Using Google Tag Manager in a GDPR-compliant way

Google Tag Manager (googletagmanager.com) does not load trackers itself, it manages them. The actual data-protection issue is the tags it deploys.

The most common mistake with Tag Manager is assuming a blocked consent tool in the container is enough. As long as the container snippet sits in the <head>, a connection to googletagmanager.com is established on page view and the IP address is transmitted to Google — before any tag fires. For the container itself this can only be avoided by loading it after consent or serving it server-side.

Google Consent Mode v2 has been effectively mandatory for advertising functions in the EEA since March 2024 if conversion data is to flow to Google Ads. But it does not replace a consent tool: Consent Mode only adjusts the behaviour of the Google tags to the consent status — the status itself must still be captured by a banner that meets the requirements for consent.

With server-side tagging, tag execution moves to a dedicated endpoint (often a subdomain). This improves load time and data control but does not shift the consent requirement: server-side tags that access client-side identifiers also need prior agreement.

Is this a risk?

If the Tag Manager loads consent-requiring tags (Analytics, Ads, Pixel) before or despite a rejection, there is no legal basis for these under § 25 (1) TDDDG. The container request itself already transmits the IP to Google (USA).

What you can do

• Use Consent Mode or a trigger condition so that tags fire only after consent.
• Assign each tag in the container to a category and check it against the consent status.
• Consider server-side tagging, but carry over the consent logic consistently.
• After setup, check in the “Network” tab what loads before the first click.

Häufige Fragen

Does Google Tag Manager itself require consent?

The container call loads no trackers but transmits the IP address to Google (USA) on page view. Strictly speaking that alone is access without technical necessity — conservatively, the container is therefore loaded only after consent.

Is Consent Mode v2 enough instead of a cookie banner?

No. Consent Mode only controls how Google tags react to the consent status. The status must be captured by a separate consent tool that offers a real choice between acceptance and rejection.

How do I ensure tags only fire after agreement?

Give each tag in the container a trigger exception or a consent condition that checks the consent status of the relevant category. Then verify in preview mode and the Network tab what loads before the first click.

Does server-side tagging help with consent?

It improves performance and data control but does not replace consent. Server-side tags that process personal data need the same legal basis as client-side ones.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.