GTM consent mode by maureenlholland · Pull Request #955 · mozmeao/springfield

maureenlholland · 2026-02-04T18:24:42Z

One-line summary

GTM implementation of Google consent mode: https://developers.google.com/tag-platform/security/guides/consent?consentmode=advanced#tag-manager_2

Default

if on /landing/get with no user pref and no consent required, allow analytics
if user pref, use user pref
else denial

Update

both ad and analytics consent will update according to pref

Significant changes and points to review

Issue / Bugzilla link

https://mozilla-hub.atlassian.net/browse/WT-602

Testing

Available on Demo 3:

https://www-demo3.springfield.moz.works/en-US/
https://www-demo3.springfield.moz.works/en-US/landing/get
GTM is loaded according to usual gates (respecting DNT/GPC, consent-required, analytics cookie)

When GTM is loaded on most pages:

and there is no existing analytics cookie, defaults are denied
and there is an existing analytics cookie TRUE, defaults are granted

When GTM is loaded on /landing/get

and there is no existing analytics cookie and consent is not required, analytics default is granted, ad defaults are denied

When user indicates pref, an 'update' dataLayer event appears:

after clicking marketing opt out checkbox on /landing/get
after clicking ACCEPT on consent banner on /landing/get (when a consent required geo, ie. http://localhost:8000/en-US/landing/get/?geo=FR)
after setting cookie pref: http://localhost:8000/en-US/privacy/websites/cookie-settings/

Google verification docs: https://developers.google.com/tag-platform/security/guides/consent-debugging#start-debugging

codecov · 2026-02-11T11:56:47Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.27%. Comparing base (7cc7ebf) to head (5acda8f).
⚠️ Report is 34 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #955      +/-   ##
==========================================
+ Coverage   76.47%   77.27%   +0.80%     
==========================================
  Files         124      124              
  Lines        7599     7627      +28     
==========================================
+ Hits         5811     5894      +83     
+ Misses       1788     1733      -55

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

maureenlholland · 2026-02-17T09:42:37Z

Needs automated tests once behaviour is confirmed (edit: this can be a follow-up task as long as demo behaviour is approved)

stephendherrera · 2026-02-25T18:32:41Z

media/js/base/gtm/gtm-snippet.es6.js

+
+    if (hasPref) {
+        setGtagAdsConsentMode(cookie.analytics, 'default');
+        setGtagAnalyticsConsentMode(cookie.analytics);


QA Bug: During testing, analytics_storage was observed firing as "update" instead of "default" when a moz-consent-pref cookie exists. This means analytics has no declared default state before GTM loads. Google falls back to its own implicit default until the update arrives.

The type argument is missing here, so it defaults to 'update'. It should be 'default' to match the ads consent call on the line above:

setGtagAnalyticsConsentMode(cookie.analytics, 'default');

Google's consent mode requires default to be set before GTM loads. Confirmed inspection on demo3 shows "1": "update" instead of "1": "default" on page load when a cookie is present (tested on /firefox/new/ and /landing/get?geo=FR).

stephendherrera · 2026-02-25T18:55:20Z

@maureenlholland Overall, 99% there, one itemg observed, left an inline comment.

Tested on demo3. All GTM loading gates pass (DNT, GPC, consent-required geo). The /landing/get special rule works correctly, analytics granted, ads denied with no cookie.

GTM Loading Gates

DNT enabled == PASS
GPC enabled == PASS
/landing/get?geo=FR no consent == PASS
A4 No gates active == PASS

Consent Defaults

No cookie -> all denied == PASS
Cookie analytics: true == FAIL analytics_storage fires as update instead of default
Cookie analytics: false == Pass, GTM doesn't load

Consent Defaults (/landing/get)

No cookie, no consent required -> analytics granted, ads denied == PASS
?geo=FR, no consent -> GTM doesn't load == PASS
Cookie analytics: true on ?geo=FR -> all granted == PASS

Update Events

Uncheck marketing opt-out -> update fires, all denied == PASS
Accept consent banner on ?geo=FR -> update fires, all granted == PASS
Cookie settings page, select No -> update fires, all denied == PASS

maureenlholland · 2026-03-02T12:00:13Z

media/js/base/gtm/gtm-snippet.es6.js

 GTMSnippet.handleConsent = (e) => {
    const hasConsent = e.detail.analytics;

+    // update gtag consent according to pref


this is probably a bit redundant given the consent rules under which we display the consent banner (denial default is likely in place & we may be updating for denial too), but it feels more future-proof in case the consent banner logic changes

stephendherrera

QA verified on demo3. Missing default type on setGtagAnalyticsConsentMode is confirmed working. analytics_storage correctly fires as default instead of update when a consent cookie is present on page load.

My tests below:

No cookie==all denied defaults
Cookie analytics:true==all granted as default
/landing/get no cookie, no consent required==analytics granted, ads denied
Consent banner accept on ?geo=FR ==GTM loads with correct grants
DNT/GPC gates and cookie settings paths were not re-tested as recent changes don't affect those paths.

PR #955 introduced Google Consent Mode defaults that inadvertently set analytics_storage to 'denied' for all pages except /landing/get. This silently blocked GA4 from recording events for the majority of site traffic — visitors outside EU/EAA without a consent cookie. The fix replaces the /landing/get-specific check with a region-based check, so analytics_storage defaults to 'granted' whenever explicit consent is not required, matching the existing GTM loading behavior in init().

* fix: fix: default analytics_storage PR #955 introduced Google Consent Mode defaults that inadvertently set analytics_storage to 'denied' for all pages except /landing/get. This silently blocked GA4 from recording events for the majority of site traffic — visitors outside EU/EAA without a consent cookie. The fix replaces the /landing/get-specific check with a region-based check, so analytics_storage defaults to 'granted' whenever explicit consent is not required, matching the existing GTM loading behavior in init(). * grant ad_storage default on /landing/get for non-EU visitors Matches the marketing opt-out checkbox state upfront so there is no gap between GTM loading with ads denied and a later update. * Update tests/unit/spec/base/gtm/gtm-snippet.js Co-authored-by: maureenlholland <[email protected]> * Update tests/unit/spec/base/gtm/gtm-snippet.js Co-authored-by: maureenlholland <[email protected]> --------- Co-authored-by: Steve Jalim <[email protected]> Co-authored-by: maureenlholland <[email protected]>

maureenlholland force-pushed the wt-602--consent-management branch from b333a17 to 31fb40b Compare February 11, 2026 11:49

maureenlholland changed the title ~~wip~~ GTM consent mode Feb 11, 2026

maureenlholland force-pushed the wt-602--consent-management branch 4 times, most recently from 6e88cec to 4bb0767 Compare February 16, 2026 18:47

maureenlholland marked this pull request as ready for review February 17, 2026 09:42

maureenlholland force-pushed the wt-602--consent-management branch 2 times, most recently from 19070e8 to 2661092 Compare February 18, 2026 12:09

maureenlholland added 2 commits February 25, 2026 11:27

Include GTM gtag consent management, default to denial

be1ac2f

Empty commit to flush CI

d86eac6

stevejalim force-pushed the wt-602--consent-management branch from 2661092 to d86eac6 Compare February 25, 2026 11:27

stephendherrera reviewed Feb 25, 2026

View reviewed changes

maureenlholland added 2 commits March 2, 2026 11:10

Fix missing default type on gtm snippet init

5e0544b

Update consent after consent banner interaction and add tests

5acda8f

maureenlholland commented Mar 2, 2026

View reviewed changes

maureenlholland requested a review from stephendherrera March 2, 2026 14:11

stephendherrera approved these changes Mar 2, 2026

View reviewed changes

maureenlholland merged commit b49a8a9 into main Mar 3, 2026
6 checks passed

maureenlholland deleted the wt-602--consent-management branch March 3, 2026 10:49

stephendherrera mentioned this pull request Mar 5, 2026

fix: grant ads consent when marketing opt-out checkbox is shown on /landing/get #1124

Closed

10 tasks

slightlyoffbeat mentioned this pull request Mar 9, 2026

fix: default analytics_storage #1133

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GTM consent mode#955

GTM consent mode#955
maureenlholland merged 4 commits intomainfrom
wt-602--consent-management

maureenlholland commented Feb 4, 2026 •

edited

Loading

Uh oh!

codecov bot commented Feb 11, 2026 •

edited

Loading

Uh oh!

maureenlholland commented Feb 17, 2026 •

edited

Loading

Uh oh!

stephendherrera Feb 25, 2026 •

edited

Loading

Uh oh!

stephendherrera commented Feb 25, 2026

Uh oh!

maureenlholland Mar 2, 2026

Uh oh!

stephendherrera left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

maureenlholland commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

One-line summary

Significant changes and points to review

Issue / Bugzilla link

Testing

Uh oh!

codecov bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

maureenlholland commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stephendherrera Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stephendherrera commented Feb 25, 2026

Uh oh!

maureenlholland Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

stephendherrera left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

maureenlholland commented Feb 4, 2026 •

edited

Loading

codecov bot commented Feb 11, 2026 •

edited

Loading

maureenlholland commented Feb 17, 2026 •

edited

Loading

stephendherrera Feb 25, 2026 •

edited

Loading