Google Tag Manager on Magento without test orders in your reports

Every night the production database is copied to staging, and every morning someone runs a test order there. If the Tag Manager snippet sits in the HTML Head, that order is now in your Analytics, your Ads conversions and your remarketing lists. On the real checkout, meanwhile, tags with inline code or unlisted hosts never fire, because since 2.4.7 the page runs under a Content Security Policy that blocks them. And the consent defaults Google asks for are nowhere at all.

What it is for

Google Tag Manager & Consent Mode is an extension for Magento Open Source and Adobe Commerce that loads your Tag Manager container on Adobe Commerce and Magento Open Source storefronts – Luma and Hyvä Theme – and takes care of the three things the pasted snippet gets wrong.

It loads only on your production hosts. You list them once; the extension compares them with the store's configured base URL, so a staging copy of the database, with its own base URL, renders no container at all. It works on the strict checkout: the page's nonce is set on gtm.js and pushed to the dataLayer for your Custom HTML tags, and the hosts your tags talk to are added to the policy from the admin. And it sets Google Consent Mode v2 defaults before the container loads – denied in the EEA, the UK and Switzerland – then follows Magento's own cookie notice or your consent platform.

Your tags, triggers and variables stay where they are: in Tag Manager.

How it can be used

A store that copies production to staging. List the production hosts and stop worrying about the nightly copy. There is no environment-specific setting to remember after each restore, and an empty list loads nothing, so a fresh install cannot leak either.

A pixel on the checkout. A Meta Pixel or a heatmap script usually sits in a Custom HTML tag. Add its host under Additional Tag Hosts, create a Data Layer Variable for cspNonce and open the tag with <script nonce="{{cspNonce}}">. It now runs on the checkout like on every other page, without loosening the policy for anything else.

An EU store without a consent platform. Turn on Magento's Cookie Restriction Mode and choose "Magento cookie notice" as the consent source. Visitors in the EEA start with every signal denied; when they click Allow Cookies the signals become granted, and they are granted before the container loads on every later page.

A store with a consent platform. Choose "External consent platform": the extension sets the defaults, the platform's Tag Manager template sends the updates. If the template sets defaults itself, leave consent off here.

Server-side Tag Manager or Google tag gateway. Point the GTM Script Base URL at your own domain; its host goes into the policy automatically.

How it compares

The category is crowded. On 2026-10-09 the Adobe Commerce Marketplace listed about nineteen Tag Manager and GA4 data-layer extensions, and the most established vendors sell from their own sites as well. Paid suites from Mageplaza and Mirasvit start at USD 149 a year for Magento Open Source, Amasty at USD 249; Magefan sells one-time editions from USD 99 to 199. They push a full GA4 ecommerce data layer, and several add server-side purchase and refund events, consent options and extra advertising pixels.

The free side is dominated by Yireo GoogleTagManager2, at about 35,800 Composer installs a month, with MagePal's free module next at about 20,100. Both push ecommerce data; Yireo supports Hyvä Theme natively.

This extension does something narrower, and measurably different. We read the source of four widely installed free modules on 2026-10-09 – Yireo 3.10.8, MagePal 3.0.2, Stape 1.0.44 and TAGGRS 1.0.13:

• none of them limits loading to a list of production hosts;
• none of them sets the page nonce on gtm.js or exposes it to Custom HTML tags;
• none of them sets Consent Mode v2 defaults.

Those three are exactly what this extension is made of. It is free and open source, and it is the size of the job: one loader, one admin section, no database table.

What the alternatives do better, plainly: if you want GA4 ecommerce events, server-side purchase tracking or ready-made pixels for other ad networks, a data-layer module or a paid suite gives you those, and this extension does not.

A side-by-side with the free module most stores start from is in Google Tag Manager & Consent Mode vs Yireo GoogleTagManager2.

What it does not try to be

It is not an ecommerce data layer, not a server-side tracker and not a cookie banner. The FAQ lists what is out of scope, and when a different tool is the better choice.