Your CMP Script Belongs in the Head, Not at the Bottom of the Page
Open your site with the network panel running and watch what loads before the cookie banner appears. On a surprising number of sites, the answer is: the analytics tag, the ad tag, and two or three marketing pixels, all firing while the banner is still rendering. The consent script is sitting at the bottom of the page, loading last, and by the time it sets the defaults the tags have already taken what they wanted.
This is not a banner design problem. It is a load order problem, and it is the single most common consent failure on small sites. The fix costs nothing and takes ten minutes, but only if you understand what the order is supposed to be.
The order that works
Consent defaults go first, before any tag loads. In Google's Consent Mode v2 that means pushing a gtag consent default of denied for all four signals, ad_storage, analytics_storage, ad_user_data and ad_personalization, into the dataLayer before the analytics or ads library loads. Only then does the CMP script load, read the stored choice if there is one, and update the signals to granted where the visitor consented. Tags that load after the defaults respect them. Tags that load before them never see them.
That is why the CMP script belongs in the head. A script in the head runs before the body renders, so it can set defaults and show the banner before the page's other scripts get going. A script at the bottom of the body runs after everything else has had its chance. The vendors who tell you to put their script in the head are not being fussy about style. They are telling you where the enforcement point is.
The failure you can see in your own network panel
Load the site in a private window with the network panel open and the cache disabled. Filter for googletagmanager and for your ad network. If any of those requests appear before the CMP script request, tags fired before consent existed. The usual culprit is a tag manager container loading in the head with tags set to fire on page view, while the CMP loads through the tag manager itself. That is a loop: the consent tool is waiting on the tool it is supposed to govern.
Break the loop by loading the CMP outside the tag manager, directly in the page head, and gating the tag manager container on the consent state. The CMP sets the defaults, the container loads, and the tags inside it check the signals before firing. Sites that do this see their analytics numbers drop in the first week, because the numbers were previously inflated by pre-consent hits. That drop is the measurement getting honest, not the site losing traffic.
What to check after you move the script
Test the three states separately. Fresh visitor, no stored choice: defaults denied, banner shows, no ad or analytics cookies set before a click. Returning visitor who accepted: stored choice read, signals updated to granted, tags fire normally. Returning visitor who rejected: signals stay denied, and the tags send cookieless pings only if you run advanced mode, nothing at all in basic mode.
Then check the vendor side. A CMP that loads early but broadcasts a stale TCF string is still broken, and the TCF v2.4 deadline passed on October 23, 2026. Load order and string version are two separate checks, and a site can pass one and fail the other. Run both, and write the results down with the date, because the next person to touch the tag setup will not know what you checked.
Keep reading: White Label Cookie Consent: What It Is and How to Choose a Platform, Checkout Sets Cookies Before Consent. That Is Where the Banner Fails., and Consent Banners on Mobile: The Bottom Sheet Problem Nobody Tests cover the nearby cases in this series.
Frequently asked questions
Why should the CMP script load in the head?
Because consent defaults must be set before any tag loads. A script in the head runs before the body's other scripts, so it can set defaults to denied and show the banner before analytics or ad tags get a chance to fire.
What happens if tags load before the CMP?
They fire without consent signals, which means cookies and identifiers are set before the visitor has chosen. That is the most common consent failure on small sites, and it shows up in the network panel as tag requests before the CMP request.
Should the CMP load through Google Tag Manager?
No. If the CMP loads through the tag manager, it is waiting on the tool it is supposed to govern, and tags can fire before consent exists. Load the CMP directly in the page head and gate the tag manager container on consent state.
How do I test load order after moving the script?
Open the site in a private window with the network panel running and cache disabled. Confirm the CMP request comes before any analytics or ad tag request, then test all three visitor states: fresh, returning accepter, and returning rejecter.