There are several ways to install a CMP on WordPress. The most obvious is to use a plugin, but it is also possible to add a JavaScript tag directly to the website or use Google Tag Manager.
All three methods can work. However, they do not provide exactly the same control over loading order, maintenance and the services that must remain blocked before consent.
For me, the main criterion is therefore not choosing the easiest installation method. It is choosing one that allows the CMP to execute early enough to do its job correctly.
The WordPress plugin: the simplest option
For many websites, a plugin is the logical choice. Installation takes place from the WordPress administration area and there is no need to modify the theme or manually add code.
However, there are two types of plugins to distinguish. Some CMPs operate largely inside WordPress and use the plugin for much of their configuration. Others simply use the plugin as an installation method for an external CMP.
This is how tarteaucitron Pro works. The official tarteaucitron plugin available on WordPress.org lets you enter the account identifier and adds the required marker to the page. Configuration is then managed through the tarteaucitron.io dashboard.
The advantage is that the CMP itself does not really depend on WordPress. The plugin simplifies installation, but the same CMP can be used with another CMS or a website built without a CMS.
The important question: where does the plugin inject the CMP?
Installing a CMP through a plugin does not automatically guarantee that it will load in the right place. What matters is the final position of the script in the HTML generated by WordPress.
A CMP that must automatically block trackers needs to execute before them. If a plugin, theme or another tool injects GA4 before the CMP, the browser may start communicating with Google before the CMP can intervene.
This is why loading order is a fundamental rule. WordPress can hide some of this complexity because several plugins may independently add their own scripts to the <head>.
Adding the JavaScript tag directly
The second method is to integrate the JavaScript tag provided by the CMP directly. It can be added to the theme, a child theme, a CMS integration point or a tool designed to inject code into the <head>.
This approach is technically simple and provides clear control over where the marker is placed. It also avoids installing a WordPress plugin solely to add a few lines of HTML.
On the other hand, it requires knowing where the code was added. After a theme change or several years after installation, that integration should still be easy to find.
I always prefer an installation whose location is obvious and documented rather than a piece of JavaScript hidden inside a forgotten theme setting.
Plugin or JavaScript tag: the result can be identical
When a plugin only injects the tag of a SaaS CMP, the difference from a manual JavaScript installation is ultimately quite small.
In both cases, the browser receives a tag that loads the CMP. The plugin mainly provides an installation method familiar to WordPress users and avoids modifying the website directly.
The choice can therefore simply depend on how the website is maintained. For a client managing plugins through WordPress, the plugin is often easier to understand. For a developer already controlling the website code, a direct tag can be just as clean.
What about Google Tag Manager?
Google Tag Manager can also inject JavaScript into a website. It may therefore seem natural to use it to load the CMP.
I find this approach much more delicate. A CMP is specifically intended to control third-party services, while GTM is often the container responsible for loading some of those services.
Making the CMP depend on GTM therefore creates a relationship that must be perfectly controlled: GTM must be available, its container must execute and the CMP tag must run before the trackers it is supposed to control.
The longer this chain becomes, the harder it is to guarantee the actual execution order in the browser.
I prefer loading the CMP independently from GTM
In most configurations, I therefore prefer the CMP to be loaded directly by the website, either through the WordPress plugin or through a JavaScript tag placed early enough.
GTM can then be controlled by the CMP or used with an appropriate consent configuration. This creates a much simpler hierarchy: the CMP knows the visitor’s choice, then marketing and analytics tools react to that choice.
The opposite feels less natural to me. Loading the tool that distributes trackers first and then asking it to load the tool responsible for controlling them adds an unnecessary dependency.
I covered another aspect of this problem in my article about GTM and cascading consent.
Be careful not to confuse this with Google Consent Mode
Google Tag Manager is often associated with Google Consent Mode v2. This can create the impression that GTM necessarily needs to load the CMP for everything to work.
It does not. The CMP collects and communicates the visitor’s choice. GTM, the Google tags inside it and Consent Mode states are separate components.
A CMP loaded directly by the website can perfectly well manage Consent Mode. tarteaucitron, for example, supports it in both the open-source and Pro versions.
This topic should be separated from the installation method itself. I explain the distinction in more detail in my Google Consent Mode v2 guide.
Check the result in DevTools
Whatever installation method is used, I finish with the same check: I open the browser developer tools.
I look at where the CMP appears in the DOM, which requests are sent before any choice and whether the relevant services actually remain blocked. I then test refusal and acceptance.
This check can also reveal duplicate integrations. A plugin may correctly configure GA4 through the CMP while another WordPress plugin continues to load the same tracker directly.
In that case, the banner works but the technical result is not what was expected. I dedicated a full article to this verification process.
Which method should you choose on WordPress?
For most WordPress websites, I would choose the plugin when it is maintained and correctly places the CMP early enough on the page. It is generally the easiest solution to understand and maintain. For tarteaucitron, the plugin can be installed directly from WordPress.org or from the WordPress administration area.
A directly integrated JavaScript tag is equally valid when a developer controls the website and wants to limit the number of WordPress plugins.
I would reserve installation through Google Tag Manager for configurations where this architecture is genuinely required and properly controlled. It adds an intermediary precisely where loading order is critical.
Ultimately, plugin or JavaScript matters less than the result: the CMP must be present before the services it needs to control. That is the first thing I would verify.
