Google Tag Manager and Cookie Consent: A U.S. Compliance Guide

Google Tag Manager is a fixture of U.S. marketing stacks because it lets teams add, edit, and fire tracking tags without touching the website’s underlying code. That convenience is also why it sits at the center of a growing amount of legal risk. GTM itself is a relatively neutral piece of infrastructure, but the tags it fires, and the data those tags collect, are exactly what U.S. privacy laws and, increasingly, U.S. courts have started to scrutinize.

This guide walks through what GTM actually does, where U.S. compliance obligations come from, how to configure GTM to respect visitor consent, and what it can cost a business to get this wrong.

What Is Google Tag Manager (GTM)?

Think of Google Tag Manager as a control panel for everything a website tracks. Instead of hand-coding a separate snippet for Google Analytics, Google Ads, Meta Pixel, and half a dozen other tools, a business drops one GTM container into its site and manages everything from there.

Inside GTM, “tags” are the snippets of tracking code, and “triggers” are firing instructions configured by the business, such as when a customer makes a purchase. 

A business might set an analytics tag to fire on every page view, and a separate conversion tag to fire only when a visitor reaches an order confirmation page. This setup lets marketing teams add or adjust tracking without looping in a developer for every change.

Does Google Tag Manager Use Cookies?

Not on its own. The GTM container itself doesn’t set cookies for regular visitors. The one exception is Preview and Debug mode, which sets a handful of temporary, first-party cookies so an administrator can test changes, and those are cleared once the session ends.

What GTM does is deploy other tools, and many of those tools set cookies of their own. Google Analytics, advertising pixels, and session-replay tools all commonly rely on cookies once they’re implemented through GTM, and it’s that downstream activity that creates a consent obligation, not GTM itself.

U.S. Compliance Obligations Google Tag Manager Can Trigger

Because GTM is typically the delivery mechanism for a website’s tracking, cookie consent and privacy compliance conversations tend to start there, even though the underlying legal obligations sit with the individual tags a business chooses to run. In the U.S., three separate bodies of law are worth tracking.

State Comprehensive Privacy Laws

The CCPA and CPRA give California consumers rights over their personal information, including the right to opt out of the sale or sharing of that data, and most tags fired through GTM (advertising and analytics tools especially) fall within scope.

As of 2026, CPPA-adjusted penalties run up to USD 2,663 per unintentional violation and USD 7,988 per intentional violation or one involving a consumer known to be under 16, and the revenue threshold to qualify as a covered business is USD 26,625,000 in annual gross revenue. (These amounts are adjusted periodically for inflation, with the next one due in 2027.)

California isn’t alone. Other U.S. states — including Colorado, Connecticut, Virginia, and a growing list of others — have their own comprehensive privacy laws with broadly similar opt-out requirements, though the specifics vary by state.

Wiretapping and Video Privacy Statutes: A Multistate Risk

This is the part of the U.S. landscape that catches businesses off guard, because none of these are privacy statutes in the usual sense, and GTM often sits at the center of nearly all of them.

The technologies plaintiffs point to in these cases, chat widgets, session-replay tools, analytics pixels, advertising pixels, and video embeds, are exactly the kind of tags a typical GTM container is built to manage. 

Whether a given tag fired before or after a visitor made a consent choice is often the central factual question in these cases, which makes GTM’s tag-sequencing and trigger logic a legal question as much as a marketing one, not a detail that only shows up after something has already gone wrong. 

So what’s going on? Starting around 2022, a cluster of older wiretapping and video-privacy laws, originally written for phone taps and video rental records, became the basis for a still-growing wave of lawsuits arguing that these ordinary, GTM-managed technologies amount to unlawful interception or disclosure. 

What began as a California-specific trend has spread to other states and to federal court, and a GTM container built to satisfy one state’s claim doesn’t automatically satisfy another’s. 

This is also not unique to GTM. For example, if you just inject the code on the site, you are subject to the same regulatory obligations as if you were using GTM. The difference is that GTM makes it easier to audit your tag and consent setups.

California Invasion of Privacy Act (CIPA)

CIPA, a 1967 wiretapping law, remains the most heavily litigated of these statutes. Under Penal Code Section 637.2, a plaintiff can recover the greater of USD 5,000 per violation or three times actual damages, without needing to prove financial harm, which is part of why this theory has attracted so much litigation.

Florida Security of Communications Act (FSCA)

FSCA is a similarly old, all-party consent wiretapping law now being applied to session-replay tools, chat widgets, and pixels, particularly following a 2025 federal court ruling that let a claim against a healthcare website’s tracking pixels proceed past dismissal. The case was later voluntarily dismissed without a final ruling on the merits, but the pleading-stage precedent stands. 

Statutory damages run to USD 1,000 per violation, or USD 100 per day of violation, whichever is greater, a lower floor than CIPA’s but still enough to fuel a rising volume of demand letters and small-claims filings.

Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA)

Pennsylvania’s WESCA, another all-party consent statute, has generated a comparable wave of claims since a 2022 Third Circuit ruling found that a third-party marketing vendor receiving website interaction data could itself be an unlawful interceptor. 

Damages run to the greater of USD 100 per day or USD 1,000, plus punitive damages and attorney’s fees. Pennsylvania has no general comprehensive privacy law, which is part of why this statute has become such a common vehicle there.

Federal: Electronic Communications Privacy Act (ECPA)

The ECPA, or Wiretap Act, is a one-party consent statute, meaning a website’s own consent to its tracking tools would ordinarily satisfy the law. Plaintiffs have increasingly worked around this through a “crime-tort exception,” arguing the tracking serves an independent unlawful purpose, an argument that has succeeded more often in healthcare-sector cases than elsewhere. 

Because ECPA is federal, claims aren’t limited to one state’s residents. Damages run to the greater of actual damages or USD 100 per day of violation, with a USD 10,000 floor.

Federal: Video Privacy Protection Act (VPPA)

The VPPA, originally passed in 1988 to protect video rental records, has become a common basis for lawsuits against businesses that embed video content and share viewing data through pixels such as Meta Pixel. 

Damages start at USD 2,500 per violation. The U.S. Supreme Court has agreed to decide who qualifies as a “consumer” under the statute, a question that could expand or narrow its reach considerably.

These statutes overlap in practice, and they overlap specifically around GTM. The same tag, a chat widget, a session-replay script, an ad pixel, fired from the same container, can raise a CIPA question for a California visitor, an FSCA question for a Florida visitor, a WESCA question for a Pennsylvania visitor, and an ECPA or VPPA question regardless of where the visitor is, depending on what the tag does and what content it touches. A GTM setup built to satisfy one state’s claim generally can’t be assumed to satisfy the rest.

On the California side specifically, SB 690 has now passed both chambers of the Legislature (August 31, 2026) and is awaiting the Governor’s signature. If signed, it would take effect January 1, 2027, and would narrow the pen-register/trap-and-trace theory specifically, while leaving CIPA’s broader wiretapping and eavesdropping provisions, and every other statute above, fully in play. It isn’t law yet.

Global Privacy Control (GPC) and other Universal Opt-Out Signals (UOOMs)

A growing number of states require businesses to recognize universal opt-out mechanisms such as Global Privacy Control (GPC), a browser-level signal that lets a visitor communicate an opt-out preference automatically, without filling out a form on every site they visit. 

As of 2026, 12 states — California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas — require this, though the details of what counts as a compliant response vary by state. More states will be joining them in coming months and years.

Configuring Google Tag Manager for U.S. Consent Requirements

Getting GTM aligned with these obligations is mostly a matter of sequencing, making sure tags don’t fire before a visitor has had the chance to make a choice, and that the choice is actually respected once made.

1. Determine which laws actually apply to your business, based on visitor locations, revenue, and data volume.
2. Audit every tag in the container and document what each one does and what data it collects.
3. Categorize tags by purpose (analytics, advertising, functional) so consent choices can be applied at the category level.
4. Use Consent Initialization triggers so consent defaults are set before any other tag fires.
5. Configure individual tags to only fire once the relevant consent category has been granted.
6. Recognize opt-out signals like GPC at the point tags would otherwise fire. (Usercentrics Web CMP does this automatically.)
7. Review the container on a regular schedule to remove outdated or redundant tags.

Your consent management platform typically handles the last three steps automatically once it’s integrated with GTM, which is the main reason most businesses running more than a handful of tags choose not to build this by hand.

What Non-Compliance Can Cost a U.S. Business

The financial exposure here comes from two different directions, and it’s worth keeping them separate.

Under the CCPA/CPRA, penalties are enforced by the California Attorney General and CalPrivacy (the name the CPPA publicly uses), and run up to USD 7,988 per intentional violation. Because each affected consumer can count as a separate violation, exposure scales with the size of a business’s California audience.

The wiretapping and video-privacy statutes covered above run through private lawsuits rather than a regulator, and most set a statutory damages floor a plaintiff can reach without proving actual harm, from USD 1,000 per violation under Florida’s FSCA up to USD 5,000 under California’s CIPA, which is why class-style claims against websites have become increasingly common across multiple states, not just California. 

Beyond any of these figures, there’s the cost of the legal proceedings themselves, and the reputational cost of a visible privacy dispute.

Doing Business Internationally? Don’t Forget the GDPR

If a business also has customers in the EU, UK, or Switzerland, GTM’s compliance obligations don’t stop at the U.S. border. The GDPR applies its own consent and data-processing requirements to tags fired through GTM for those visitors, with penalties of up to EUR 20 million or four percent of global annual revenue, whichever is higher, for serious violations. 

A U.S.-based business selling into Europe generally needs a setup that can apply the correct rules by visitor location, rather than a single U.S.-only configuration.

How a Consent Management Platform (CMP) Helps

A CMP sits between a visitor’s consent choices and the tags GTM would otherwise fire automatically. Integrating Usercentrics CMP with GTM through a data layer variable means tags corresponding to consented purposes fire, and others don’t, without a developer manually rebuilding that logic tag by tag. 

It also generates a customizable consent banner, applies the right rules based on visitor location, and keeps a record of consent choices that can help support a business’s position if a regulator or plaintiff ever asks for one.

This article is provided for general informational purposes only and does not constitute legal advice. Consult qualified legal counsel about your specific business operations, privacy compliance needs, and any compliance or remediation decisions.