A **consent bridge** loads a supported vendor and forwards the visitor's decision to it, live — so the tag keeps sending privacy-safe signals under denied consent instead of being hard-blocked into silence. It's the "bridge" half of [bridge, then block](/how-it-works/#bridge-then-block), and it's the setup most sites get wrong when they wire each vendor by hand. Every bridge is **one config flag**. The CMP ships and manages the vendor-specific adapter; you don't write `onConsentChange` glue or custom tag templates: ```js lightning("init", { bridges: { google: { tagId: "G-XXXXXXX" }, // CMP loads gtag.js for you hubspot: { portalId: "1234567" }, // CMP loads HubSpot + forwards consent }, }); ``` Bridges are **opt-in** — omit a key and that vendor is never loaded, and the page pays no runtime cost for it. (Google Consent Mode *signals* are on by default via [`googleConsentMode`](/configure/consent-mode/); the `google` bridge below adds CMP-managed tag *loading* on top.) > **Tip — When to bridge vs. block** > A bridge is only possible for vendors with a consent-aware mode. A vendor with > no such mode (Meta Pixel, TikTok, LinkedIn, Hotjar…) isn't a bridge candidate > — gate it with the [script blocker](/integrations/script-blocker/) instead. ## Google (gtag / GTM) Set `bridges.google.tagId` to a GA4 measurement ID (`G-…`), a Google Ads conversion ID (`AW-…`), or a **GTM container** (`GTM-…`) and the CMP loads it itself: ```js lightning("init", { bridges: { google: { tagId: "G-XXXXXXX" } } }); ``` The win is **ordering**. The CMP pushes `consent default` (denied) *before* the tag executes — the single most common Consent Mode mistake when hand-rolling the head snippet is getting that order wrong and leaking before the default lands. Letting the CMP own the tag makes the ordering impossible to get wrong. - **GTM containers work too.** A `GTM-…` id loads your container the canonical way (`gtm.start` / `gtm.js`) with the same guaranteed consent-default-before-boot ordering. You still gate the container's **individual tags inside GTM** via each tag's Consent Settings — the bridge only handles *loading* plus Consent Mode signals — so confirm they fire in **GTM Preview** after wiring it up. - If you already hand-place `gtag.js` or the GTM snippet, don't set `tagId`; Consent Mode signals still flow via `googleConsentMode`. - The loader is injected **off the critical path** (idle-time, `async`), so it never blocks first paint. > **Note — The \