CMP group mapping: GTM tied to the wrong consent

When the Google Tag Manager service sits in a CMP group like "external media", visitors who consented to statistics are never measured. The check reads the mapping from the Borlabs config.

What gets tested

The scanner reads from the Borlabs config which consent group the Google Tag Manager service is assigned to. Essential, statistics and marketing count as matching. Any other group, in practice usually "external media", is flagged for review.

Why it matters

The group mapping decides whose consent loads the measurement container. When it is wrong, two failures run in parallel. Visitors with statistics consent are not measured, because the container hangs on a group they never ticked: silent data loss no dashboard will show. Meanwhile Consent Mode reports "analytics_storage granted" to Google although no tag exists that could measure. And in the other direction, a single embed tick pulls up the whole container.

Common causes

The GTM service was sorted into the same group as YouTube and Google Maps during setup, because all three are "by Google".
The banner entries "Google Analytics" and "Google Ads" are pure Consent Mode switches without loading code of their own; that the actual container hangs elsewhere goes unnoticed.
After a CMP migration the groups were carried over 1:1 without testing the loading logic.

The fix

Move the GTM service to the essential group (with Consent Mode active) or to statistics in the CMP. Then click through every opt-in variant: statistics only, external media only, everything. For each variant, check in the network tab that the container loads exactly when measurement consent is present.

Matching template

CMP and GTM Consent QA Template

The repeatable test plan for default-denied, consent update and reject, across all four signals.

Get the QA template →

Check it yourself first

The Tracking Check tests this point along with all the others, in seconds.

Start the Tracking Check →

Asked often

What does the "CMP group mapping" finding mean?

In the CMP, every service belongs to a consent group (essential, statistics, marketing, external media). The check reads from the Borlabs config which group holds the Google Tag Manager service. If it sits in a group that has nothing to do with measurement, the entire measurement stack fires only on a consent that means something else.

Why is GTM in "external media" a problem?

Two failures at once. Visitors who consent to statistics and marketing but skip external media are never measured: the container simply does not load, despite a valid consent. And visitors who just want to watch a YouTube video pull in the full measurement container with their external-media tick.

Which group should the GTM service sit in?

Per the Borlabs docs, either essential with Consent Mode active, so the container always loads and the consent signals steer the tags, or statistics, if the container should load only with measurement consent. Both are defensible. What matters is that the group semantically matches measurement.

The fix, delivered

Wired up in days, not sprints.

Findings from the Tracking Check go into a ranked sequence with effort estimates in the Audit Sprint, every module with an acceptance criterion.

To the service Request an Audit Sprint