What does the “late consent signal” warning mean? #
If you’ve spotted a “late” consent signal, it means one or more Google tags are firing before the CookieFirst Consent Management Platform (CMP) has set the user’s consent state. Because the tag fires too early, it misses the correct consent signal — so that first request isn’t governed by what the user actually chose.
You can confirm this yourself in your Google diagnostics — for example, in Tag Assistant’s consent debugging view.
One of the most common causes is Google tag gateway (GTG). This article explains what GTG is, how to check whether your site uses it, and exactly how to fix the load order so consent is applied correctly.
The short version: If you see a late consent signal, first check whether your domain uses Google tag gateway. If it does, the recommended fix is to adopt advanced consent mode (U+C) together with Data Transmission Controls and Global Consent Defaults — or to move all your tags into a single GTM container where you control the load order.
What is Google tag gateway (GTG)? #
Google tag gateway serves Google tags as first-party scripts through your own Content Delivery Network (CDN) or CMS, instead of loading them from a Google domain. Data still travels to Google, but it goes through a first-party “gateway” that works like a router: it reads the incoming request and forwards it to Google.
Important: Information such as IP addresses and other identifying details is still sent to Google. GTG is not a form of anonymisation — it changes how data reaches Google, not what is sent.
Why GTG can cause late consent signals #
GTG is often switched on through a one-click CDN integration. When it’s set up this way, the CDN injects the Google tags for you — and you usually have no control over the order in which scripts load. If a Google tag loads before the CookieFirst banner appears, the consent signal arrives late, and that first request happens before the user has made a choice.
For the full technical background, see Google’s documentation: Google tag gateway for advertisers (overview) and the setup guide.
Step 1: Check whether your tags are enrolled in GTG #
- Open Google Tag Manager and go to the Admin section.
- Look for Google tag gateway.
- Check the status for your specific domain(s). If it says “First-party,” GTG is active. Other statuses you might see include Not started, Paused, or Pending.
For help interpreting these statuses, see Google’s About Google tag gateway for advertisers (Tag Manager Help).
Step 2: If GTG is enrolled, choose a fix #
If you’ve confirmed GTG is active and you’re seeing a late consent signal, pick the option below that best fits your setup.
Recommended: advanced consent mode (U+C) #
For GTG-enabled tags, advanced consent mode (U+C) is the recommended approach because it’s compatible with manual GTG. With advanced consent mode, Google tags load and immediately set a default consent state, and only transmit data once consent is granted. Pair this with Data Transmission Controls and Global Consent Defaults, configured to match your needs.
Your options #
Option A — Adopt advanced consent mode (U+C). Enable Data Transmission Controls and Global Consent Defaults to match your needs. See Set up consent mode on websites and the consent mode overview.
Option B — Move everything into one GTM container and deploy GTM via Google tag gateway, so the gateway serves a single, controlled container. To do this:
- Combine all your tags into one GTM container.
- Load the CookieFirst CMP from the container and fire it on a “consent initialization” trigger, so it runs before any other tags.
- Restrict the Google tags until consent is received, so nothing fires before the user has chosen.
For setting up Google Tag Manager with CookieFirst and consent mode, follow CookieFirst’s own Google Tag Manager / Google Consent Mode integration guide.
Option C — Set up GTG manually (rather than via one-click CDN injection), so you control the script import order. See the manual setup guide.
Step 3: Fix the load-order problem #
To keep your measurement working without firing tags before consent is set, use Google’s built-in mechanism to apply a default “denied” state. This injects a default-denied block before the Google tags load through the CDN. The CookieFirst CMP then gets a chance to load and explicitly re-grant consent for the categories the user accepted. Any events in between are queued and replayed as consented once consent is granted.
Set a default “deny” in GTM #
- In GTM, go to Configuration.
- Open Manage → Override consent mode defaults.
- Set the configuration to deny everything for that tag.
This ensures nothing is measured until the CMP has loaded and consent has been resolved. For details, see Google’s Set up consent mode in Tag Manager and Tag Manager consent mode support.
Add Data Transmission Controls #
On top of the default-deny step, use Data Transmission Controls to stop behavioural measurement and configuration data from being sent to Google when consent is denied. These controls layer on top of consent mode — they don’t replace it — so you need basic or advanced consent mode in place first.
Putting it all together #
- Set a default denied state before the Google tags load.
- Let the CookieFirst CMP load and resolve the user’s choice.
- Re-grant consent for accepted categories.
- Queued events are replayed as consented.
With advanced consent mode (U+C) plus Data Transmission Controls, this works correctly even when GTG is enabled.
Still seeing a late consent signal? #
If you’ve verified GTG enrolment, applied a default-deny, and adopted advanced consent mode but still see the warning:
- Re-test using Tag Assistant’s consent debugging to confirm the order in which signals fire.
- Contact CookieFirst support with a screenshot of your Tag Assistant output and your GTG status in GTM.
