Skip to main content
Cookie Gate
green gradient background, "The Future of Application Security Is Already Here." and a read the report button.
Category: CMP Implementation

Tag Sequencing

Simply put

Tag sequencing is a feature in tag management systems, such as Google Tag Manager, that lets you control the order in which tags fire by specifying that certain tags run immediately before or after a chosen 'primary' tag. This makes it possible to set up dependencies so that related tags fire in a predictable, deliberate sequence rather than all at once. It is a technical configuration tool and does not by itself determine whether any tag is permitted to fire under applicable consent rules.

Formal definition

Tag sequencing is a Google Tag Manager configuration (available in web containers) that allows a practitioner to designate setup and cleanup tags that fire immediately before or after a given primary tag, thereby establishing firing-order dependencies among related tags. It is used to enforce execution order where one tag must run before or after another. Note that the evidence describes tag sequencing only as a functional mechanism for ordering tag execution; it does not address, and should not be assumed to enforce, consent conditions, and any relationship to consent gating would depend on separate trigger and consent-mode configuration outside the scope of this evidence. (The other sources in the evidence packet refer to unrelated genomic sequencing methods and are not applicable to this term.)

Why it matters

Tag sequencing gives practitioners a way to enforce a deliberate firing order among related tags, which matters wherever one tag depends on another having already run. Without such control, tags configured in a tag management system generally fire independently once their triggers are met, and a tag that relies on setup performed by another tag may execute prematurely or fail. Sequencing addresses this by letting a practitioner designate setup tags that run before, and cleanup tags that run after, a chosen primary tag.

From a consent and compliance perspective, it is important to be precise about what tag sequencing does and does not do. Based on the evidence available, tag sequencing is purely a mechanism for ordering execution; it does not itself determine whether a tag is permitted to fire under applicable consent rules such as those flowing from the ePrivacy Directive (and its national implementations) for the placing of and access to information on a device, or the GDPR for any subsequent processing of personal data. Whether a given tag may fire at all typically depends on separate trigger conditions and, where used, consent-mode or consent-gating configuration that sits outside the scope of tag sequencing.

As a result, teams should not treat tag sequencing as a substitute for consent controls. Ordering tags correctly does not make an unconsented tag lawful, and consent obligations differ across jurisdictions such as the EU, the UK, and individual US states. Tag sequencing supports reliable technical behaviour, but the question of whether any tag should fire in the first place is a separate compliance determination.

Who it's relevant to

Web developers and tag management practitioners
Those who build and maintain tags in Google Tag Manager web containers use tag sequencing to enforce dependencies, ensuring that setup tags run before and cleanup tags run after a primary tag. This is the group most directly responsible for configuring the feature correctly and understanding that it governs order, not permission to fire.
Marketing and analytics teams
Teams deploying analytics and advertising tags may rely on sequencing to make related tags fire in a predictable order. They should understand that correct sequencing does not address whether those tags may fire under applicable consent rules, which is determined by separate trigger and consent configuration.
Privacy and compliance professionals
Privacy officers and compliance staff reviewing a tag setup should recognise that tag sequencing is a technical ordering mechanism and not a consent control. Consent obligations, which differ across the EU, the UK, and individual US states, must be handled through appropriate trigger and consent-mode settings rather than assumed from sequencing alone.

Inside Tag Sequencing

Tag Firing Order
The defined sequence in which tags (such as analytics, advertising, or functional scripts) are permitted to execute on a page. In a consent context, this ordering is used to ensure that consent-checking logic runs before any non-essential tag fires, so that tags requiring prior consent are held back until a valid signal is received.
Consent Gate or Trigger Condition
A conditional check placed ahead of a tag in the sequence that evaluates whether the relevant consent category (for example, analytics or advertising) has been granted. Under EU rules derived from the ePrivacy Directive, non-essential tags should generally only be sequenced to fire after such a condition is satisfied, whereas strictly necessary tags may fire without waiting on consent.
Category-Based Sequencing
The practice of grouping tags by cookie or technology category (strictly necessary, functional, analytics, advertising) and sequencing each group against its corresponding consent state. This mirrors the fact that similar technologies such as pixels, SDKs, and local storage fall within the same consent rules as cookies even where they are not literally cookies.
Tag Manager and CMP Interaction
The technical integration by which a consent management platform (CMP) communicates consent state to a tag management system, which then enforces the firing sequence. The CMP supplies the signal, and the tag manager applies it to the order of execution; neither component on its own determines legal compliance.
Deferred and Blocked States
The handling of tags that have not yet met their consent condition, either by deferring them until consent is given or by suppressing them entirely for the session. This distinguishes tags that are delayed within the sequence from those that are prevented from firing at all.

Common questions

Answers to the questions practitioners most commonly ask about Tag Sequencing.

Does tag sequencing on its own make my cookie deployment compliant?
No. Tag sequencing is a technical mechanism for controlling the order in which tags fire; it does not, by itself, establish a lawful basis for placing cookies or processing personal data. In most EU jurisdictions, non-essential tags generally require valid prior consent under the ePrivacy rules before they fire, and any resulting processing of personal data must also satisfy the GDPR. Sequencing can help enforce those requirements by ensuring consent-dependent tags only run after consent is captured, but the legal judgment about whether a tag needs consent, and whether consent was validly obtained, remains separate from the sequencing configuration. Tools support compliance; they do not replace it.
If I sequence a tag to fire after the consent tag, does that guarantee consent was actually given?
Not necessarily. Ordering a tag to fire after a consent-related tag controls timing, but it does not guarantee that the user provided freely given, specific, informed, and unambiguous consent through a clear affirmative action, as required under the GDPR in the EU. A sequence that fires a tag on page load or after a banner is merely displayed, rather than after an actual opt-in, would not reflect valid consent in most EU jurisdictions. Sequencing should be tied to a genuine consent signal from your consent management platform, and you should verify that the signal represents a real user choice rather than an assumed or default state. Requirements also differ under frameworks such as certain US state privacy laws, which often rely on opt-out rather than opt-in.
How should I configure tag sequencing to respect a CMP's consent signal?
A common approach is to make consent-dependent tags conditional on the consent state exposed by your consent management platform, so that a tag only fires once the CMP reports the relevant consent category as granted. This typically involves waiting for the CMP to load and publish its signal before evaluating whether downstream tags should run. The specific implementation depends on your tag management system, your CMP, and how consent categories are mapped to individual tags, so the configuration details are outside the scope of a general definition and should be validated against your own setup.
How do I handle tags that must fire before the consent signal is available, such as during initial page load?
Tags that need to run before a consent signal is available are generally limited to those that do not depend on consent, such as tags supporting strictly necessary or essential functionality, which are typically exempt from consent under EU rules. Non-essential tags should generally be held back until a valid consent signal is received. Where a tag would otherwise fire early, sequencing can be used to defer or block it pending consent. Whether a given tag qualifies as essential is a factual and legal question specific to your site and should not be assumed based on convenience.
How can I test that my tag sequencing behaves correctly across consent scenarios?
Testing usually involves simulating the main consent states, such as consent granted, consent denied, and consent not yet provided, and confirming that each tag fires only when the corresponding condition is met. It is also useful to check behavior on first visit versus return visits, and to observe network requests to verify that no consent-dependent tag transmits data before consent. Because the same rules can apply to non-cookie technologies like pixels, SDKs, and local storage, testing should cover those mechanisms too. The precise test steps depend on your specific tooling and are outside the scope of this entry.
Should tag sequencing decisions be logged as part of consent record-keeping?
Record-keeping and consent logging are generally treated as distinct from the sequencing configuration itself. Sequencing determines when tags fire, while consent logging concerns capturing evidence of the consent choices that drive those tags. Maintaining records of consent may be relevant to demonstrating accountability, and aligning your logs with the conditions that govern tag firing can support that. However, what needs to be logged, and for how long, depends on the applicable framework and your organization's obligations, which vary between the EU, the UK, and individual US states, and should be assessed with appropriate legal input.

Common misconceptions

Simply placing a consent tag first in the sequence makes a site compliant.
Correct sequencing is a technical measure that supports compliance but does not by itself guarantee it. Valid consent under the GDPR must still be freely given, specific, informed, and unambiguous, and the ePrivacy Directive's requirement of prior consent for non-essential storage must be met. Sequencing tools enforce order but do not replace the legal judgment about whether consent was properly obtained.
Tag sequencing only needs to control cookies.
The same consent rules generally apply to pixels, SDKs, local storage, and fingerprinting techniques, not only to literal cookies. A sequencing approach that gates cookie-setting scripts but allows other tracking technologies to fire before consent may still involve accessing or storing information on a device without the consent that is typically required in EU jurisdictions.
A single firing sequence works the same way across all jurisdictions.
Consent obligations differ between regimes. In most EU jurisdictions non-essential tags typically require prior opt-in consent before firing, while several US state frameworks such as the CCPA and CPRA in California often rely on an opt-out model. A sequence designed for an opt-in default may not reflect what other jurisdictions require, so geographic scope should be considered.

Best practices

Sequence strictly necessary or essential tags separately from non-essential tags, allowing essential tags to fire while holding analytics, advertising, and functional tags behind a consent condition where consent is required.
Apply consent gating to all in-scope technologies, including pixels, SDKs, local storage, and fingerprinting scripts, rather than only to scripts that set traditional cookies.
Integrate the tag management system with a CMP so that firing order responds to the current consent state, and treat the tools as support for compliance rather than a substitute for legal review.
Configure sequencing to reflect the applicable legal regime, distinguishing opt-in defaults typically expected in EU jurisdictions from opt-out approaches used under frameworks such as the CCPA and CPRA, based on the user's location where feasible.
Maintain records of how tags are sequenced and gated so that consent enforcement can be demonstrated, supporting consent logging and record-keeping expectations.
Test the sequence to confirm that non-essential tags do not fire before a valid consent signal is received, and periodically re-verify as tags, regulatory guidance, and enforcement positions evolve.
Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide