Using Google Tag Manager in a GDPR-compliant way

Google Tag Manager (googletagmanager.com) does not load trackers itself, it manages them. The actual data-protection issue is the tags it deploys.

Is this a risk?

If the Tag Manager loads consent-requiring tags (Analytics, Ads, Pixel) before or despite a rejection, there is no legal basis for these under § 25 (1) TDDDG. The container request itself already transmits the IP to Google (USA).

What you can do

• Use Consent Mode or a trigger condition so that tags fire only after consent.
• Assign each tag in the container to a category and check it against the consent status.
• Consider server-side tagging, but carry over the consent logic consistently.
• After setup, check in the “Network” tab what loads before the first click.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.