Introduction

A forex broker client operating in various global markets had a problematic consent management system that wasn’t very functional. Most of their traffic came from regions where explicit consent banners are not typically needed, so it was never a primary concern. However, a small percentage of their traffic came from the EU region, which poses a significant compliance risk under GDPR.

Without a proper consent framework, they exposed themselves to a compliance violation and operated their Google tags in restricted mode. This results in limited attribution accuracy, no advanced GA4 tracking and fewer marketing features in Google Ads. 

The solution was to deploy Cookiebot CMP integrated with Google Consent Mode. We implemented a region-aware setup to achieve GDPR compliance for EU visitors, while allowing full tracking for non-EU sessions without interruption.

Background

The client relied heavily on GA4 and Google Ads for their analytics and advertising framework. Without a properly functioning consent system, the tracking and attribution implementation had multiple gaps, resulting in inconsistent and inaccurate data collection.

Although the traffic coming from the EU region was smaller, the lack of consent created two issues:

• Regulatory Risk – Operating in the EU without a compliant CMP exposed the client to substantial fines.
• Marketing and Data Impact – Without proper consent, one can miss out on campaign efficiency, attribution accuracy, and advanced features across several Google marketing platforms.

Without a region-specific approach, EU and non-EU visitors were the same, wasting opportunities to maximise tracking for non-EU traffic while maintaining compliance for EU users.

Project Goals

The project targeted both compliance and data quality:

GDPR Compliance for EU Users: Deployment of a recognised CMP (Cookiebot) with region-based custom implementation to display consent banners only to EU visitors. 

Setting the consent as denied by default on the website until explicitly granted.

Automatic Consent Signals for Non-EU Users: Configure Consent Mode as granted by default to send the correct consent values to GA4, Google Ads, DV360, and SA360 for non-EU users.

Preserve GA4 Data Quality: Ensure that Analytics Storage consent is provided where applicable to prevent attribution gaps and maintain comprehensive reporting for compliant users.

Enable Advanced Marketing Features: Grant Ad Storage, Ad User Data, and Ad Personalisation, where applicable, to facilitate remarketing lists, optimised conversions, and cross-platform audience sharing.

Centralise Consent Across Multiple Domains: Consistent consent state implementation across all client domains and subdomains.

Implementation Steps

Regional Cookiebot CMP Deployment

The consent signal was set to granted for all non-EU traffic by default, enabling full tracking without any explicit user action, whereas for the EU region, all consent categories were denied by default until the user actively provided consent.

Consent Mode Configuration and Mapping

Mapped consent categories in GTM to control data handling:

• Analytics Storage – Ensures accurate attribution, richer reports, and reduced gaps caused by restricted tracking for compliant users.
• Ad Storage, Ad User Data, Ad Personalisation – Provides active remarketing, audience sharing and conversion tracking for users providing consent to do so.
• Restrict tags triggering only to compliant users – Unless conditions for the cookie_consent_update trigger are met, GTM sets to block GA4 and marketing tags. This ensures data collection from consented users only.

Consent Initialisation and Tag Firing Logic

• Created consent-related triggers to fire accordingly:
• Consent Initialisation – Checks on consent status before executing any tags.
• Cookie Consent Update—This was fired according to the provided consent, which is granted by default for non-EU regions and explicitly by users for the EU region.
• Tag Deployment Control – EU compliance is checked before any GA4, remarketing or conversion tag is triggered while maintaining full tracking for non-EU users.

Data Layer Integration and Multi-Domain Verification

• Integrated the CMP with the dataLayer to log:
• Default denied state for EU visitors.
• Consent is changed only after interaction.
• Confirming the firing of GA4 tags only after consent is granted.
• All domains are covered while testing to ensure consistent consent states.

Debugging and QA Testing 

• Validated the setup using GTM Preview Mode, confirming that:
• EU visitors had tracking blocked until consent was provided.
• Non-EU visitors received all consent categories automatically without any manual intervention.
• Tags were fired consistently across all domains.

Results and Benefits

• Regulatory Compliance – Achieving complete GDPR compliance for EU visitors, reducing the risk of penalties while ensuring lawful data processing across all properties.
• Data Accuracy – Restoring Analytics Storage consent for all compliant users not only allows the attribution models to work accurately but also removes any gaps in session tracking, providing a more complete and reliable view of the traffic source data.
• Marketing Enablement – Enabled remarketing, audience list building, and campaign optimisation with the help of Ad Storage, Ad User Data, and Ad Personalisation consent wherever possible. This improved access to several key features of Google’s marketing ecosystem.
• Operational Efficiency – Streamlining the consent handling through regional targeting helped avoid unnecessary consent banners for non-EU users, while maintaining proper consent logs for EU traffic across domains.

Conclusion

This project helped the client achieve better compliance and marketing performance by deploying Cookiebot CMP with Google Consent Mode integration. The client achieved GDPR compliance without sacrificing analytics quality and gained multiple advertising capabilities.

Using the cookie_consent_update trigger ensured tags fired only under compliant conditions, while non-EU traffic retained full tracking. This solution safeguarded against regulatory penalties while optimising marketing potential and unifying consent management across a multi-domain environment.