iubenda runs a proactive scan of your site and flags a “late” consent signal when it finds one. You may receive this warning by email or see it in your iubenda dashboard. You can also confirm it yourself in your Google diagnostics, for example in Tag Assistant’s consent debugging view.
A late consent signal means one or more Google tags are firing before the iubenda Consent Management Platform (CMP) has set the consent state, so those tags miss the correct consent signal.
A frequent cause is Google tag gateway (GTG). This article explains what GTG is, how to confirm whether your site uses it, and how to fix the load order so consent is applied correctly.
In short:
If you see a late consent signal, first check whether your domain uses Google tag gateway. If it does, the recommended fix is to adopt U+C (advanced consent mode) together with Data Transmission Controls and Global Consent Defaults, or to move your tags into a single GTM container where you control the load order.
What is Google tag gateway (GTG)?
Google tag gateway serves Google tags as first-party scripts through your own Content Delivery Network (CDN) or CMS, instead of loading them from a Google domain. Data is sent to Google through a first-party gateway that acts like a router: it reads the incoming request and forwards it to Google.
Information such as IP addresses and other identifying details is still transmitted to Google. GTG is not a form of anonymization. It changes how data reaches Google, not what is sent.
Why GTG can cause late consent signals
GTG is often enabled through a one-click CDN integration. Set up this way, the CDN injects the Google tags and you usually have no control over the order in which scripts load. If a Google tag loads before the iubenda cookie banner, the consent signal could arrive late and the user’s choice doesn’t govern the first request.
For full technical details, see Google’s documentation: Google tag gateway for advertisers (overview) and the setup guide.
Step 1: Verify whether your tags are enrolled in GTG
- Open Google Tag Manager and go to the Admin section.
- Look for Google tag gateway.
- Check whether it is marked as active (status “First-party”) for your specific domain(s). Other statuses you may see include Not started, Paused, or Pending.
For more on reading these statuses, see Google’s About Google tag gateway for advertisers (Tag Manager Help).
Step 2: If GTG is enrolled, choose a fix
If you’ve confirmed that GTG is active and you’re seeing a late consent signal, you have a few options. Pick the one that best matches your setup and needs.
Recommended: U+C (advanced consent mode)
For GTG-enabled tags, U+C (advanced consent mode) is the recommended mechanism because it is compatible with manual GTG. With advanced consent mode, Google tags load and immediately set a default consent state, and only transmit data once consent is granted. Combine this with Data Transmission Controls and Global Consent Defaults configured according to your needs.
Your options
- Adopt U+C (advanced consent mode) and enable Data Transmission Controls and Global Consent Defaults according to your needs. See Set up consent mode on websites and the consent mode overview.
- Migrate all your tags into a GTM container and deploy GTM via Google tag gateway, so the gateway serves a single, controlled container. With this approach you should:
- Combine all tags into one GTM container.
- Load the iubenda CMP from the container and fire it on a “consent initialization” trigger, so it runs before other tags.
- Restrict the Google tags until consent is received, so nothing fires before the user’s choice is set.
- Set up GTG manually (rather than via one-click CDN injection) so that you control the order in which scripts import. See the manual setup guide.
Step 3: Troubleshoot the load-order problem
To keep your measurement working without firing tags before consent has been set, use Google’s built-in mechanism to apply a default “denied” state. This injects a default-denied block before the Google tags load through the CDN. The iubenda CMP then gets a chance to load and explicitly re-grant consent for the categories the user has already accepted. Events are queued and replayed as consented if consent is granted.
Set a default “deny” in GTM
- In GTM, navigate to Configuration.
- Go to Manage → Override consent mode defaults.
- Set the configuration to deny everything for that tag.
This ensures nothing is measured until the CMP has loaded and consent has been resolved. For details, see Google’s Set up consent mode in Tag Manager and Tag Manager consent mode support.
Add Data Transmission Controls
In addition to the default-deny step, use Data Transmission Controls to prevent behavioral measurement and configuration data from being sent to Google when consent is denied. Data Transmission Controls layer on top of consent mode (they don’t replace it), so you must have basic or advanced consent mode in place first.
Putting it together:
Set a default denied state before the Google tags load → let the iubenda CMP load and resolve the user’s choice → re-grant consent for accepted categories → queued events are replayed as consented. With U+C (advanced consent mode) plus Data Transmission Controls, this works correctly even when GTG is enabled.
Still seeing a late consent signal?
If you’ve verified GTG enrollment, applied a default-deny, and adopted advanced consent mode but still see the warning, re-test using Tag Assistant’s consent debugging to confirm the order in which signals fire, then contact iubenda support with a screenshot of your Tag Assistant output and your GTG status in GTM.
Related Google documentation: