To the home page
Contact

Cookie Consent Manager

Google Consent Mode & Tracking

What the plugin sends

When Google Consent Mode V2 is active, the plugin writes the default signals in the <head> — before any tag — and updates them after every decision. The cookie groups are mapped like this:

Cookie group Google signals
statistics analytics_storage
marketing ad_storage, ad_user_data, ad_personalization
comfort functionality_storage, personalization_storage
— security_storage is always granted

The technical names of the groups are what matters. If you create your own group that should drive Google signals, use exactly statistics, marketing or comfort.

dataLayer events

Events are also pushed to the dataLayer so you can trigger on them in Google Tag Manager:

Event When
prems_cookie_consent_accepted Accept all
prems_cookie_consent_rejected Only necessary
prems_cookie_consent_individual Individual selection confirmed
prems_cookie_consent_updated Existing selection changed
PremsCookieConsentUpdate After every consent update, contains consentGroups

Every event carries the details under premsCookieConsent: action, groups, previousGroups, timestamp and consentId.

DOM events

For your own JavaScript there are events on document:

Event When
PremsCookieConsentInitialized On page load when valid consent already exists
PremsCookieConsentAccepted After Accept all or an individual selection
PremsCookieConsentRejected After Only necessary
PremsCookieConsentUpdated After changing an existing selection
PremsCookieConsentGroupLoaded As soon as the scripts of a group have been loaded 
document.addEventListener('PremsCookieConsentAccepted', (event) => {
    console.log(event.detail.groups);
});

Adding GA4 and Google Ads

There are three ways — pick exactly one, otherwise you track twice:

  1. Through Google Tag Manager (recommended). Add the GTM container ID as a cookie/script in the Statistics group, or use the ready-made container from the GTM Integration.
  2. Through the plugin. Enter the GA4 measurement ID and enable Load gtag.js directly through the plugin.
  3. Through a preset. Under Cookies & Scripts → Add preset choose Google Analytics 4 and enter the ID.

Advanced options (premium)

Ads data redaction

While ad_storage is denied, Google removes the identifiers from the ad click URL and sends follow-up requests without cookies. As soon as the Marketing group is accepted, the option turns itself off. Recommended as the default.

URL passthrough

Without marketing consent Google cannot store the click ID (gclid) — the path from landing page to checkout then looks like a new session and the conversion is lost. With URL passthrough gtag.js appends the ad parameters to internal links and forms instead.

Note: the parameters become visible in the address bar and can end up in server logs, referrers or shared links.

Region-specific defaults

A JSON list that sets the default status per region:

[
  {"region": ["DE", "AT", "CH"], "default": "denied"},
  {"region": ["US", "CA"], "default": "granted"}
]

Debug mode

Logs the default status and every later change as [PremsCookieConsent] Consent Mode update: together with the full set of signals to the browser console. A pure developer tool — turn it off on production, otherwise every visitor sees it.

When enabled, the plugin calls fbq('consent', 'revoke') in the head — before the pixel is initialised — and switches to grant as soon as the Marketing group is accepted. The pixel loads, but processes no data until then.

The pixel itself has to be embedded already — through the theme, GTM or as a blocked script of the Marketing group. The plugin does not add it.

Server-side tracking (premium)

Two mechanisms expose the consent status to backend systems:

  • Every storefront response carries the header X-Prems-Cookie-Consent with the accepted groups, e.g. necessary,statistics.
  • On every decision the banner posts the consent record as JSON to the configured endpoint: {consentId, version, configVersion, groups, timestamp, expires}.

The request comes from the visitor's browser. A foreign host has to allow it via CORS, otherwise the call fails silently. A path relative to the shop domain (e.g. /consent-endpoint) avoids CORS entirely. The endpoint is publicly reachable — do not put secrets in the URL.

Cookie settings