Guide 81 · Consent · GA4 + Tag Manager
Consent default states: set all four consent types to denied before the first tag loads
A consent default state is the value each consent type holds before the visitor answers. Set analytics_storage, ad_storage, ad_user_data and ad_personalization to denied first, then let the banner update them.
After the trace, the page sends a default of denied for all four consent types before any Google tag loads, and the banner update is the only thing that changes them.
Download the reference: the consent default states reference (JSON) (581 bytes, MD5 37d9b7963cefe12a7a680874703da630). It holds the worked example from this guide with every figure recomputed. The file was built for this guide and checked the same day; it was not exported from a live property.
What you need
- The four consent type names, exactly as Google spells them.
- A place to run the default command before the Google tag: Tag Manager, or the Google tag snippet.
- A note of any regional default your privacy decision requires.
The trace
- List the four types. analytics_storage controls Analytics cookies such as the Analytics cookie. ad_storage controls advertising cookies. ad_user_data controls sending user data to Google for advertising. ad_personalization controls personalized advertising.
- Write the default as denied for all four. Google's reference lists each type with its meaning, and the setup page places defaults before any tag behaviour. A default of granted is a decision to record, not a shortcut to take silently.
- Send the default before the Google tag loads. In gtag.js that is a gtag consent default call placed above the tag. In Tag Manager it is a Consent Mode template or a custom HTML tag on the Consent Initialization trigger, covered in the companion guide.
- Check the order in the download. The worked example records four defaults, all denied, sent once per page load, followed by one update when the visitor answers. That is 4 default values and 1 update per visitor, not one default per tag.
- Test the refusal path. Deny in the banner and confirm no Analytics cookies are set, accessed or read. If a cookie appears, the default ran after the tag, and the order is wrong.
- Test the grant path. Grant in the banner and confirm the tags then send full measurement. The update must change all four types the visitor granted, not only analytics_storage.
Dead ends
DEAD END — SETTING ONLY analytics_storage. A visitor who grants analytics but not ads still needs ad_storage, ad_user_data and ad_personalization handled. Four types, four values, every time.
DEAD END — A DEFAULT THAT ARRIVES LATE. A default sent after the Google tag has loaded does not restrain that load. The default must run first on every page.
DEAD END — NO DEFAULT AT ALL. Google's developer guidance says no consent state is set by default. Without a default command, the tags have no state to obey.
End state
Four consent types, all denied by default, sent once before the tag loads, then one update per visitor answer. That order is the whole check.
Sources
- Analytics Help — Consent mode reference — the four consent types and what each controls
- Analytics Help — Set up consent mode — defaults set to denied unless configured otherwise, and updates after user interaction
Checked 11 November 2026. The click paths above are the ones in Google's help and developer pages, opened 11 November 2026. No step in this guide was run inside a live Analytics property or a live Tag Manager container, because both need a Google sign-in and this site does not sign in as anyone. The figures on this page were recomputed in Python 3 and are shown in the downloadable file, which was checked the same day. Google moves menu items without warning; if a path on this page no longer matches, the linked help page is the current map.