cookiebot in google tag manager with consent mode

Question

I am trying to implement the Cookiebot CMP using Google Tag Manager and Google's Consent Mode. I followed the tutorial on https://support.cookiebot.com/hc/en-us/articles/360003793854-Google-Tag-Manager-deployment but the only other tag in my container besides the Cookiebot CMP tag, is the GA4 tag and that fires all the time. My Cookiebot CMP tag has a trigger "Consent Initialization - All Pages". My GA4 tag has a trigger "All pages". Since I understood that the Cookiebot CMP is tightly integrated with Google's Consent Mode and since the GA4 tag is by default integrated with Google's Consent Mode I thought as long as no permission is given in Cookiebot, the GA4 tag would not be triggered. The question is: why is GA4 triggered although no consent was given. Second question: how can I check the value of the Consent Mode variables "ad_storage",... In the Google Tag Manager Preview/debug mode I did not find any of these variables so this makes it difficult for me to check if the Cookiebot tag failed to set the Consent Mode variables or if the GA4 tag failed to respect the Consent Mode variable settings.

UPDATE: I think I figured out some of the above:

1. when using the Consent Mode, the Google Analytics tag will still fire on all pages (this was also the only trigger defined for that tag in the tag manager) but the Google Analytics tag will take the value of analytics_storage into account and if it is not "granted", no analytics data will be sent to Google. So the tag fires, the GA script starts execution but doesn't do it's normal job of sending data to Google
2. the best way to check without any additional software is checking the cookies in your browser; using the Cookiebot CMP I could then see that by changing the permissions in Cookiebot, the GA cookie was set or not
3. a way to check the Consent Mode variables is by using the Chrome plugin "Google Analytics Debugger" which shows in the F12 console much of the communication with the data layer.

Answer 1

I had too the problem of the GA4 tag firing without consent.

The issue was that I had wrongly set the Default Consent State of Cookiebot CMP to Granted instead of Denied and once I set it correctly, the problem was solved.

In Google Tag Manager:

1. access the Cookiebot CMP Tag
2. modify the Tag Configuration
3. check that the Default Consent State is properly set

Answer 2

You already found out most of your answer, but let me summarize and add to that:

1. When using consent mode the GA4 tag will always fire. Data will be recorded, but the user_pseudo_id identifying the user will be stripped off (source)
2. You can see whether a hit to GA4 had its analytics_storage set to granted or denied based on the gcs parameter of the hit in your DevTools' Network tab:
   • gcs=G100 is denied
   • gcs=G111 is granted
3. And you're right, the GA4 tag shouldn't set any of its cookies (_ga, _gid, etc.) when analytics_storage is denied