Blocking GTM is only the first step
Google Tag Manager is useful because a single container can load many things. That is also exactly what makes its integration with a CMP more delicate.
A setup I regularly see consists of declaring GTM as a service in tarteaucitron, then letting GTM load GA4, Facebook, Google Maps and several other services.
Accepting GTM does not mean accepting everything inside it
The problem becomes obvious when stated this way: a visitor who accepts Google Tag Manager has not necessarily accepted Google Analytics, Facebook or Google Maps.
GTM is a container. Consent concerns the actual services and processing behind it. Correctly blocking the container before the initial choice therefore does not solve everything.
A container blocked before consent does not automatically turn every tag inside it into a correctly managed service.
The manual integration case
With tarteaucitron.js in manual mode, if only GTM is declared as a service, tarteaucitron controls GTM. It does not automatically know the internal configuration of the container.
Once GTM is accepted, the tags configured inside it may trigger according to their own rules. Their consent must be organised separately and each service must be checked.
This is exactly where checking the DOM and network requests becomes essential.
Pro automatic mode changes the problem
In tarteaucitron Pro automatic mode, supported services can be detected and blocked when they appear on the page, including when they are injected after the initial page load.
This keeps consent management at service level instead of treating GTM as a general permission. The principle remains the same: GA4, Facebook and Maps are separate choices.
GTM, Consent Mode and the CMP are three different topics
It is also important not to confuse loading the GTM container, triggering the tags inside it and Google Consent Mode states. These mechanisms can work together, but they are not interchangeable.
A clean setup starts by mapping the tags actually present in GTM. Only then can each service be assigned the appropriate consent behaviour.
Less magic, more control
I always prefer a configuration whose path I can explain: this service exists, this choice controls it, this request appears after permission.
Whenever a setup becomes “GTM handles everything”, I check it. A tag manager is very useful, but it can also hide a lot of complexity behind a single piece of JavaScript.
