As it's a general requirement for our customers to cover GDPR, we should really have a proper cookie management implementation that allows granular control of what customers accept, records it in the website database, and can use this data agreement to pass on to Tag Manager. This functionality really should be OOB, as it's a standard requirement, may well be needed in order for Google tracking to even work in the near future, and needs to be integrated so that we can track the agreements properly. We can't assume from a legal perspective that agreement is inferred by a customer doing business, and even if a company had somehow implicitly agreed to data gathering, that may not cover individual purchasers.