# We manage consent through GTM consent mode, how does the Croct tag behave?

Asked by Aurelia Moretti on 2026-02-17. Tags: privacy, consent, gtm.

I own our GTM container and every tag in it is mapped to a consent state, no
exceptions. Before I add the Croct tag I need to understand its behavior
precisely.

My understanding is that the Croct tag listens to data layer events rather than
firing its own pixels. So my question is about the scope of gating: if I gate
the tag itself behind consent, does that gate ALL Croct tracking, or is there
some pathway (conversion events, direct SDK calls, anything) that bypasses the
tag and would need its own consent mapping?

I map every tag to a consent state for a reason, so "mostly gated" is not an
answer I can work with

## 1 answer

### Accepted answer from Marta Kowal (2026-02-17)

Your mental model is right, and the gating scope is clean. The Croct GTM tag
is the inbound mechanism: a single tag that listens to Google's recommended
events in the data layer and maps them to Croct events. That tag is the entire
pathway for a GTM-based setup, so firing it only after consent gates
everything that flows through it. There is no secondary pixel or side channel
that fires independently of the tag.

Conversion events do not bypass it either. Conversion-indicating events like
purchase, sign-up, and generated lead are tracked as conversions through the
same tag, so they inherit exactly the same consent gating as everything else.

The one case to check in your audit: if any team has ALSO installed the SDK
directly on a page (outside GTM), that is a separate integration path with its
own gating pattern, which is deferring `croct.plug()` until consent. Nothing
runs or stores before the SDK is plugged. There is a detailed thread on
[holding all Croct tracking until the consent banner is accepted](/answers/defer-tracking-until-cookie-consent)
covering that pattern.

So: one tag, one consent mapping, full coverage, as long as GTM is your only
integration path.

#### Reply from Aurelia Moretti (2026-02-18)

Verified there is no direct SDK install anywhere, so the single mapping
covers us. Tag added with the same consent trigger as our analytics group.
Thank you for the unambiguous answer.