You Can't Trust Your Tag Neither: Privacy Leaks and Potential Legal Violations within the Google Tag Manager

Gilles Mertens; Nataliia Bielova; Vincent Roca; Cristiana Santos

doi:10.1109/EuroSP63326.2025.00015

You Can't Trust Your Tag Neither: Privacy Leaks and Potential Legal Violations within the Google Tag Manager

Gilles Mertens^*
, Nataliia Bielova
, Vincent Roca
, Cristiana Santos

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

Abstract

Tag Management Systems (TMS) were developed in order to support website Publishers in installing multiple third-party JavaScript scripts (Tags) on their websites. Google has proposed its own TMS called "Google Tag Manager"(GTM) that is currently present on 52% of the top 1 million most popular websites. However, GTM has not yet been thoroughly evaluated by the academic research community. In this work, we study, for the first time, the Tags provided within the GTM system. Our methodology consists in installing Tags in isolation to analyze the types of data that Tags collect and contrast them to the legal and technical documentation, in collaboration with a legal expert. Across three studies - in-depth analysis of 6 Tags, automated analysis of 718 Tags, and analysis of Google "Consent Mode"- we discover multiple hidden data leaks, incomplete and diverging declarations, undisclosed third- parties and cookies, personal data sharing without consent and we further identify potential legal violations within EU Data Protection law.

Original language	English
Title of host publication	Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025
Publisher	IEEE
Pages	93-112
Number of pages	20
ISBN (Electronic)	9798331594930
DOIs	https://doi.org/10.1109/EuroSP63326.2025.00015
Publication status	Published - 26 Aug 2025
Event	10th IEEE European Symposium on Security and Privacy, Euro S and P 2025 - Venice, Italy Duration: 30 Jun 2025 → 4 Jul 2025

Publication series

Name	Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025

Conference

Conference	10th IEEE European Symposium on Security and Privacy, Euro S and P 2025
Country/Territory	Italy
City	Venice
Period	30/06/25 → 4/07/25

Bibliographical note

Publisher Copyright:
© 2025 IEEE.

Keywords

consent
GDPR compliance
Google Tag Manager
GTM
online tracking
privacy
website Publishers

Access to Document

10.1109/EuroSP63326.2025.00015

Cite this

Mertens, G., Bielova, N., Roca, V., & Santos, C. (2025). You Can't Trust Your Tag Neither: Privacy Leaks and Potential Legal Violations within the Google Tag Manager. In Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025 (pp. 93-112). (Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025). IEEE. https://doi.org/10.1109/EuroSP63326.2025.00015

Mertens, Gilles ; Bielova, Nataliia ; Roca, Vincent et al. / You Can't Trust Your Tag Neither : Privacy Leaks and Potential Legal Violations within the Google Tag Manager. Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025. IEEE, 2025. pp. 93-112 (Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025).

@inproceedings{e3352f664fb041e4adab4f59610ffbd5,

title = "You Can't Trust Your Tag Neither: Privacy Leaks and Potential Legal Violations within the Google Tag Manager",

abstract = "Tag Management Systems (TMS) were developed in order to support website Publishers in installing multiple third-party JavaScript scripts (Tags) on their websites. Google has proposed its own TMS called {"}Google Tag Manager{"}(GTM) that is currently present on 52\% of the top 1 million most popular websites. However, GTM has not yet been thoroughly evaluated by the academic research community. In this work, we study, for the first time, the Tags provided within the GTM system. Our methodology consists in installing Tags in isolation to analyze the types of data that Tags collect and contrast them to the legal and technical documentation, in collaboration with a legal expert. Across three studies - in-depth analysis of 6 Tags, automated analysis of 718 Tags, and analysis of Google {"}Consent Mode{"}- we discover multiple hidden data leaks, incomplete and diverging declarations, undisclosed third- parties and cookies, personal data sharing without consent and we further identify potential legal violations within EU Data Protection law.",

keywords = "consent, GDPR compliance, Google Tag Manager, GTM, online tracking, privacy, website Publishers",

author = "Gilles Mertens and Nataliia Bielova and Vincent Roca and Cristiana Santos",

note = "Publisher Copyright: {\textcopyright} 2025 IEEE.; 10th IEEE European Symposium on Security and Privacy, Euro S and P 2025 ; Conference date: 30-06-2025 Through 04-07-2025",

year = "2025",

month = aug,

day = "26",

doi = "10.1109/EuroSP63326.2025.00015",

language = "English",

series = "Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025",

publisher = "IEEE",

pages = "93--112",

booktitle = "Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025",

address = "United States",

}

Mertens, G, Bielova, N, Roca, V & Santos, C 2025, You Can't Trust Your Tag Neither: Privacy Leaks and Potential Legal Violations within the Google Tag Manager. in Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025. Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025, IEEE, pp. 93-112, 10th IEEE European Symposium on Security and Privacy, Euro S and P 2025, Venice, Italy, 30/06/25. https://doi.org/10.1109/EuroSP63326.2025.00015

You Can't Trust Your Tag Neither: Privacy Leaks and Potential Legal Violations within the Google Tag Manager. / Mertens, Gilles; Bielova, Nataliia; Roca, Vincent et al.
Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025. IEEE, 2025. p. 93-112 (Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - You Can't Trust Your Tag Neither

T2 - 10th IEEE European Symposium on Security and Privacy, Euro S and P 2025

AU - Mertens, Gilles

AU - Bielova, Nataliia

AU - Roca, Vincent

AU - Santos, Cristiana

PY - 2025/8/26

Y1 - 2025/8/26

N2 - Tag Management Systems (TMS) were developed in order to support website Publishers in installing multiple third-party JavaScript scripts (Tags) on their websites. Google has proposed its own TMS called "Google Tag Manager"(GTM) that is currently present on 52% of the top 1 million most popular websites. However, GTM has not yet been thoroughly evaluated by the academic research community. In this work, we study, for the first time, the Tags provided within the GTM system. Our methodology consists in installing Tags in isolation to analyze the types of data that Tags collect and contrast them to the legal and technical documentation, in collaboration with a legal expert. Across three studies - in-depth analysis of 6 Tags, automated analysis of 718 Tags, and analysis of Google "Consent Mode"- we discover multiple hidden data leaks, incomplete and diverging declarations, undisclosed third- parties and cookies, personal data sharing without consent and we further identify potential legal violations within EU Data Protection law.

AB - Tag Management Systems (TMS) were developed in order to support website Publishers in installing multiple third-party JavaScript scripts (Tags) on their websites. Google has proposed its own TMS called "Google Tag Manager"(GTM) that is currently present on 52% of the top 1 million most popular websites. However, GTM has not yet been thoroughly evaluated by the academic research community. In this work, we study, for the first time, the Tags provided within the GTM system. Our methodology consists in installing Tags in isolation to analyze the types of data that Tags collect and contrast them to the legal and technical documentation, in collaboration with a legal expert. Across three studies - in-depth analysis of 6 Tags, automated analysis of 718 Tags, and analysis of Google "Consent Mode"- we discover multiple hidden data leaks, incomplete and diverging declarations, undisclosed third- parties and cookies, personal data sharing without consent and we further identify potential legal violations within EU Data Protection law.

KW - consent

KW - GDPR compliance

KW - Google Tag Manager

KW - GTM

KW - online tracking

KW - privacy

KW - website Publishers

UR - https://www.scopus.com/pages/publications/105016225658

U2 - 10.1109/EuroSP63326.2025.00015

DO - 10.1109/EuroSP63326.2025.00015

M3 - Conference contribution

AN - SCOPUS:105016225658

T3 - Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025

SP - 93

EP - 112

BT - Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025

PB - IEEE

Y2 - 30 June 2025 through 4 July 2025

ER -

Mertens G, Bielova N, Roca V, Santos C. You Can't Trust Your Tag Neither: Privacy Leaks and Potential Legal Violations within the Google Tag Manager. In Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025. IEEE. 2025. p. 93-112. (Proceedings - IEEE 10th European Symposium on Security and Privacy, Euro S and P 2025). doi: 10.1109/EuroSP63326.2025.00015

You Can't Trust Your Tag Neither: Privacy Leaks and Potential Legal Violations within the Google Tag Manager

Abstract

Publication series

Conference

Bibliographical note

Keywords

Access to Document

Other files and links

Embargoed Document

Fingerprint

Cite this