WebToffee GDPR Cookie Consent Plugin + GTM4WP – How to setup?

Google Tag Manager for WordPress can now integrate with the popular GDPR Cookie Consent Plugin by WebToffee. This integration lets you set up Consent Mode in Google Tag Manager based on the cookie choices users make in the WebToffee plugin.

What is Consent Mode?

When it comes to tracking website data, Google uses Consent Mode to understand your preferences. This works by sending consent information to Google’s tracking codes. Based on these “consent flags,” Google adjusts how its data collection scripts behave. This includes how information is stored and processed on Google’s servers.

For instance, if you deny permission for analytics storage (often through a disabled “Statistics” consent category), Google Analytics 4 (GA4) won’t use cookies or collect any automatically stored identifiers. It will also keep this data separate and use it for modeling algorithms. These algorithms add modeled data to your observed, consented data in your Google Analytics reports.

Similar adjustments are made for Google Ads and Floodlight tracking codes. You can find more details in Google’s official documentation.

Why is Consent Mode so important?

Since 6th March, 2024, Google requires websites and mobile apps to pass consent mode flags for users coming from the European Economic Area (EEA) in order to be able to put those users on audience lists and activate them (also known as remarketing). Currently, the most important Consent Mode flag is ad_personalization but other flags might be required later as well therefore it is wise to fully setup Consent Mode now to be prepared for further changes in requirements.

Users coming from other regions of the worlds are currently not affected.

How to prepare WebToffee GDPR Cookie Consent Plugin settings?

There is currently no specific preparation needed in WebToffee’s plugin settings. You should setup consent (cookie) categories as they will be the key to use consent mode flags.

It is recommended to setup at least 3 categories:

1. Necessary
2. Statistics
3. Marketing / Advertising

If you wish to also offer users more granular consent choices, you might also create a “User data for advertising purposes” and a “Personalization in advertising” category without adding any specific cookies to these categories.

Setup Consent Mode defaults

Google’s Consent Mode allows you to send two commands:

1. The default command stores the consent flags that will be used with Google’s tracking codes if no other command is received
2. The update command is fired when the users changes consent choices. For easier setup, many consent management platforms also fire the update command during page load, after the default command when there is a stored consent state in the browser of the user.

To setup the default command in GTM4WP, open this option page:

Turn on the first checkbox to activate the default command.

It is recommended to leave other checkboxes turned off. It will tell Consent Mode that no consent has been granted yet on each page load. Turning on any checkbox besides the first checkbox might be a violation of GDPR but you can use it for testing purposes.

Activate integration with WebToffee GDPR Cookie Consent Plugin

Turn on this chechbox:

This integration will listen to the signal of the GDPR plugin which will let GTM4WP now that either the user just saved a new consent choice or there was already a stored consent state during page load. GTM4WP will fire a GTM event: cookie_consent_update with a consent data variable that will hold user choices for consent (cookie) categories:

dataLayer.push({
  event: "cookie_consent_update",
  consent_data: {
    necessary: true,
    advertising: true,
    statistical: true
  }
}

Keys under the consent_data variable will reflect your cookie category slugs:

GTM4WP will also fire a GTM event for each accepted cookie category. The event name will be cookie_consent_<category_slug>. For example:

dataLayer.push({
  event: "cookie_consent_necessary"
});

You can use these events and data layer variables to activate the update command within your Google Tag Manager container.

How to setup the update command in Google Tag Manager?

In your Google Tag Manager container, you will need to create at least two new variables. One for the statistics category and one for the marketing/advertising category. If you decided to also create separate categories for user data in advertisement and personalization in advertisement, you will need to repeat the steps for those categories as well, ending up having 4 variables in GTM. For this tutorial, we use only two variables.

Here is how the variable should look like:

Make sure you adjust the Data Layer Variable Name based on the slugs in your GDPR plugin settings. Also do not forget to setup all other options, like the default value and all formatting rules. Using this, within Google Tag manager, this variable will report either the value granted or denied.

Create another variable, but this time for the statistics category. In our example, the value of the Data Layer Variable Name will be consent_data.statistics but this might need adjustment on your site. Save this variable with the name: Consent – statistics.

Now add a new Tag into your container by choosing the following tag template from the community galery:

Setup the tag using the following options:

In the Triggering section, create a new trigger with the type Custom Event and set it up like this:

Add this trigger to the Consent Mode update tag and save everything.

You are done (?)

After publishing your changes, you are done setting up Consent Mode with WebToffee GDPR Cookie Consent Plugin… but you might have more work to be done.

Using the steps above, you will setup the so called “Advanced mode” of Consent mode. This will allow Google to collect those cookieless data when user has denied any related consent. There are arguments that this might be not GDPR compliant. It is not our duty to decide this for you. If you or your DPO says that this is not compliant then you need to move to the so called “Basic mode”. Since this is not something related to GTM4WP itself, I can just give you some steps that you need to go through:

• Enable Consent Overview in the settings of your GTM container
• Set your Google tags (GA4, Google Ads, Floodlight) to prevent firing when specific consent flags are denied
• The Consent Mode tag that we added during setup will fire a gtm_consent_update event each time
  • The page loads while there is a previously stored consent
  • The user visits the site for the first time and selected its consent choices
• You can use this gtm_consent_update event instead of the All pages event to fire your tags when proper consent state is available preventing any Google tag to send data without specific consents