Google Tag Manager Needs Consent: 2026 Ruling

The VG Hannover ruling in plain terms

On 19 March 2025 the Hanover Administrative Court dismissed a website operator's lawsuit against an order issued by the data protection authority (case 10 A 5385/22). The authority had objected to two things: first, the cookie banner lacked an equivalent option to reject all non-essential cookies at the first level; second, Google Tag Manager was embedded without prior consent. The court upheld both objections and confirmed that the order was lawful (VG Hannover, 19 Mar 2025).

The central finding on GTM: simply embedding the manager already accesses the user's device and triggers a data transfer - namely by loading the gtm.js script from Google servers (VG Hannover, 19 Mar 2025). That access falls under Section 25(1) TDDDG and is impermissible without prior consent, unless the tag manager provides only strictly necessary functions. In addition, the court required a 'reject all' button equivalent to the 'accept' button in visibility, accessibility and placement (VG Hannover, 19 Mar 2025).

Why merely fetching the script already counts

Many operators assume the tag manager is just an 'empty container' that tracks nothing itself and may therefore run without consent. That view falls short. Section 25(1) TDDDG covers two acts: storing information on the device and accessing information already stored on it (Section 25 TDDDG). The very connection to googletagmanager.com to load gtm.js triggers such access and transmits technical data such as the IP address to a third party (VG Hannover, 19 Mar 2025).

There is also the third-country issue: gtm.js is loaded from Google servers, which may transfer personal data to the United States (VG Hannover, 19 Mar 2025). Such transfers face additional requirements from Chapter V GDPR on top of the consent obligation. If you want to know exactly which data leaves on the first page load, it is best measured actively - the article on measuring data flow and third-country transfer shows the method.

How widespread the problem is

The reach of the ruling follows from the tool's market position. Among all websites that use a tag manager at all, 94.3% run Google Tag Manager (W3Techs 2026). According to BuiltWith analyses, GTM runs on a large share of the world's most visited websites (BuiltWith 2026). At the same time, consent handling is poor across the board: a peer-reviewed large-scale study from 2025 analysing more than a quarter of a million websites found that only about 15% of consent banners meet the minimum requirements for valid consent (Large-Scale Web Tracking Study 2025).

The picture sharpens with actual tracking behaviour: more than 50% of websites set cookies before the user had made any choice at all (Large-Scale Web Tracking Study 2025). Around 67% of the sites studied showed a consent interface, yet a large share offered no equivalent rejection (Large-Scale Web Tracking Study 2025). This exact pattern - scripts and cookies before the click, no genuine 'reject' - is what VG Hannover objected to.

What a breach costs legally and commercially

The sanctions sit on two levels. Access without consent fulfils the fine provision of Section 28(1) no. 13 TDDDG and can be penalised with up to 300,000 euros (Section 28 TDDDG). Depending on the constellation, enforcement lies with the Federal Network Agency or the data protection authority (Section 28 TDDDG). If unlawful processing of personal data is added, the GDPR fine range of up to 20 million euros or 4% of worldwide annual turnover applies (Article 83 GDPR).

Besides fines, a second and often faster danger looms: warning letters from competitors or specialised law firms. Missing or deficient consent solutions are pursued as unfair-competition breaches, similar to what the article on the BFSG warning-letter wave over missing accessibility describes for digital accessibility. In practice, these civil-law letters tend to reach operators fastest - long before a supervisory authority steps in.

The typical consent mistakes at a glance

Four failure patterns keep appearing in practice. They share one trait: the user is tracked before validly consenting.

How to check whether tags fire before consent

Whether your website is affected can be determined by simulating the first page visit - the state before any consent has been given. The practical steps:

1. Simulate a first visit: open the page in a fresh state with no consent set, so you see exactly what a new visitor triggers.
2. Watch the network requests: check whether a request to googletagmanager.com (gtm.js) goes out before the banner is answered - this fetch is the decisive point (VG Hannover, 19 Mar 2025).
3. Log cookies and storage access: capture every cookie and every access to device storage that occurs before the click (Section 25 TDDDG).
4. Break down third-party connections: record which domains and which countries data flows to, to assess the third-country question (Article 83 GDPR).
5. Repeat regularly: a deploy, a new marketing tag or a changed container configuration can flip the state at any time - a one-off check is not enough.

Setting up consent cleanly - the right order

The technical fix is straightforward: nothing that requires consent loads before consent. This applies to the GTM container just as much as to every individual tag. This sequence has proven itself:

• Blocker first: the consent tool loads before everything else and blocks all non-essential scripts until a decision is made.
• GTM only after 'accept': the container is loaded solely once the user has actively consented - technically via an event, not via an already embedded snippet.
• Equivalent rejection: 'accept' and 'reject' stand on the first level as equals (VG Hannover, 19 Mar 2025).
• Document consent: the time, scope and version of consent are stored verifiably to be able to prove the consent (Article 6(1)(a) GDPR).
• Enable withdrawal: the user must be able to withdraw their decision as easily as they gave it.

In code this means: the standard GTM snippet in the <head> is replaced by a function that fires only after documented consent. A schematic example:

<!-- Wrong: GTM loads immediately in <head>, before any consent exists -->
<script>(function(w,d,s,l,i){/* gtm.js is loaded straight away */})(window,document,'script','dataLayer','GTM-XXXX');</script>

<!-- Right: load GTM only after documented consent -->
<script>
  function loadTagManager(){
    var s = document.createElement('script');
    s.src = 'https://www.googletagmanager.com/gtm.js?id=GTM-XXXX';
    document.head.appendChild(s);
  }
  // The consent tool calls this ONLY after the visitor clicks 'Accept'
  window.addEventListener('consent:granted', loadTagManager);
</script>

If you would rather avoid consent-requiring cookies altogether, the article on cookieless analytics without consent banners shows an alternative route, and the fundamentals of a legally sound banner are covered in the guide to implementing cookie consent correctly.

Monitor continuously instead of checking once

A clean consent configuration is not a permanent state. It tips over precisely when no one is watching: a marketing team adds a new pixel, an update changes the container logic, a developer comments out the consent gate 'just to test'. Such regressions stay unnoticed without ongoing control, until a warning letter makes them visible.

Because tags are often loaded through the container, watching consent behaviour belongs together with controlling embedded scripts. The article on monitoring consent tag drift deepens the pattern, and script integrity monitoring fires when a third-party script silently changes its behaviour. Complemented by alerting across multiple channels, the snapshot becomes an early-warning system.

Uncover pre-consent tracking with XICTRAQ

After the VG Hannover ruling, the question is no longer whether Google Tag Manager requires consent, but whether your container obeys the rule. That cannot be ticked off once - every deploy, every new tag and every changed consent configuration can alter the state. That is why the check belongs in the same toolbox as running cookieless analytics, which works without consent-requiring cookies from the outset.

XICTRAQ reproduces a first visit without consent, detects every tracker and every gtm.js fetch before consent and reports deviations automatically. Combined with the GDPR scanner for mandatory pages and pre-consent trackers, you see in one place whether banner, scripts and data flows fit together. Anyone looking for a privacy-friendly analytics alternative instead of a tracker sidesteps the consent problem at its root.

Start with the free test and check what your homepage really loads on the first visit. Or see in a personal demo how pre-consent detection and alerting work together day to day.