Google Tag Manager (GTM) is an awesome tool for webmasters and marketers. It allows you to safely deploy JavaScript snippets and other tags on your website and change the implementation logic at any time – all without having to touch any code. However, with it comes scripts that may use third-party cookies on your visitors’ browsers, therefore, raising privacy concerns. But don’t worry, you can still use GTM without meddling with users’ privacy. In this article, we will see how Google Tag Manager uses cookies and what you can do to comply with privacy regulations like GDPR and CCPA for cookies.

Already a GTM user?

What is Google Tag Manager and how does it work?

Google Tag Manager (GTM) is a tag management system that allows you to effortlessly manage tags and trackers on your website without having to modify the code directly.

As you probably know, websites have many different types of code running on them. Sometimes that code can be used to track how visitors interact with the site—for example, by recording page views and clicks. GTM helps with this process by allowing you to add and manage these kinds of tags from a single dashboard.

You can add new tags or remove old ones, and then activate them on any site or app. You can also see which tags are firing on any given page and use its tracking feature to automatically add data points when certain actions occur on your site.

In short, Google Tag Manager lets you:

  • create tags that collect data from your website visitors,
  • use those tags to measure how customers are interacting with your site, and
  • set up triggers so that certain actions automatically trigger new tags or updates to existing ones.
how-does-google-tag-manager-work

You can use Google Tag Manager to

  • track page views on your site,
  • track button/link clicks (signing up for a newsletter, filling out a form, external links, internal links),
  • track conversions (making a purchase),
  • collect information about users’ devices and browsers,
  • collect information about user behavior (e.g. user scroll pattern), etc.

Does Google Tag Manager use cookies?

No, Google Tag Manager does not use cookies, by default. It enables tags for third-party scripts that may place cookies on the user’s device. GTM can read the value of first-party cookies set by your website but does not do anything with third-party cookies.

Although Google Tag Manager does not set any cookies, there is one case where they do. If you enable GTM’s Preview and Debug mode, it sets a few first-party cookies on the site being previewed. These cookies are necessary for the Preview mode to work—that is, to display what is happening on your website and which tags are firing. Only site admins or users who have enabled the preview and debug mode will receive these cookies; when you exit Preview and Debug mode, GTM deletes these cookies from your device.

Google Tag Manager and GDPR

Google Tag Manager is GDPR compliant and allows you to use tags across multiple domains with a single installation. It also gives you full control over the data that is being sent to your website, allowing you to have complete transparency over what data is being collected.

It may collect some aggregated data about tag firing to help monitor, provide diagnostics, and improve the quality of its systems. However, this data does not include any personally identifiable information. Other than HTTP request logs that expire in 14 days, and other non-personal diagnostics data, GTM does not collect, store or share any PII about visitors to its users. Neither does it use tracking technologies like cookies.

However, suppose you want to use Google Analytics or other tools on your website via GTM. You need to update your privacy policy accordingly and get consent if these tools collect the personal data of the visitors.

Consent management in Google Tag Manager

The Tag Manager includes several features that help to manage how tags behave in response to user consent states. Google Consent Mode lets you control how tags behave, including which ones fire on a page and which don’t, depending on whether the user has granted consent for your site. 

The Consent Initialization trigger in GTM makes sure that all consent settings are executed before tags fire in response to any other triggers. This trigger can be used in conjunction with a third-party provider that integrates with Tag Manager’s consent management capabilities. Each web container includes a Consent Initialization – All Pages trigger by default, which you can select to fire any tags that require it.

How to comply with cookie laws when using Google Tag Manager?

If you use Google Tag Manager on your website to deploy tags that use cookies, you can use this checklist to comply with privacy laws

  • Keep a list of all third-party scripts/tags your GTM deploys.
  • Perform a cookie scan to identify cookies set by your website.
  • Check if they use cookies that track user data.
  • If they do, add a cookie banner to your website to get user consent.
  • Ensure you share necessary details about cookies used and what they do while asking for consent.
  • Allow users to opt out (along with opt-in) of these cookies.
  • Let users choose consent for cookies based on their category (e.g. if a user wants to disable analytics cookies and enable all others, there should be an option to do so.)
  • Automatically block all third-party (and other non-essential) cookies when the user first arrives on your site, and only unblock cookies that they have given consent for.
  • Allow users an option to withdraw consent later.
  • Keep a log of all consent received to use as proof if requested.
  • Share a detailed explanation of all cookies in a privacy or cookie policy and provides its link on the cookie banner and other important pages of your website.

Comply with cookie laws and
minimize your legal risks

Try for free

14-day free trialCancel any time

CookieYes and Google Tag Manager: auto-block third-party cookies

Probably, the most important thing to consider in the checklist will be to auto-block all “third-party cookies” during a user’s first visit to your site. This can be done through a consent management platform (CMP). However, if you are using GTM, tags may fire before the CMP can block these cookies. Therefore, it is best to use a CMP that helps you take advantage of all the features of GTM without compromising your users’ privacy.

CookieYes is just the perfect solution for you.

CookieYes is a CMP for cookies that installs a cookie banner on your website and ensures the site does not store cookies until the user gives consent. It blocks all third-party cookies except for strictly necessary ones and acts as a middleman for websites that use Google Tag Manager. For example, suppose the user consents to allow all cookies except analytics cookies. In that case, CookieYes will change the tag trigger condition in GTM so that tags that set analytics cookies will not run.

In this way, CookieYes perfectly integrates with Google Tag Manager to give you and your users the best possible experience.

CookieYes has achieved the prestigious status of being an official certified Google CMP Partner. Additionally, we are proud to announce that we are now a registered and certified IAB CMP.

Read how you can implement Google Consent Mode with CookieYes and Google Tag Manager.

Frequently asked questions

Does Google Tag Manager set cookies?

Google Tag Manager does not set any cookies on its own. The only time a cookie is set is when you are using preview and debug mode, which just gives you a view of what tags are firing on each page. If you’re using third-party tags, they may set cookies on user devices if they have been configured to do so.

Does Google Tag Manager need cookie consent?

If you use Google Tag Manager to manage third-party tags, code snippets, or tracking pixels on your website, those tags may set third-party cookies. If this is the case, then you may need cookie consent to comply with GDPR.

Is Google Tag Manager a first-party cookie?

Google Tag Manager is not a first-party cookie. First-party cookies are those set by the same domain as the website in which they are being served, while third-party cookies are set by sites other than the one you’re currently on. Google Tag Manager does not set any cookies at all. The only exception is when you activate its Preview & Debug mode, which sets non-tracking cookies that are essential for the mode to work, and this mode is only visible to the GTM account admins.

Can Google Analytics track cookies?

Yes, Google Analytics can track cookies.

Google Analytics is a web analysis tool that allows website owners to monitor how people use their sites. It uses cookies to track users as they move from page to page on a site.

The Analytics cookie records information about users’ devices, such as their operating system, IP address, and location, as well as the date and time of their visit. It generates reports on pageviews, session durations, and bounce rates that will help you understand how engaging your web pages are. Google Analytics also includes information about the page they visited on your site and what search terms they used when arriving at your site through an organic search result or referral link from another site.

This is why GDPR compliance for Google Analytics is important.

Hey,
are you an agency?

Deploy cookie banners on multiple client websites with our agency platform.

Partner with CookieYes

Up to 50% off on licenses