Google Analytics 4 and Google Tag Manager are usually installed together, and most cookie policies treat them as one line item: "we use Google Analytics." That single sentence hides three separate questions a cookie policy actually needs to answer: which cookies GA4 itself sets, what Google Tag Manager does and doesn't do on its own, and what your Consent Mode configuration lets fire before a visitor answers your banner at all. Getting those three questions right is the difference between a disclosure that would survive a regulator's cookie scan and one that just repeats a vendor name.
GTM is a delivery mechanism, not a cookie
The most common mistake in this stack is treating "we use Google Tag Manager" as a disclosable fact on its own. It isn't, not by itself. Google Tag Manager's own container script (gtm.js) loads a rules engine into the page: a set of tags, triggers, and variables you configured in the GTM interface. Loading that container does not set a tracking cookie. What sets cookies is whatever tag inside the container actually fires, a GA4 configuration tag, a Google Ads conversion tag, a Meta Pixel tag, and so on, each governed by its own trigger conditions.
That distinction matters because it means the cookie policy can't stop at naming the tag manager. It has to describe the tags that live inside your specific container, since two sites both running GTM can have completely different cookie footprints depending on what's configured to fire and under what conditions.
Auditing your own container before writing the policy is not optional here. Open the GTM workspace, list every tag with a trigger that isn't "Consent Initialization" or "Initialization," and check each one's consent settings. That list, not the fact that GTM exists on the page, is what the cookie policy needs to describe.
The cookies GA4 itself sets
Once a GA4 tag actually fires, it sets a small, fairly stable set of first-party cookies through the _ga cookie family. This is worth listing by name because older cookie policies, especially ones carried over from a Universal Analytics setup, often list _gid, a cookie GA4 does not use. _gid was specific to Universal Analytics and has no equivalent in GA4's own cookie set.
GA4's own cookie set
| Purpose | Typical duration | |
|---|---|---|
| _ga | Distinguishes unique users | 2 years |
| _ga_<container-id> | Persists GA4 session state | 2 years |
| _gac_gb_<container-id> | Google Ads click data, if linked | 90 days |
The _ga_<container-id> cookie is the one that most often confuses people writing these policies by hand, because the property-specific suffix means the exact cookie name is different on every GA4 property. A cookie policy doesn't need to spell out your specific measurement ID in the disclosure text, but it should describe the cookie by its pattern (_ga_ followed by a property-specific string) rather than a single fixed name, so the disclosure stays accurate if the property is ever reconfigured.
The _gac_gb_ cookie is conditional, not universal. It only appears if you've linked Google Ads to the same GA4 property and enabled auto-tagging for campaign attribution. A site running GA4 for reporting only, with no Ads link, won't set it at all, and a policy that lists it unconditionally is disclosing a cookie that may not exist on that particular site.
Consent Mode v2: what can fire before an answer
Since March 2024, Google has required Consent Mode v2 for sites serving Google's advertising products to EEA and UK visitors, and most sites running GA4 through GTM have it configured whether or not the person who set it up thought carefully about what it does. Consent Mode works through four signals that your consent banner passes to Google's tags: ad_storage, ad_user_data, ad_personalization, and analytics_storage. Each one is either granted or denied based on the visitor's actual banner choice, and Google's tags read those signals before deciding what to do.
The detail that matters most for a cookie policy is the difference between Consent Mode's two implementation levels. In Basic Consent Mode, tags simply don't load at all until consent is granted, which is close to how a well-built banner behaved before Consent Mode existed. In Advanced Consent Mode, GA4 and Ads tags load regardless of consent status, but with analytics_storage denied, GA4 sends a "cookieless ping," a request to Google's servers with no persistent identifier and no _ga cookie set, used for statistical modeling rather than user-level tracking. Once the visitor grants consent, the tag switches to full measurement and the _ga cookie gets set on the next hit.
- We use Google Analytics and Google Tag Manager to understand site usage.
- No mention of what fires before a consent choice is made.
- GA4 sets _ga and _ga_<container-id> once analytics_storage consent is granted.
- Before consent, only cookieless, non-identifying pings are sent to Google.
That distinction is worth writing into the policy explicitly, because "no cookie is set before consent" and "no data reaches Google before consent" are two different claims, and only the first one is true under Advanced Consent Mode. A cookie policy that only tracks cookies can honestly say no _ga cookie exists pre-consent. A privacy policy covering the same setup should still disclose that anonymized, cookieless pings are sent regardless, since that's still a transmission of information about the visit even without a persistent identifier attached to it.
Writing the section without guessing your own setup
The practical path here is to treat the GTM audit as the actual source of truth, not the fact that "we have Analytics installed" people usually reach for. Pull up your container, note which tags have a live trigger, check whether each one respects a consent state or is set to fire unconditionally, and confirm whether Google Ads is linked (which is what determines whether the _gac_gb_ cookie applies to your site at all). That list, plus GA4's own fixed _ga and _ga_<container-id> cookies, is the actual content a cookie policy for this stack needs to contain, rather than a single sentence naming the two Google products.
Our Cookie Policy Generator builds this section from the specific tags and consent configuration you tell it about, so a GA4-and-GTM disclosure names the cookies that are actually set on your site, distinguishes the container from the tags firing inside it, and reflects your actual Consent Mode implementation rather than a generic paragraph that reads the same on every site running the same two products.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
