Why order matters
Google Consent Mode v2 requires gtag('consent', 'default', ...) to be called before any GA4 or Ads tags fire. theConsent emits these defaults synchronously on load.
Correct order
<!-- 1. theConsent (must be first) -->
<script async src="https://cdn.gettheconsent.com/v1/banner.js?siteKey=..."></script>
<!-- 2. GTM -->
<script>(function(w,d,s,l,i){...})(...);</script>
Common mistake
Pasting theConsent after GTM. The compliance verifier flags this — fix by moving theConsent to the top of Head Code.