Integrations

The tag sets Consent Mode defaults to denied before any Google tag runs and pushes an update on every decision: analytics maps to analytics_storage, marketing to ad_storage, ad_user_data and ad_personalization, preferences to personalization_storage. Nothing to connect; the cards for GA4, Google Ads and Tag Manager on the Integrations page say “Automatic” because that is what they are.

Meta’s pixel has a consent API: revoked, it loads but sends nothing; granted, it flushes what it buffered. The tag places the revoke ahead of the pixel’s own init and PageView and sends the grant the moment a visitor allows marketing. That covers a pixel hard-coded above our tag, which no blocking rule can reach.

The one limit: if the pixel’s script had already run and sent PageView before our tag executed, that first hit is gone. Keep our tag as high in the page as you can.

The tag pushes ad_storage: denied onto UET’s queue before the UET tag loads and updates it on every decision. Under denial UET still records conversions without cookies, so an advertiser keeps modelled data from visitors who refused. Nothing to configure. If you would rather UET did not load at all for refused visitors, add a blocking rule for bat.bing.com as well.

Segment’s consent management works through a wrapper around analytics.js that asks your CMP which categories are allowed. The tag exposes what it needs on window.__cmpstack. Category names in the snippet must match the consent categories configured in Segment’s Consent Management settings.

import { createWrapper } from "@segment/analytics-consent-tools";

const categories = (c) => ({
  Analytics: c.analytics,
  Advertising: c.marketing,
  Functional: c.preferences,
});

createWrapper({
  getCategories: () => {
    const c = window.__cmpstack?.consent();
    return c ? categories(c) : {};
  },
  registerOnConsentChanged: (set) =>
    window.__cmpstack?.on((c) => set(categories(c))),
})(window.analytics);

Put it before analytics.load(...). Destinations in a refused category stay off, and a change through the preferences control updates them without a reload.

window.__cmpstack.consent()
// → { necessary: true, analytics: false, marketing: true, preferences: false } or null

window.__cmpstack.on((consent) => {
  // called at once if there is a decision, and again on every change
});

window.__cmpstack.open(); // open the preferences banner

In Google Tag Manager, trigger on the Custom Event cmpstack_consent. It is pushed on every decision and carries the same object under consent, so a tag can fire when the visitor accepts, not only be gated by Consent Mode.

1. Integrations → Webhooks. Enter an HTTPS URL. Private addresses and plain HTTP are refused.
2. Choose a mode: all decisions, granted only or revoked only. The last two exist for keeping a suppression list without being woken by decisions that do not change it.
3. Save. The signing secret is shown once; store it. Use Rotate if it leaks.

Each delivery is a JSON consent.recorded event with an X-CMPStack-Signature header of the form t=<unix>,v1=<hex>: an HMAC-SHA256 of timestamp.body with your secret. Verify it, and reject timestamps older than a few minutes to defeat replays. X-CMPStack-Delivery carries an id you can use to make your handling idempotent.

Integrations → API keys → Create. The key, starting cmpk_live_, is shown once and stored hashed; a lost key is revoked and replaced, never recovered. Send it as a bearer token:

curl -H "Authorization: Bearer cmpk_live_…" \
  https://api.cmpstack.io/v1/api/consent-events?domainId=…

/v1/api/consent-events returns decisions with the same filters the Consent Logs page offers; /v1/api/domains lists your domains. A revoked key answers 401 immediately.

The status pill on every card opens the matching answer in the help centre at the bottom of the Integrations page. The most common question, “there is no card for my vendor”, is answered there first: most vendors are handled by blocking, not by a connection.