# Your Banner Arrived After the Tags Already Fired

Source: https://bannerbulwark.com/blog/2026-11-11-consent-banner-load-order-tags-fired.html

November 11, 2026

*The banner appears. The shopper has chosen nothing. Google tags are already sending full hits with cookies. The banner is not broken, and the consent choice is not broken either. The order is broken: the tags loaded before the denied default was set, and in the window between the two, everything fired unrestricted. The data looks complete, which is exactly why nobody notices. Complete data is the symptom of this failure, not the proof that everything works.*

## The failure you cannot see in reporting

There are two failure modes, and they look opposite in the data. In the first, tags fire before consent: the banner appears, the user has chosen nothing, and Google tags are already sending full hits with cookies. This is a compliance exposure, and it is invisible in reporting because the data looks complete. In the second, consent updates never arrive: the default is denied, the user accepts, and nothing changes because the banner never calls the update, so all EEA data disappears. The first failure looks like success. The second looks like a traffic collapse. Both come from ordering, and both are fixed by ordering.

The cause is usually the same. The default consent call runs after the container or the tag has already loaded, instead of in the document head, above everything. If no consent default is ever set, Google treats every consent type as granted. Not configured does not mean blocked. It means everything fires. A CMP template that fires on the Consent Initialization trigger in GTM is loaded through GTM, which means the container loads first, and the banner lives inside the thing it is supposed to gate.

## G100 vs G111, the five-minute check

The fastest verification is the gcs parameter on any Google request in the browser's network panel. G100 means ad\_storage denied and analytics\_storage denied. G111 means both granted. Before consent there should be no \_ga cookie and no advertising cookies, and gcs should read G100, which is Advanced Consent Mode working: tags loaded, in a restricted state, sending a cookieless ping. After the shopper accepts, gcs should become G111 and cookies should be set. If the request shows G111 before the shopper chose, that is the compliance failure, and the default is running too late.

Two more checks complete the picture. The denied state must persist: if the second page shows granted, the choice is not being stored or restored, and every page view re-asks. And the stored choice should be restored before tags act on the default: if a returning acceptor briefly shows denied and then granted, the wait\_for\_update window may be too short, or the restore is happening after the tag has already sent.

## The ordering fix

The default consent call must execute before any Google tag loads. Not in GTM, not after the container snippet, not in a tag that fires on page view: in the document head, above everything. On Shopify this is the hard case, because the platform, not the merchant, decides when things load, and Consent Mode v2 on Shopify covers the most common version of this problem. The verification is the same either way: open the network panel, load the page, and read gcs before touching the banner. G100 is the answer you want. Anything else is a load-order bug wearing a consent banner. For the banner that fires twice, see [why your consent banner fires twice](2026-11-09-consent-banner-fires-twice-duplicate-cmp.md), and for the mode choice that decides what the tags do, [Consent Mode v2 basic vs advanced](2026-11-08-consent-mode-v2-basic-vs-advanced.md).

## Frequently asked questions

### What does gcs=G100 mean?

It means ad\_storage denied and analytics\_storage denied. Tags are loaded in a restricted state, sending a cookieless ping. Before consent, that is the correct state for a compliant Advanced Consent Mode implementation.

### What does gcs=G111 mean before the shopper chooses?

Both storages granted, which is the compliance failure. The default consent call is running too late, after the container or tag has already loaded. It must be the first script in the head, above everything else.

### Why does our data look complete if consent is broken?

Because tags firing before consent send full hits with cookies, so the data looks complete. That is the symptom of the failure, not proof it works. A compliant setup shows restricted, cookieless pings before consent, not full hits.

### Does a CMP loaded through GTM satisfy Consent Mode?

Usually not. A CMP template firing on the Consent Initialization trigger loads through GTM, which means the container loads first. The banner has to run before any Google tag loads, in the document head, not inside the container it is supposed to gate.