Scope Consent Mode to specific countries or regions

This guide shows you how to apply your Consent Mode v2 defaults only to specific countries or subdivisions, instead of every visitor everywhere. Available in GTM Kit 2.9 and later.

Why scope by region

Consent regulation varies by country. EU countries, the UK, and Switzerland enforce strict opt-in. The US, most of Asia, and most of Africa are opt-out or unregulated.

If you have visitors from both kinds of markets, applying denied-by-default to everyone hurts measurement for visitors who do not legally need to see a consent banner. The region parameter solves this: GTM Kit’s defaults apply only to the countries you list. Visitors from other countries get whatever is the implicit default in your other tags (usually “granted everything” since there are no defaults to override).

Steps

1. Decide which countries you need defaults for

The conservative answer is “every country with GDPR, ePrivacy, or similar regulation”:

  • All EU member states.
  • UK (PECR / UK GDPR).
  • Switzerland (revFADP).
  • Norway, Iceland, Liechtenstein (EEA).
  • Brazil (LGPD).
  • California (CCPA / CPRA), if you treat it as opt-in.

You can list them by ISO 3166-1 alpha-2 country code (DK, DE, FR, IT, ES, NL, SE, BE, IE, AT, FI, PT, GR, PL, CZ, HU, RO, BG, HR, SK, SI, EE, LV, LT, LU, MT, CY, GB, CH, NO, IS, LI, BR).

You can also list subdivisions with ISO 3166-2 codes, e.g. US-CA for California, DE-BY for Bavaria.

Go to GTM Kit, General, scroll to Google Consent Mode, find the Region field.

3. Enter region codes

Enter codes separated by commas or as a tag-style input. The plugin accepts upper or lower case and trims whitespace; invalid entries are silently dropped. Examples that pass validation: DK, de, US-CA, gb. Examples that are dropped: Denmark, EU, 123.

4. Save

The next page render emits the consent block scoped to your region list:

<script>
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    // ...
    'region': ['DK','DE','FR','IT','ES','NL','SE','GB']
  });
</script>

How Google interprets the region list

Google determines the visitor’s region from the IP address and matches it against your list. If the visitor is in a listed country, your defaults apply. If they are not, the defaults do not apply and tags use whatever fallback state is configured in the workspace.

This means: visitors from listed countries see the strict denied-by-default behavior; visitors from other countries do not. Your CMP banner can also be configured to only show in listed countries to reinforce this.

Combining with multiple default blocks

Google Consent Mode supports multiple default calls with different region lists, applied in order. GTM Kit currently emits one default block. If you want different defaults for different regions (e.g. all denied in DE, only ad_storage denied in NL), the cleanest path is your CMP.

Verify it worked

View source. The region array in the consent default block should match your list.

If you have a way to simulate non-listed-country traffic (a VPN, a debug header, or your CDN’s geolocation simulator), test that:

  • Visitors from listed countries: GTM tags requiring analytics_storage do not fire until update.
  • Visitors from non-listed countries: tags fire normally.

Common issues

The region array is empty in source. You either left the field blank (defaults apply globally) or every entry was invalid and dropped. Re-check: codes must be ISO 3166-1 alpha-2, optionally with ISO 3166-2 subdivision after a hyphen.

Tags fire for EU users despite being on the list. Your CMP’s banner code may be calling gtag('consent', 'update', ...) with granted everything before the user clicks Accept. Audit the CMP’s behavior in DevTools.

You added US-CA but California traffic is still treated as opt-out. Region matching needs Google’s geolocation to identify the visitor’s subdivision. This works for US states. If your traffic is going through a CDN or proxy that masks the visitor’s IP, geolocation may resolve to the proxy location instead. Configure your CDN to forward the original client IP.

Filter hook

For developers, the region list can be overridden in PHP:

add_filter( 'gtmkit_consent_region', function ( $regions ) {
    // Add California dynamically based on a feature flag.
    if ( my_feature_flag( 'ccpa_strict' ) ) {
        $regions[] = 'US-CA';
    }
    return $regions;
} );