When a user accepts or rejects cookies on a Cookiebot banner, Cookiebot writes the consent state into a cookie called CookieConsent. The cookie travels with every subsequent request to your domain, including requests to your sGTM tagging server. Reading it server-side gives you a consent signal without needing the browser to push it explicitly.

The cookie format

A typical CookieConsent cookie value looks like this when URL-decoded:

{stamp:'abcd1234',necessary:true,preferences:false,statistics:true,marketing:false,ver:1,utc:1740000000000,region:'fr'}

The five categories are necessary, preferences, statistics, marketing, and (optionally) unclassified. Each one is a boolean. The stamp is a per-user consent ID; the utc is the timestamp.

Parsing in a Custom Variable

const cookieValue = getCookieValues('CookieConsent')[0];
if (!cookieValue) {
  return { statistics: false, marketing: false };
}
const decoded = decodeUriComponent(cookieValue);
const stats = decoded.indexOf('statistics:true') !== -1;
const marketing = decoded.indexOf('marketing:true') !== -1;
return { statistics: stats, marketing: marketing };

The cookie is not strict JSON (no quotes around keys), so you cannot JSON.parse it. String matching is reliable enough because the format is stable across Cookiebot versions.

Mapping to Consent Mode v2

Cookiebot's "statistics" maps to analytics_storage. "Marketing" maps to ad_storage, ad_user_data, and ad_personalization (all three Meta consent fields collapse to the same Cookiebot category).

Why read it server-side

Belt-and-braces: your client-side Consent Mode integration also pushes the state via the data layer. If something breaks that path (a script load failure, a misconfigured tag), the server-side read gives you a fallback. The two should agree; if they do not, log the discrepancy and investigate.