Why Your Consent Banner Fires Twice: Duplicate CMP Scripts and How to Find Them

The banner appears twice. Or it appears once, but Google receives two different consent defaults, and your analytics quietly run on the wrong one. The cause is almost never the banner itself. It is the second copy of the banner, installed by someone else, months ago, and never removed.

How duplicates happen

There are three usual ways a site ends up with two consent management platforms. The first is the platform double-install: Shopify, WordPress, or a tag manager loads one CMP from an app or plugin, and a developer hardcodes a second one in the theme. The second is the migration that never finished: the old CMP was replaced, but its script tag stayed in the header, or its GTM template stayed on the Consent Initialization trigger. The third is the template conflict: two GTM templates that both configure Google Consent Mode, like the iubenda template and the Simo Ahava template running at once, each sending its own default signal.

OneTrust's own documentation warns about exactly this: if you use the CMP template, remove any other banner scripts already implemented, because running two banner scripts simultaneously leads to unexpected behaviors. MineOS puts it more bluntly in its GTM guide: adding a duplicate consent-init tag is unnecessary and can cause race conditions. The symptom is usually subtle. The banner looks fine. The consent signals do not agree, and the tags fire on the wrong one.

What two signals do to Consent Mode

Google Consent Mode reads the consent default and the consent update, and it expects one of each. When two CMPs both send defaults, Google receives multiple default consent signals, and the last one to arrive wins, or the two fight and the state flips. The iubenda troubleshooting guide lists this as a distinct failure: multiple consent signals sent because there are multiple cookie banners from different CMPs installed on the website, which happens when platforms like Shopify double-manage Consent Mode. The result is tags firing before consent, or consent granted by default before any explicit user action, which violates the principle of obtaining consent through explicit, positive action.

The ordering problem sits beside it. If the CMP script loads after the Google scripts, the Google tags fire before users can make their choices, and the default consents pass as granted without user consent. The fix is order: the CMP script goes before any Google script, and neither uses async or defer in a way that breaks the sequence. Google Tag Gateway can produce the same late-signal problem even when the banner is in the right position, because Google tags may load through a CDN before the banner runs. That is a second place to look when the order looks right and the signals are still late.

The audit that finds the duplicate

Open the page source and search for the CMP names: iubenda, Cookiebot, otSDKStub for OneTrust, Usercentrics, CookieYes, Complianz. One name should appear once. Two names, or one name twice, is the duplicate. Then open GTM Preview, load the site in a fresh incognito window, and watch three things: the Consent Default event should appear near the top, before the first Container Loaded; the Consent Update should appear once a choice is made; and the Consent tab on any event should show one default and one update, not two. If you see two defaults, you have two CMPs, and the fix is removing one, not configuring both.

The stakes are not cosmetic. On 19 March 2025 the Administrative Court of Hannover ruled that loading GTM itself needs consent, because the GTM request sends the visitor's IP address and device details to Google before they have made any choice. A duplicate CMP does not just confuse Consent Mode. It can mean the consent the site claims to have was never validly obtained, and the banner the visitor saw was the second copy, not the first. For the mode the banner is supposed to drive, see Consent Mode v2: Basic vs Advanced, and What Actually Changes. For the cost of the tag the banner gates, see Consent Banner Performance: What the Tag Actually Costs.

Frequently asked questions

How do I know if I have two CMPs installed?

Open the page source and search for CMP names like iubenda, Cookiebot, otSDKStub, Usercentrics, or CookieYes. One name should appear once. Two names, or one name twice, means a duplicate.

What happens when two CMPs send consent signals?

Google receives multiple default consent signals, and the last one wins or the two fight. Tags can fire before consent, or consent can pass as granted without any explicit user action.

Where should the CMP script sit in the page?

Before any Google scripts, and without async or defer breaking the sequence. If the CMP loads after the Google tags, those tags fire before the user can choose.

Can a duplicate CMP cause a compliance problem?

Yes. If consent was never validly obtained because two banners conflicted, the consent the site claims to have may not hold up. A court in Hannover ruled in March 2025 that loading GTM itself needs consent.