Meta - Consent and tag gating

Analytics and advertising tags read and write information on a visitor's device. In many countries, including across the EU, that requires the visitor's permission first. This article explains how consent works in practice with a story, and how to make sure tags only fire when they're allowed to.

💡 In one sentence: a consent banner loads before Tag Manager, records what the visitor allows, and Tag Manager holds each tag back until the matching permission is granted.

⚠️ This article describes how the mechanics work. It isn't legal advice — which tools need consent, and on what basis, is a decision for the client and their data protection officer.

It's a banner, not a wall

Worth getting the terminology right, because the two are treated very differently.

A consent banner asks permission and respects the answer. If the visitor declines, the story still plays; the tags just stay silent.

A cookie wall makes access conditional on accepting. European regulators have been explicit that this isn't acceptable, so Reject has to be a real option that still lets someone view the story.

Practical consequences for the design:

Accept and Reject should be equally prominent. Making Reject harder to find is treated as a dark pattern.
Don't block the whole screen if you can avoid it. Let the story's cover render, then show a compact bar or bottom sheet.
The visitor must be able to change their mind later, so keep a way back to the choice.

The four permissions

Google's consent framework splits permission into four types. Tag Manager can check each one independently.

Permission	Covers
`analytics_storage`	Analytics measurement — Google Analytics needs this
`ad_storage`	Advertising identifiers — the Meta pixel and Google Ads need this
`ad_user_data`	Sending user data to an advertising platform
`ad_personalization`	Using the data for personalised advertising and audiences

A consent tool only works if it runs before Tag Manager, so it can set every permission to denied by default before any tag has a chance to fire.

That's what the Header scripts field is for. Go to Project settings → Tracking & scripts → Header scripts and paste the consent tool's snippet there. It's injected at the end of the page head, ahead of the container.

⚠️ Header scripts is an admin-only field, same as the Tag Manager ID. If you can't see it, ask an admin in your organisation.

Use a certified consent management platform rather than building the banner yourself. The visible bar is the easy part; the parts that are expensive to get wrong are storing a record of each consent, versioning the text people agreed to, and handling withdrawal. Most consent platforms allow full restyling, so you can still make it look like part of the story.

Step 2 — Set defaults to denied

Configure the consent tool so all four permissions start as denied and are only granted when the visitor agrees. This is what "prior consent" means in practice: nothing fires until someone says yes.

Step 3 — Gate each tag in Tag Manager

Now tell each tag what it needs. Open the tag, go to Advanced Settings → Consent Settings, choose Require additional consent for tag to fire, and add the relevant permissions.

Tag	Require
Google tag and all Analytics event tags	`analytics_storage`
Meta pixel base and all Meta event tags	`ad_storage`, `ad_user_data`, `ad_personalization`

⚠️ Tags are created with no consent requirement by default, which means they fire regardless of what the visitor chose. Setting this on every tag is the step that actually makes the banner do something. It's easy to build a banner, publish it, and still be sending everything.

What happens when someone declines

The two platforms behave differently, and it's worth knowing before you promise a client a number.

Google Analytics degrades gracefully. With consent mode configured, Google models the conversions it can't observe, so you keep an estimate rather than a hole.
Meta does not. Declined means Meta receives nothing at all for that visitor.

💡 Plan for the arithmetic. Measured conversions are roughly consent rate × actual conversions. At a 60% consent rate you need about 85 real conversions for Meta to see 50. This directly affects the volume thresholds in Meta pixel and campaign tracking strategies — build it into expectations at the start rather than explaining it three weeks in.

Where the story runs changes how much work this is.

How visitors reach the story	What that means for consent
Embedded on the client's own website	Simplest. The client's existing banner already governs the page, and the visitor isn't asked twice. Pass the consent state into the story frame so its tags respect the same choice.
A direct link to the story	The story needs its own banner, because a choice made on another website doesn't carry across to a different domain.

Consent given on clientwebsite.com does not apply on a different domain — browsers keep them separate. So a visitor who already accepted cookies on the client's site will be asked again on a directly linked story. That's expected behaviour, not a bug, and it's the main argument for embedding stories where you can.

Keep product analytics separate from advertising

A useful distinction when you design this: Intractive's own story statistics in the Insights tab are not the same thing as an advertising pixel. Set it up so that declining consent switches off Analytics and Meta while the client keeps their basic story reporting.

The Session persistence setting under Privacy & GDPR in project settings controls how long a story session is remembered: loose keeps it between visits, strict clears it when the tab closes. Note that this governs the story's own session only — it does not gate Analytics or Meta tags, which is what the steps above are for.

✅ Quick checklist

A banner with a working Reject, never a wall. Accept and Reject equally prominent.
Consent tool goes in Header scripts so it loads before Tag Manager.
All four permissions default to denied.
Set Consent Settings on every single tag — without this the banner does nothing.
Analytics models around declines; Meta gets nothing.
Embed the story where possible so the client's existing banner covers it.
Session persistence is not a consent setting.

Updated on: 24/09/2026

Was this article helpful?

Thank you!