In this guide
- Google Tag Manager is a container that loads your tags. GDPR obligations come from what the tags do.
- Tags that set cookies or send personal data usually need consent in the EU and UK.
- Use consent settings on tags, keep records, sign data processing agreements and tell visitors clearly.
"Is Google Tag Manager GDPR compliant?" is a common question with an unhelpful short answer: it depends on what you load. Tag Manager has no ability to know whether a tag is lawful. It runs what you tell it to run. This page explains what Tag Manager does and does not do, what your obligations are, and how to set it up so consent actually controls your tags. It is general information, not legal advice. See also Consent Mode v2 and server-side tracking and GDPR.
What Tag Manager itself does
Tag Manager itself does not set tracking cookies or build profiles. It loads a script and runs your tags. Google processes some data to deliver the container, such as the visitor's IP address when the container file is requested, and publishes terms for that. The tags are where most of the questions arise: they set cookies and send data to vendors.
3 things to remember
Scroll and the points stack up.
Google Tag Manager is a container that loads your tags. GDPR obligations come from what the tags do.
Tags that set cookies or send personal data usually need consent in the EU and UK.
Use consent settings on tags, keep records, sign data processing agreements and tell visitors clearly.
What needs consent
| Tag type | Typical need for consent in the EU and UK |
|---|---|
| Strictly necessary (login, cart, security) | No |
| Analytics cookies and identifiers | Usually yes |
| Advertising and remarketing | Yes |
| Personalisation and social widgets | Usually yes |
| A heat-map or session recording | Usually yes |
How to make consent control your tags
Choose a consent platform
One that supports Google Consent Mode and records choices.
Set defaults to denied where required
Before the container loads.
Add consent settings to tags
In each tag, under consent settings, list the consent types it needs.
Use built-in consent checks
Many templates check consent on their own.
Test accept, reject and partial choices
In Preview and a private window.
Runs on your domain, anywhere
Your tracking runs on your own domain, so a visit from any country is handled the same way.
Server containers
A server container does not change the rules, but it gives you control. You can remove fields, hash identifiers, add consent checks to the tags and decide what each vendor receives. Open Tracked adds the Anonymizer for IP addresses, consent switches on the Enricher and a choice of retention for the Data Store. See transformations.
Contracts and records
- Data processing agreements with every vendor that handles personal data for you, including your hosting provider.
- Records of processing: list the tags, their purposes, the vendors and the data they receive.
- A cookie notice that lists what is set and why.
- A privacy notice that names the purposes and recipients.
- Retention: how long each tool keeps data.
A practical checklist
A worked example
A store audits its container and finds sixteen tags. Four set cookies for advertising and fire on every page view with no consent setting. Two are old tags for a platform it no longer uses. One Custom HTML tag, added by a former agency, loads a third-party script nobody can explain. The fix takes an afternoon: delete the two old tags, add advertising consent to the four, replace the mystery script after finding out what it does, and write a one-page note listing every tag, its purpose and its vendor. The store now has a container it can explain to a regulator, a client or a new colleague, and its consent banner finally controls the tags.
The effort was small compared with the risk it removed. Most consent problems are of this kind: not clever violations, but forgotten tags and missing settings.
Ask Ari instead of digging through reports
Ari reads your tracking and ad data and answers in plain words.
Frequently asked questions
Is Google Tag Manager GDPR compliant?
Tag Manager is a tool. Compliance depends on the tags you load, your consent set-up, your contracts and your records.
Do all tags need consent?
No. Strictly necessary tags do not. Analytics and advertising tags usually do in the EU and UK.
Does server-side GTM make me compliant?
No. It gives you control that helps you comply. The rules still apply.
What should I record?
The tags, their purposes, vendors, data and retention, plus consent choices.
Where do I start?
List your tags, set consent settings on each and test accept and reject.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Guides · 6 min read
