In server-side GTM, tag order matters for consent compliance. If you fire a tag that sends data to Facebook before checking consent status, you’ve violated consent rules. This isn’t a performance issue—it’s a legal issue. This guide covers tag ordering strategies that ensure consent is evaluated first, then dependent tags fire conditionally based on the user’s consent preference.

The Consent-First Principle in Server-Side GTM

The core principle: Always evaluate consent before firing any tag that processes personal data.

• 1. Receive event in server-side container
• 2. Evaluate consent signals (from request headers, cookies, data layer)
• 3. Set consent variables in container memory
• 4. Fire data collection tags ONLY if consent is true
• 5. Fire non-personal-data tags regardless of consent

Tag Ordering in Server-Side GTM

Server-side GTM tag order depends on alphabetical naming, explicit trigger sequencing, or tag dependencies. Use numeric prefixes in tag names to control execution order:

• 01_Consent_Evaluation
• 02_Set_Consent_Variables
• 03_GA4_Tag (fires only if consent = true)
• 04_Facebook_Tag (fires only if consent = true)
• 05_Logs_and_Monitoring (fires always)

Reading Consent Status from Multiple Sources

Evaluate consent in priority order: request headers first (CMP might set consent header), then cookies (Google Consent Mode or custom consent cookie), then data layer values passed from client-side GTM, and finally default to deny if consent is unknown.

function getConsentStatus(request, event) {
  const headerConsent = request.getHeader('X-Consent-Analytics');
  if (headerConsent) return headerConsent === 'true';

  const cookieConsent = getCookie('consent_status');
  if (cookieConsent === 'granted') return true;
  if (cookieConsent === 'denied') return false;

  if (event.data && event.data.consentStatus) {
    return event.data.consentStatus === 'granted';
  }

  return false; // Default: deny if unknown
}

Compliance Best Practices

• Never send personal data without explicit consent. If unsure, deny.
• Log consent decisions: Keep audit trail of which requests were consented/denied
• Allow consent withdrawal: If user later denies consent, stop sending data
• Handle consent updates: If consent changes mid-session, update behavior immediately
• Test thoroughly: Verify that non-consented requests actually don’t send personal data

Testing Consent Tag Ordering

Use your server-side GTM’s preview mode to verify consent handling. Send a request with consent = granted and verify all tags fire. Send one with consent = denied and verify only non-personal-data tags fire. Check server logs to ensure no personal data is sent when consent = denied.

Server-side GTM’s tag ordering becomes a compliance control, not just a performance optimization. Get it right and you’re respecting user privacy while maintaining tracking accuracy.

Related guides: Server-Side GTM Client ID, GA4 Consent Mode v2, GTM Variable Priority.