Fix Google’s consent defaults with one file

The kit shows up on a scan where we saw a Google tag and at least one of these:

• Your Google tags ran without any consent setting.
• The two newer Google signals, ad data and personalised ads, were missing.
• Your tags told Google visitors had already agreed, before anyone chose.
• Your Google tag sent data before your consent setting was in place.
• Tracking started before the visitor made a choice.

If we did not see a Google tag, or its consent setting looked right, there is nothing for the kit to do and we say so.

• A Tag Manager file with one tag, named “untick – Consent defaults (denied until a choice)”. It runs on a Consent Initialization trigger so it goes first, on every page.
• The same setting as a snippet you paste high in the head of your pages, above any Google tag, if you do not use Tag Manager.
• It sets ad_storage, analytics_storage, ad_user_data and ad_personalization to denied, and gives your banner half a second to answer before Google tags start.
• Your choice of who starts as denied: all visitors, or only visitors in the EEA, the UK and Switzerland.
• Everything we add is named “untick –”, so you can find it and remove it again.

1. 1
   Download the file

   Open the scan, go to the fix kit and choose who should start as denied. Download the Tag Manager file.

2. 2
   Import it

   In Tag Manager, open Admin, then Import Container. Choose the file, pick your workspace and select Merge. Your own tags and triggers stay as they are.

3. 3
   Preview

   Click Preview and open your site. The untick tag should be the first one to fire.

4. 4
   Publish and confirm

   Submit and publish, then scan again to confirm.

• It does not tell Google when a visitor accepts. Your cookie banner has to send that update.
• If your banner tool has its own Tag Manager template (Cookiebot, OneTrust, Usercentrics, Didomi and CookieYes do), use that instead. Two sets of defaults fight each other, and the kit tells you so.
• It does not change what other tags do. A pixel that loads outside your consent tool still needs fixing at its source.
• Denied by default is one common setup. Whether it is right for your business and your visitors is a question for you and your advisers. It is not legal advice.

Every report with a Google tag also has an Ad measurement panel, on every plan. It explains in plain words what your result means for Google ads, with a link to the Google help page behind each sentence. It does not change your grade.

• Google asks you to collect consent from visitors in the EEA and pass their choice on to Google. Without those signals you lose ad personalisation.
• It says whether you run basic or advanced mode, and what Google says each one costs you in modelled data.