Consent Management: Configuring Google Tag Manager

In this tutorial, we'll configure Astralis consent to ensure tags only fire with consent from a Tag Manager. In this example, we'll use Google Tag Manager, however, these steps are also applicable to similar tag managers such as Adobe Tag Manager and Tealium.

After reading this, you'll be familiar with how to configure tags to respect consent.

Prerequisites

For this tutorial you'll need:

• The role of Owner or Contributor for your Astralis organization.
• Update and publisher permissions on your Google Tag Manager account.
• At least one system with a data use on your Data Map. Read how to add systems to the Data Map now.
• At least one privacy notice configured. Read how to configure privacy notices now.
• At least one privacy experience configured. Read how to configure privacy experiences now.
• Installed Fides.js on your web site. Read how to install fides.js now.

Regulation information

When implementing Astralis and Google Tag Manager for use in Europe and Germany specifically, seek the advice of your legal counsel on the proper implementation. In response to their advice, you may wish to load the GTM javascript only after consent is obtained from Astralis. To accomplish this, ensure that Astralis is loaded and initialized before Google Tag Manager. You can read more about this in the Fides.js documentation here.

Once Astralis is initialized, you should defer any loading of GTM javascript until after consent is obtained. The specific consent you wish to use to load GTM is a choice you and your legal counsel will need to make. Once you have obtained the agreed upon consent, you can check for it using the Astralis interface and load GTM based on the user's consent.

Create a GTM Variable

1. Navigate to Variables → New to create a new GTM Variable.
2. From the Choose variable type menu, select Data Layer Variable as the type:

3. Set the Data Layer Variable Name to the corresponding cookie key of the privacy notice you configured. In this example, we use Fides.consent.data_sales_and_sharing. Read about creating cookie keys as part of privacy notices here.
4. Give the variable a suitable, identifiable name, such as Fides.DataSalesAndSharing. In certain cases, you may want to set a default value. For example, in opt-out consent, you would set the default value to true. See the example below:

Configure a Trigger

Many third-party tools rely on you to correctly configure their tags to fire depending on user consent. A single consent trigger tag ensures that a third-party tag only fires when a user’s consent is appropriately set.

1. Navigate to Triggers → New to create a new Trigger.
2. From the Choose a trigger type menu, select the appropriate trigger, this can be anything you choose but is typically Page View or Custom Event:

3. Give the trigger a suitable, identifiable name, such as Fides.DataSalesAndSharing.OptOut
4. Set “This trigger fires on” to Some Page Views.
5. In the “Fire this trigger when…” option, set the following:
   • The event field to match your user-defined variable earlier (e.g. Fides.DataSalesAndSharing)
   • The evaluation to equals
   • The value to false

To suppress tags from firing where the user hasn't given consent, you can add your newly created trigger using the following steps:

1. Navigate to Tags and select the Tag you would like to add a consent trigger to.
2. Under Triggering you can add, remove or combine triggers. In this case, you are adding an exception that will suppress firing where you do not have consent. Select Add Exception to add your newly created trigger.
3. Select the consent trigger created earlier (e.g. Fides.DataSales.Consent), which will add it as an exception to your tag:

You should now see your trigger listed in your tag as an Exception. When configured as outlined in this tutorial, this tag will no longer fire if a user has opted out of Data Sales.

Configure Limited Data Use for Meta (Facebook)

Meta's implementation of data sales is unique to their platform, and requires specific configuration in Google Tag Manager.

To implement the Limited Data Use flag, the following modifications to your pixel are required:

1. Add the line below before the Facebook pixel is initialized fbq('init', '{{YOUR_FACEBOOK_PIXEL_ID}}');

{{Fides.DataSalesAndSharing}} ? fbq('dataProcessingOptions', []) : fbq('dataProcessingOptions', ['LDU'], 0, 0);

Save your changes. Limited Data Use is now set when the pixel loads.

Update the Meta Pixel when consent changes

The steps above control the pixel when it first loads. They don't run again if the user changes their consent later. On a single page app, the page doesn't reload, so a pixel that loaded after an opt in keeps running after the user opts out. Astralis deletes the _fbp cookie on opt out, but the running pixel keeps sending events to Meta. Unless Continuous cookie deletion is on, it can also set _fbp again. A trigger that only controls when the pixel tag loads isn't enough to handle this.

To update the pixel when consent changes, add a tag that passes the user's choice to Meta's own consent controls every time Astralis updates consent. Fides.gtm() pushes a FidesUpdated event to the data layer whenever the user's consent changes, which you can use as a trigger.

1. Navigate to Triggers → New, and select Custom Event as the trigger type.
2. Set the Event name to FidesUpdated, set the trigger to fire on All Custom Events, and give it a name such as Fides.Updated.
3. Navigate to Tags → New, and select Custom HTML as the tag type.
4. Add the following code. Replace {{Fides.DataSalesAndSharing}} with the variable you created for the privacy notice that covers the Meta Pixel.

<script>
  (function () {
    if (!window.fbq) return;
    var ok = {{Fides.DataSalesAndSharing}} === true;
    var geo = window.Fides && window.Fides.geolocation;
    if (geo && geo.country === "US") {
      window.fbq("dataProcessingOptions", ok ? [] : ["LDU"], 0, 0);
    } else {
      window.fbq("consent", ok ? "grant" : "revoke");
    }
  })();
</script>

5. Under Advanced Settings → Tag firing options, select Unlimited so the tag fires on every consent change.
6. Under Triggering, select the Fides.Updated trigger you created.
7. Save and publish your container.

Outside the US, revoke stops the pixel completely and grant turns it back on. In the US, the tag sends Meta's Limited Data Use signal instead, which lets the pixel keep running while Meta limits how it uses the data. If you want the pixel fully off for US users who opt out as well, use revoke everywhere.

For more detail, including the Conversions API and how to test your setup, see Meta Pixel in the Fides.js installation guide.