatever you choose.

// EEA and Switzerland: nothing until the visitor agrees.
gtag('consent', 'default', {
  analytics_storage: 'denied',
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  region: ['AT', 'BE', 'BG', 'HR', 'CY', 'CZ', 'DK', 'EE', 'FI', 'FR',
           'DE', 'GR', 'HU', 'IE', 'IT', 'LV', 'LT', 'LU', 'MT', 'NL',
           'PL', 'PT', 'RO', 'SK', 'SI', 'ES', 'SE', 'IS', 'LI', 'NO', 'CH'],
  wait_for_update: 500
});

// UK: analytics on unless the visitor objects, advertising waits for consent.
gtag('consent', 'default', {
  analytics_storage: 'granted',
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  region: ['GB'],
  wait_for_update: 500
});

// Everyone else: on, with opt-outs honoured when they're made.
gtag('consent', 'default', {
  analytics_storage: 'granted',
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted'
});

wait_for_update gives the banner half a second to load a visitor's saved choice before Google's tags go ahead with the default.

In Tag Manager.

  1. Set the defaults first. Put them in a tag on the Consent Initialization trigger, usually through your consent platform's GTM template, which will often have region settings of its own.
  2. Update on every choice. When the visitor accepts, rejects or changes their mind, the banner sends a Consent Mode update with all four signals.
  3. Control the other tags. Consent Mode only governs Google's tags. Give Meta, TikTok, LinkedIn and other pixels GTM's consent checks, or triggers that wait for the right consent event.
  4. Add US opt-outs. For US visitors, a "Do not sell or share" choice and Global Privacy Control should update the same signals to denied.

Show each region the right banner.

The defaults are only half of it. The banner itself should differ too: an opt-in banner with "Reject all" for EU visitors, the UK's version with a way to object to analytics, and a lighter notice with a "Do not sell or share" link for US visitors.

That needs to know where the visitor is before the banner appears. Most consent platforms detect it for you. On a custom setup, the most reliable source is the server or CDN, which can pass the country to the page before any script runs. This site works that way.

Test it from each place.

  1. Use a VPN, or your consent platform's region override, to visit as someone in Germany, the UK, California and another US state.
  2. In GTM's Preview mode, check the consent state shown for the first event matches the region.
  3. Check which tags fire before any choice, then after accepting and after rejecting.
  4. Check the network requests match: no advertising requests from an EU visitor who hasn't agreed.

The guide to testing Consent Mode v2 has the detail of what to look for.

Marc Alexander sets up consent by region for US businesses with UK and EU visitors and for European businesses, in one container, tested from each place. The GA4 mini audit is a good first check of what your site does today.