Server-side GTM consent forwarding patterns

What this is

Server-side consent forwarding is the mechanism by which a website’s Consent Mode state travels from the browser to a server-side Tag Manager container as HTTP request parameters, where it becomes event-data keys that tags read to adjust or suppress the data they send. Native Google server tags honor the forwarded state automatically; custom and non-Google server tags must be gated manually, because the server-side sandbox exposes no consent API.

Reference tables

Consent types

Every type carries a state of granted or denied. The cited sources describe four of the seven in detail.

Consent flow to the server container (3 steps)

Outgoing HTTP consent parameters

Server-side event-data keys (internal parameters)

Mapping: the outgoing gcs reads as x-ga-gcs in event data; gcd as x-ga-gcd; dma as x-ga-dma; dma_cps as x-ga-dma_cps. The internal-parameters reference publishes only Name, Type, and Products (no value decoding) and warns that names, types, and products are subject to change.

Value-decoding note: Google does not publish the bit-level structure of gcs (the community G1XY scheme) or the base64 layout of gcd. Any value-to-category mapping is community reverse-engineering and may change without notice; treat it as unofficial.

Per-product behavior when consent denied (server-side)

Basic vs advanced consent mode

Consent API surface by container

Notes: read APIs require the access_consent permission with read access; setDefaultConsentState and updateConsentState require access_consent write access. isConsentGranted returns true when the type is granted OR unset. setDefaultConsentState optional fields are region (array of ISO 3166-2 codes) and wait_for_update (milliseconds). The listener in addConsentListener is invoked with (consentType, granted).

Web-side knobs that shape the payload before it leaves the browser

Server-side consent design must assume the incoming payload was already shaped by these; they are not server-container settings.

Tag-level consent controls (web container UI)

Gotchas

1. Server tags send full data despite on-site denial. Cause: the consent state never reached the server, either because the web Google tag is not forwarding gcs/gcd, or, for custom tags, because nothing in the container reads it. Fix: confirm the web Google tag forwards gcs/gcd to the container URL; for non-Google tags, read consent from event data and gate manually.
2. A server variable referencing gcs returns undefined or empty. Cause: in event data the key is namespaced x-ga-gcs; the raw gcs name exists only as the outgoing HTTP parameter. Fix: reference x-ga-gcs (and x-ga-gcd) as the event-data key.
3. Calling isConsentGranted() or addConsentListener() in a server template fails. Cause: those consent APIs exist only in web and client templates; the server sandbox exposes none. Fix: derive consent from request or event data (parse x-ga-gcs, or read a custom header or cookie) and implement gating manually.
4. Some events arrive with no gcs or consent signal at all. Cause: the source is not running Google consent mode (custom clients, Measurement Protocol, non-consent-mode sites), or the site is on basic mode where nothing is sent pre-interaction. Fix: handle the missing case explicitly with a deliberate fallback, treating it as denied for safety or as configured.
5. isConsentGranted() returns true although consent was never set. Cause: it returns true when the type is granted OR unset. Fix: always call setDefaultConsentState with explicit denied defaults before the user interacts, so an unset type does not read as granted.
6. Reporting or attribution looks degraded or modeled after enabling consent mode. Cause: denied storage means cookieless pings, and Google fills gaps via modeling that requires data thresholds. Fix: this is expected behavior, not a bug; ensure advanced mode is configured, confirm traffic meets thresholds, and communicate the modeled nature of the numbers to stakeholders.

Quick recipes

const getAllEventData = require('getAllEventData');

const event = getAllEventData();
const gcs = event['x-ga-gcs'];   // outgoing gcs, namespaced in event data
const gcd = event['x-ga-gcd'];   // fuller picture incl. ad_user_data, ad_personalization
const dma = event['x-ga-dma'];   // boolean

const getEventData = require('getEventData');

// The server sandbox has no isConsentGranted() — read the signal yourself.
const gcs = getEventData('x-ga-gcs');

// No signal (Measurement Protocol, non-consent-mode source): fail closed.
// Treat as denied and do not send the outbound request.
if (gcs === undefined) {
  // signal completion without firing, then stop
}

// Otherwise map gcs to a category via a configured lookup (value decoding is
// unofficial), and send the outbound request only when consent is granted.

const setDefaultConsentState = require('setDefaultConsentState');

setDefaultConsentState({
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
  wait_for_update: 500,          // milliseconds to wait for an update
  region: ['ES', 'US-AK']        // optional ISO 3166-2 scoping
});

const updateConsentState = require('updateConsentState');

updateConsentState({
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
  analytics_storage: 'granted'
});

const isConsentGranted = require('isConsentGranted');

// Returns true if granted OR unset — set denied defaults first so
// an "unset" type cannot read as granted.
if (isConsentGranted('analytics_storage')) {
  // fire the analytics tag
}

const addConsentListener = require('addConsentListener');

addConsentListener('ad_storage', (consentType, granted) => {
  // re-evaluate gating when the user changes the choice
});

Related

• Hub: Server-side tagging guides
• Consent Mode v2 reference
• sGTM Firestore lookup variables

Sources

• Set up consent mode on websites (Tag Platform) (read 2026-07-20)
• Consent mode overview (Security concepts) (read 2026-07-20)
• Implement consent mode with server-side Tag Manager (read 2026-07-20)
• An introduction to server-side tagging (read 2026-07-20)
• Internal parameters (server-side event data) (read 2026-07-20)
• Server-side sandboxed JavaScript API reference (read 2026-07-20)
• Common event data (server-side unified schema) (read 2026-07-20)
• Create a consent mode template (Templates) (read 2026-07-20)
• Custom template APIs (Templates API reference) (read 2026-07-20)
• Consent mode settings / data redaction (GTM Help 13802165) (read 2026-07-20)