Google Consent Mode is a critical component for websites using Google services to maintain compliance with privacy regulations like GDPR. When properly configured, it allows Google’s tags to adjust their behavior based on user consent choices. However, misconfigurations can lead to compliance issues and may affect your ability to use Google’s advertising and analytics services effectively.
This guide will help you identify and resolve common Google Consent Mode configuration issues detected by iubenda’s Site Scanner.
The iubenda Site Scanner automatically checks your website for various Google Consent Mode configuration issues. If any problems are detected, you’ll see an “Attention Required” alert in your dashboard. The scanner checks for:
⚠️ Why this issue happens:
When the iubenda Privacy Controls and Cookie Solution script is embedded after Google scripts (like Google Analytics or Google Tag Manager), the Google scripts fire before users can make their consent choices. This can result in default consents being passed as “granted” without user consent, leading to GDPR non-compliance
💡 How to fix it
Use the iubenda WordPress plugin, which automatically places the Privacy Controls and Cookie Solution script before any Google scripts.
Access your website’s HTML code
Locate the <head>
section of your pages where scripts are embedded.
Identify the iubenda Privacy Controls and Cookie Solution script
Look for code similar to:
<script type="text/javascript" src="https://cs.iubenda.com/autoblocking/[YOUR-SITE-ID].js"></script>
Identify Google-related scripts
Look for scripts like:
gtag.js
(Google Analytics)googletagmanager.com
(Google Tag Manager)Reorder the scripts
Move the iubenda Privacy Controls and Cookie Solution script BEFORE any Google scripts.
Example of INCORRECT script order:
<!-- WRONG: Google Analytics script placed BEFORE Privacy Controls and Cookie Solution -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'G-XXXXXXXXXX');
</script>
<!-- iubenda Privacy Controls and Cookie Solution placed AFTER Google scripts -->
<script type="text/javascript">
var _iub = _iub || [];
_iub.csConfiguration = {
"askConsentAtCookiePolicyUpdate":true,
"cookiePolicyInOtherWindow":true,
"countryDetection":true,
"enableGdpr":true,
"floatingPreferencesButtonDisplay":"bottom-right",
"siteId":3258456,
// ... rest of configuration
};
</script>
<script type="text/javascript" src="https://cs.iubenda.com/autoblocking/[YOUR-SITE-ID].js"></script>
<script type="text/javascript" src="//cdn.iubenda.com/cs/gpp/stub.js"></script>
<script type="text/javascript" src="//cdn.iubenda.com/cs/iubenda_cs.js" charset="UTF-8" async></script>
Example of CORRECT script order:
<!-- CORRECT: iubenda Privacy Controls and Cookie Solution placed FIRST -->
<script type="text/javascript">
var _iub = _iub || [];
_iub.csConfiguration = {
"askConsentAtCookiePolicyUpdate":true,
"cookiePolicyInOtherWindow":true,
"countryDetection":true,
"enableGdpr":true,
"floatingPreferencesButtonDisplay":"bottom-right",
"siteId":3258456,
// ... rest of configuration
};
</script>
<script type="text/javascript" src="https://cs.iubenda.com/autoblocking/[YOUR-SITE-ID].js"></script>
<script type="text/javascript" src="//cdn.iubenda.com/cs/gpp/stub.js"></script>
<script type="text/javascript" src="//cdn.iubenda.com/cs/iubenda_cs.js" charset="UTF-8" async></script>
<!-- Google Analytics placed AFTER iubenda -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'G-XXXXXXXXXX');
</script>
⚠️ Why this issue happens:
The Privacy Controls and Cookie Solution is intentionally configured via code with Google Consent Mode disabled, even though your website requires it for compliance with Google’s requirements and privacy regulations.
💡 How to fix it
With Autoblocking enabled
<script type="text/javascript" src="https://cs.iubenda.com/autoblocking/[YOUR-SITE-ID].js"></script>
With Sync.js (Autoblocking disabled)
<script type="text/javascript" src="https://cs.iubenda.com/sync/[YOUR-SITE-ID].js"></script>
Unified script (latest version)
<script type="text/javascript" src="//embeds.iubenda.com/widgets/[YOUR-WIDGET-ID].js"></script>
"googleConsentMode": true
is set in your configuration"googleConsentMode": false
⚠️ Why this issue happens:
Your Privacy Controls and Cookie Solution is installed but isn’t using either the autoblocking feature or Sync.js, which are required for Google Consent Mode to function properly.
💡 How to fix it
Update from outdated scripts:
If you’re using an outdated version of the Privacy Controls and Cookie Solution script, replace it with one of these updated versions that support Google Consent Mode:
Option 1 – With Autoblocking (Recommended)
<script type="text/javascript" src="https://cs.iubenda.com/autoblocking/[YOUR-SITE-ID].js"></script>
Option 2 – With Sync.js
<script type="text/javascript" src="https://cs.iubenda.com/sync/[YOUR-SITE-ID].js"></script>
Option 3 – Unified script
<script type="text/javascript" src="//embeds.iubenda.com/widgets/[YOUR-WIDGET-ID].js"></script>
⚠️ Why this issue happens:
One or more consent purposes are set to “granted” by default before users make an explicit choice. This violates the principle of obtaining consent through explicit, positive action and doesn’t align with best practices.
💡 How to fix it
Plugins or external apps might be setting consent defaults incorrectly. This is especially common with tools that add pixels or configure Google services.
WordPress + Site Kit:
Shopify + Google & YouTube app:
If you previously manually set consent defaults using gtag, remove that code. Look for and remove code like this:
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
// REMOVE THIS CODE - it overrides default consent
gtag('consent', 'default', {
'ad_storage': 'granted',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'analytics_storage': 'denied'
});
</script>
After removing this code, iubenda’s CMP will handle the default consent configuration, provided you have autoblocking or Sync.js enabled.
⚠️ Why this issue happens:
Multiple default consent signals are being sent because there are multiple cookie banners (from different CMPs) installed on the website. This can happen when using platforms like Shopify or when plugins are double-managing Google Consent Mode. When our solution and other plugins both launch Google Consent Mode signals, it causes incompatibility and multiple signals.
💡 How to fix it
If you’re using the iubenda GTM template, ensure you’re not simultaneously using another template that configures Google Consent Mode (e.g., Simo Ahava template).
Plugins or external apps might be setting consent defaults incorrectly. This is especially common with tools that add pixels or configure Google services.
WordPress + Site Kit:
Shopify + Google & YouTube app:
If you previously manually set consent defaults using gtag, remove that code as it will override the CMP configuration.
Example of code to remove:
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
// This code overrides default consent – REMOVE IT
gtag('consent', 'default', {
'ad_storage': 'granted',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'analytics_storage': 'denied'
});
</script>
After removing this code, iubenda’s CMP will be the sole handler of consent configuration.
To check your DataLayer for anomalies:
dataLayer
and press Enter⚠️ Why this issue happens:
A user’s consent preference (either Accept or Reject) is sent to Google before the user has explicitly made a choice on the banner. As a result, when the user eventually interacts with the cookie banner, their preference is no longer taken into account by Google, since a consent signal has already been sent earlier.
This often occurs when the Privacy Controls and Cookie Solution is configured with enableGdpr: false
, meaning the user has unintentionally enabled US legislation and/or Swiss legislation even though the site should comply with GDPR legislation.
💡 How to fix it
enableGdpr: true
is set in your configuration if your site serves EU usersThe same third-party tools mentioned in Issue #4 and 5 can cause this problem:
WordPress + Site Kit:
Shopify + Google & YouTube app:
If you enable US Law in the Privacy Controls and Cookie Solution configurator, the default behavior for US users differs from GDPR:
Note: If you’re on a Free plan, this applies only if you disable GDPR and apply only US Law. To apply GDPR for EU users and US Law for US users, you need at least an Advanced plan.
ad_storage
is granted when the user hasn’t opted out of:
analytics_storage
is granted when the user hasn’t opted out of:
To verify your configuration is working correctly:
If you’re experiencing difficulties resolving these issues:
Remember, Google requires proper Consent Mode implementation for continued use of their advertising and analytics services. Ensuring correct configuration is essential for both compliance and maintaining your Google services functionality.