Setting Up a Cookie Banner and Google Consent Mode (Step by Step)

Does a Singapore website need a cookie banner?

The PDPA has no cookie-specific rule, but the PDPC explains how its general rules apply in chapter 7 of its Advisory Guidelines on Selected Topics (revised 23 May 2024).

The PDPC adds that a visitor's browser settings can reflect consent, but simply not changing browser settings does not mean they consented. As good practice, it recommends letting people set cookie preferences on your website to enable or disable cookies for personalised ad targeting.

Two further reasons often decide it: Google's EU user consent policy if you have visitors from Europe, and Shopify's privacy settings if you sell to the UK or EEA. Our privacy policy and cookie consent guide covers the notice side.

How Google Consent Mode v2 works

Consent Mode passes the visitor's choices to Google tags, which then change behaviour. Google's EEA consent mode update says advertisers must collect consent from EEA end users and share consent signals to keep using Google tags for measurement, ad personalisation and remarketing, and added two signals for this.

• ad_storage: cookies related to advertising.
• analytics_storage: cookies related to analytics, such as visit duration.
• ad_user_data: whether user data may be sent to Google for advertising.
• ad_personalization: whether ads may be personalised (remarketing).

Google's consent mode overview describes two set-ups. Basic blocks Google tags until the visitor interacts with the banner, so nothing is sent before that. Advanced loads tags with default consent (usually denied); while denied, tags send cookieless pings that Google uses for modelling, and they switch to full measurement once consent is granted.

Set up consent mode in Google Tag Manager

This is the most common set-up for WordPress and custom sites. Google's Tag Manager consent documentation describes the features used below.

1. 1

   Choose a consent management platform (CMP)

   Pick a banner tool with a Tag Manager template that supports Consent Mode v2. Google recommends a Google-certified CMP if you serve EEA visitors.

2. 2

   Add the CMP tag on Consent Initialization

   Fire it on the Consent Initialization - All Pages trigger, which fires before every other trigger. Set default states, typically denied for ad and analytics storage, optionally only for certain regions.

3. 3

   Turn on Consent Overview

   In Admin, Container Settings, select Enable consent overview. It lists which tags have consent configured and lets you bulk-edit them.

4. 4

   Configure each tag's consent settings

   Google tags have built-in consent checks. For non-Google tags such as the Meta Pixel or TikTok, set 'Require additional consent for tag to fire' with the right consent type.

5. 5

   Link the banner choices to consent updates

   Make sure accepting or rejecting a category in the banner sends the matching consent update. Most CMP templates handle this once categories are mapped.

6. 6

   Publish and test

   Use Preview and Tag Assistant to check defaults and updates (next section).

Shopify and WordPress set-up

Shopify. In Settings, Customer privacy, you can enable Shopify's own cookie banner. According to Shopify's privacy settings guide, automated settings show the banner to visitors in the UK and EEA if you have active markets there, and it is off elsewhere by default, although you can choose any region. The Shopify banner governs Shopify's tools and pixels; third-party pixels added manually or through apps may need their own handling.

If you use a third-party banner app, Shopify says to choose one integrated with its Customer Privacy API, set the same consent regions in Shopify and in the app (otherwise non-essential data can be processed before consent), and mention Shopify by name in the banner text. See our Shopify launch checklist for where this fits before going live.

WordPress. Use a consent plugin that supports Google Consent Mode v2 and either loads Google tags itself or works with Tag Manager. Avoid running two systems at once, for example a plugin inserting Google Analytics directly while Tag Manager also loads it, because one copy will ignore consent.

How to test that tags actually respect consent

Google's consent debugging guide uses Tag Assistant to check the default state, the update after the visitor chooses, and how tags behave.

Also check the browser's developer tools (Application, Cookies) after rejecting. If ad cookies such as _fbp or Google Ads cookies appear, something is loading outside your consent set-up, often a hard-coded snippet in the theme or a plugin.

Common cookie banner mistakes

These are the usual faults on small business sites.

• Banner without blocking: the banner is decoration and every tag fires immediately.
• Tags hard-coded in the theme as well as in Tag Manager, so one copy ignores consent.
• Defaults set too late, after Google tags have already loaded.
• Mismatched regions between Shopify and a third-party banner app.
• No way to change your mind later, because the preferences link is missing from the footer.
• Privacy policy not updated to describe the cookies and tools actually used.

Do it yourself or get help?

With Tag Manager and a CMP template, a straightforward site takes a few hours to set up and test. It gets fiddly with several ad platforms, theme-embedded scripts, or a mix of Shopify apps.

IT Sorted's Speed & SEO Fix (S$390) includes script clean-up, which is where duplicate and hard-coded tags are usually found, along with Search Console set-up. The PDPA Compliance Pack (S$690) includes the website privacy policy and a cookie and consent notice that matches what your site actually uses.