# An Analysis of Client-and Server-Side Google Tag Manager and its Tags on the Web

Gilles Mertens, Nataliia Bielova, Vincent Roca, Ahmed Bouhoula, Marouanne Akassab

► To cite this version:

Gilles Mertens, Nataliia Bielova, Vincent Roca, Ahmed Bouhoula, Marouanne Akassab. An Analysis of Client-and Server-Side Google Tag Manager and its Tags on the Web. 2026. hal-05466083v2

HAL Id: hal-05466083

https://hal.science/hal-05466083v2

Preprint submitted on 6 Feb 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
# An Analysis of Client-and Server-Side Google Tag Manager and its Tags on the Web

Gilles Mertens

Centre Inria de l'Université
Grenoble-Alpes, France
gilles.mertens@inria.fr

Nataliia Bielova

Centre Inria de l'Université
Côte d'Azur, France
nataliia.bielova@inria.fr

Vincent Roca

Centre Inria de l'Université
Grenoble-Alpes, France
vincent.roca@inria.fr

Ahmed Bouhoula

ETH Zurich
Switzerland
ahmed.bouhoula@inf.ethz.ch

Marouanne Akassab

Centre Inria de l'Université
Grenoble-Alpes, France
marouaneakassab@gmail.com

## ABSTRACT

Google Tag Manager (GTM) enables website Publishers to install analytics, advertising, and other tracking services as “Tags” on their websites. Traditionally, in Client-Side GTM, Tags collect and send data directly from the browser to third-party servers. However, as today’s browsers and extensions increasingly block third-party trackers, Google introduced a Server-Side GTM in 2020. This GTM version allows to install and execute Tags directly on a first-party server, thus hiding the presence of third-party trackers. In this study, we perform a crawl of 80K popular websites worldwide to analyze the adoption of Client- and Server-Side GTM and the prevalence of their Tags. Our results show that GTM is present on 28.8% of websites, with 6.7% of these sites obfuscating its presence. Our Tags detection methodology is able to measure the prevalence of all GTM Tags – Official, Template, HTML and Image Tags – globally and reveals a strong dominance of Tags provided by Google, which appear on 95.3% of sites. We further analyze 386K HTML Tags and find that they invoke third-party libraries on at least 81.2% of websites, to potentially share personal data. Finally, we detect the presence of Server-Side GTM on 3K websites and 398 Server-Side Tags instances on the Web. We also propose a GTM-Eye browser extension that detects GTM and its Tags accessible to everyone.

## KEYWORDS

privacy, Google Tag Manger, GTM, Client-Side tracking, Server-Side tracking, obfuscation

## 1 INTRODUCTION

In the modern web ecosystem, websites often load resources from a multitude of third-party domains, including advertising networks, tracking services, content distribution networks (CDNs), analytics platforms, and consent management platforms. In 2024, 92% of websites included such third-party content [82]. Website owners (or Publishers) rely on these third-party services to outsource technical tasks, gain insights through analytics, and monetize traffic through targeted advertising[18]. Integrating such services typically requires embedding code snippets, known as Tags in the Ad-Tech industry, directly into a site’s source code.

When Publishers use many Tags, managing them becomes increasingly complex and error-prone. To address this challenge, Tag Management Systems (TMS) were created – they centralize Tag

deployment, offering Publishers a graphical interface to select and configure Tags without manually editing source code, and automatically adding them to the Publisher’s website. In 2012, Google launched its free TMS – Google Tag Manager (GTM) – which has since become widely adopted. Existing online sources estimate that GTM is present on 61% of the 100K most popular websites [16], with a reported market share exceeding 99% [68]. These sources however do not disclose their detection methodologies. Despite its ubiquity, no academic study has examined the prevalence of GTM on the web, nor the popularity of the Tags it proposes.

In its initial architecture, known as GTM “Client-Side”, Tags operate entirely in the user’s browser. This model relies on the browser’s ability to communicate directly with third-party domains to fetch scripts, set cookies, and transmit user data. In 2024, 92% of websites communicated with third-party servers [82], however, privacy protections introduced by major browsers have increasingly disrupted this Client-Side architecture: Safari [51, 52], Firefox [64], and Brave [15] now block many third-party scripts and cookies by default. Furthermore, approximately one third of web users use content blockers [11, 12, 29], impairing the functionality of Tags or rendering them ineffective at collecting user data. To counter this, some Publishers deploy evasion techniques such as serving tracking scripts from first-party domains, randomizing URLs, or modifying HTTP request characteristics [9, 30].

In 2020, Google introduced GTM “Server-Side” [46], an alternative architecture in which Tags are executed on a remote first-party server instead of the browser. In this architecture, the collected data is first sent to the Publisher’s server, which then handles communication with third-parties behind the scenes. Recently, Fouad et al. [31] proposed two methods to detect server-side tracking by identifying the trackers that shifted from Client- to Server-Side. However, today these methods faces several limitations. First, Google’s recent guidance encourages Publishers to deploy Server-Side GTM on the same domain as the website, rather than on a subdomain, undermining detection techniques based on identifying “emerging subdomains”. Second, detection of “cloaked domains” using DNS records is also made more difficult since Google discourages the use of CNAME cloaking [23], and Publishers can now self-host Server-Side GTM on the same infrastructure as the website itself.

Beyond circumventing browser-level privacy protections and content-blocking tools, the use of server-side tracking also obscures the ultimate recipients of user data, complicating efforts to perform
<figure><img src="image_2.png" /><figcaption>(a) Client-Side GTM.</figcaption></figure>

<figure><img src="image_3.png" /><figcaption>(b) Server-Side GTM.</figcaption></figure>

<caption>**Figure 1:** Overview of Client- and Server-Side GTM. Red arrows represent the flow of data collected by the Tags to Data Recipients. Circled numbers show the chronology of events. In reality, some Tags send data to multiple domains.</caption>

independent audits. While Fouad et al. [31] proposed a method to detect trackers that migrate from Client- to Server-Side, this approach fails to capture trackers that are deployed on the server from the start, without ever being present on the Client-Side. To the best of our knowledge, no existing work has developed other methods to detect trackers operating entirely server-side.

In this work, we present the first large-scale study, measuring the prevalence of both Client-Side and Server-Side GTM deployments on the Top 80,605 websites and proposing methods to identify Tags in both environments, answering the following research questions:

* **RQ1.** How prevalent is Client-Side GTM?

* **RQ2.** Do website Publishers attempt to obfuscate the presence of GTM on their websites?

* **RQ3.** Which Client-Side Tags are the most popular?

* **RQ4.** Is Server-Side GTM detectable and how widely is it adopted?

* **RQ5.** How to identify Server-Side Tags and how prevalent are they?

Our key findings are the following:

**Client-Side GTM** We introduce a robust method to detect Client-Side GTM that remains effective even when websites obfuscate it. By crawling 80,605 websites, we find that 28.8% use Client-Side GTM, of which 6.7% employ obfuscation techniques.

**Client-Side Tags** We develop a method to identify all Official, HTML, and Image Tags, as well as 78.9% of Template Tags from GTM's Community Gallery. Our analysis shows that Google is the most popular Tag provider, whose Tags are present in 95.3% of Client-Side Containers. By analyzing 386,230 HTML Tags, we find that many call functions provided by third-party libraries, potentially enabling the transmission of user data.

**Server-Side GTM** We propose a new method to detect Server-Side GTM by relying on Collector Tags, whose role is to send data from the browser to the Server-Side GTM Container. We find that Collector Tags are present on 3.8% of websites, corresponding to 13.8% of websites that use a Client-Side GTM Container.

**Server-Side Tags** We introduce a method to infer the presence of Server-Side Tags based on the cookies they create and detect 12 types of Server-Side Tags deployed across 325 websites.

**GTM-EyE** We develop a browser extension, available in supplementary materials [55], capable of detecting Client-Side Containers on websites and identifying the Tags they embed, including Collector Tags that indicate the presence of a Server-Side GTM.

## 2 BACKGROUND

In this section, we introduce the Client- and Server-Side architectures and explain the concept and the different types of Tags.

**GTM Client-Side Containers.** Client-Side GTM contains “Client-Side Container” which embeds the Tags selected by the Publisher<fnref n="1" />. Figure 1a illustrates a typical Client-Side installation, where a Publisher of example.com has created a Container using the GTM interface, and embedded the generated code snippet into their website. This snippet loads the Container – a JavaScript script named gtm.js – from the domain googletagmanager.com. When a user visits the website (step ① in Figure 1a), the gtm.js script is loaded into the page ②, runs in the background and executes the Tags. These Tags collect data ③, which is transmitted to third-party servers ④.

**GTM Server-Side Containers.** In a Server-Side GTM, Tags are executed on a first-party server instead of the browser (Figure 1b). A Server-Side GTM installation is composed of a “Client-Side Container” and a “Server-Side Container”, that runs on a server. In this system, when a user visits the website (step ① in Figure 1b), a Client-Side Container is loaded ② with a special Tag called “Collector Tag” that collects data ③ and sends it to the Server-Side Container configured by the Publisher ④. Google recommends installing this server on the first-party domain [34] or a first-party subdomain [35]. Upon receiving data, the Server-Side Container shares it with the Tags, which then transmits it to third-party servers ⑤. Optionally, Server-Side Tags create cookies in the users’ browser ⑥. As such the presence of a Client-Side Container on a website may indicate both the presence of Client-Side Tags as well as the presence of Server-Side Container and Server-Side Tags.

<footnote n="1">¹In the remainder of this paper, unless noted otherwise, the term “Container” refers to “Client-Side Container”.</footnote>
<figure><img src="image_4.png" /><figcaption>Figure 2: High-level overview of our methods to analyze GTM.</figcaption></figure>

## 2.1 Tags

A Tag is a software component embedded in a Client- or Server-Side Container to provide a service to the Publisher, typically related to analytics or marketing. Tags are commonly developed by third-party entities such as marketing platforms, analytics providers, or independent developers, though less frequently, they may be developed by Publishers themselves. The function of a Tag is to collect data about the end-user, their device, or their interactions on the website, and transmit it to a third-party service, referred to as the Data Recipient. For example, "Facebook Pixel" Tag sends data to Facebook to enable Publishers to send retargeted advertising [83]. Another example is the Google Tag, formerly known as Google Analytics until renamed in 2023 [43], which sends statistics about users to the Google Analytics service and report them to the Publisher [33]. GTM classifies Tags into four main categories:

**Officially supported Tags** are natively supported by GTM and appear as primary options in the GTM interface. As of December 2025, there exists 80 of such Tags for Client-Side GTM, including 18 Tags provided by Google, and 9 Tags for Server-Side GTM, all provided by Google. The source code of these Tags is not available. Examples of an officially supported Client-Side Tag is the "Google Tag" and officially supported Server-Side Tag is the "Google Analytics: GA4 Tag". We consider that the Tag Provider is the company that is written next to the Tag Name in the GTM interface.

**Template Tags** can be developed by Data Recipients, independent developers or Publishers themselves. Optionally, they can be submitted to GTM's "Community Template Gallery" a public Tag marketplace accessible within a submenu of the GTM interface. As of **Gilles: August 2025, this marketplace contains 984 Tags for Client-Side GTM and 170 Tags for Server-Side GTM.** Tags published through this gallery are open source and their code is available on GitHub. Examples include the Client-Side "Facebook Pixel" Tag, created by an independent developer, and the Server-Side "Pinterest API for Conversions Tag" Tag, created directly by Pinterest. We consider that the Tag Provider is the GitHub account providing the Tag.

**HTML Tags** are Tags that contain HTML code. According to the GTM documentation, such Tags allow Publishers to embed arbitrary HTML code, typically provided by third-parties that do not have a Tag available in GTM [36]. The HTML code they embed can include JavaScript (e.g., via `<script>` elements) and load external resources. Upon execution, GTM adds the HTML directly into the DOM of

the webpage. HTML Tags are only available in Client-Side GTM and the GTM interface does not show who provides this Tag.

**Image Tags** are Tags that do not contain any code but an URL. Upon execution, GTM inserts a `<img src="URL">` HTML element in the DOM prompting the browser to send an HTTP request to such URL. Generally, the URL of such Tags is provided by Data Recipients. HTML Tags are only available in Client-Side GTM and the GTM interface does not show who provides this Tag.

### 2.1.1 Template Tag Permissions.
According to GTM's documentation, Template Tags are executed within a restricted, sandboxed environment [45]. In this environment, access to certain browser features, such as setting cookies or injecting third-party scripts, requires permissions that Developers must declare when creating the Tag. Some permissions impose additional constraints. For example, the permission to set cookies require developers to specify cookie names or use a wildcard to allow any cookies. Similarly, the permission to include external scripts require declaring the URLs from which scripts are loaded.

## 3 METHODS

In this section, we present the methods used to address our five research questions through a large-scale web crawling study analyzing GTM installations on publicly accessible websites. Figure 2 presents a high level overview of our methods, highlighting our research questions and subsections where their methodology is described. Figure 3 further provides a detailed pipeline of our methods, which we describe in the following sections.

### 3.1 Data Collection

We develop our crawler using the OpenWPM platform [28], a well-established framework for automated web measurements. To maximize the discovery of embedded scripts, our crawler integrates automated interaction with consent banners. Prior work has demonstrated that accepting consent typically results in a higher number of scripts being loaded and exposes a broader range of data collection [54]. Specifically, we adopt the methods of Bouhoula et al. [14], which uses heuristics to detect consent banners and employs machine learning to classify their interactive elements, allowing us to automatically accept consent. This handles scenarios where the accept button is only accessible by navigating the notice. We perform all our crawls from a server connected to the Internet through an
<figure><img src="image_5.png" /><figcaption>Figure 3: Detailed overview of our methodology.</figcaption></figure>

institutional network, using an E5-4620 CPU and 256GB of memory and running Ubuntu 24.04.3 LTS.

### 3.1.1 Preliminary crawls.
We conducted two preliminary crawls in February and March 2025 to validate our methods. In the first crawl, we compared two approaches to detect Containers (Section 3.2). In the second crawl, we evaluated our method for identifying Template Tags (Section 3.7). In both crawls, we visited the top 5,000 websites from the Tranco list generated on 8 October 2024 [56].

### 3.1.2 Website selection for large-scale crawls.
We rely on the Chrome User Experience Report (CrUX) [21] from October 2025 to select websites for a large-scale crawl. Ruth et al. [70] have observed that it is significantly better in representing website popularity compared to other top lists. CrUX groups sites by popularity and country; we include all websites from the top-1k bucket of each of the 237 countries and remove duplicates.

### 3.1.3 Limitations.
On 5.2% (4,452) of the 85,057 websites, our crawler could not access the website or crashed during the visit of the website. We removed such websites from further analysis, resulting in a final dataset of 80,605 websites. Interactions with consent banners are imperfect: banners in non-English languages were machine-translated, which may have caused mistranslations and incorrect consent decisions. Additionally, the crawler did not emulate full user behavior (e.g., scrolling or clicking links) and only visited home pages, potentially missing Containers present on subpages.

## 3.2 Detection of Containers

In this section, we describe methods to answer RQ1 on the prevalence of Client-Side GTM. Each Container is implemented in a JavaScript library `gtm.js` and has a unique identifier `GTM-XYZ`. We evaluated two methods to detect Containers and get their identifier.

**Method 1: URL-based.** As written in Google's documentation [49], `gtm.js` scripts are loaded from www.googletagmanager.com/gtm.

`js?id=GTM-XYZ`, where `GTM-XYZ` is the Container's unique identifier. We identify Containers by matching HTTP request URLs against this pattern using a regular expression.

**Method 2: JavaScript-based.** Upon execution, the `gtm.js` creates a JavaScript global variable `google_tag_manager` containing, among other information, the Container's unique identifier `GTM-XYZ` (see ⚙️ in Figure 3). We therefore extract such identifier from this variable directly after interacting with the cookie notice.

#### 3.2.1 Evaluation of methods.
We used the preliminary crawl of 5,000 websites (see Section 3.1) to compare the effectiveness of both detection methods. The URL-based approach identified Containers on 1,629 websites, while the JavaScript-based method identified them on 1,668 websites. We have further manually inspected websites where two methods performed differently. On 57 websites, the *JavaScript-based* method detected a Container, while the *URL-based* method failed. On 37 websites, `gtm.js` was loaded from a different domain than `googletagmanager.com`. On 20 websites, the URL-based method did not detect the Container because the Container's script (typically `gtm.js`) was renamed.

On 18 websites, the *URL-based method* detected a Container, while the *JavaScript-based method* failed. Upon manual investigation, we could not determine the cause of failure on 7 websites, but found various causes for it on 11 websites: on 2 websites the Container was downloaded from `googletagmanager.com`, but did not run because the crawler could not accept consent in the consent banner; on 5 websites, the crawler was redirected to a different website before the Container could be detected; on 4 websites, the crawler crashed. We consider these to be standard, acceptable limitations inherent to web crawlers, as described in Section 3.1. We therefore adopt the *JavaScript-based* method to detect Containers as it yields a higher detection rate and is able to detect `gtm.js` scripts that are renamed and those loaded from other domains.
## 3.3 Detection of obfuscated Containers

To answer RQ2, we describe our method to detect obfuscated Containers allowing website Publishers to hide the presence of GTM.

3.3.1 *Identifying the origin of Containers.* In Section 3.2, out of 5,000 websites we have manually detected 20 websites where the gtm.js script was renamed and 37 websites where it was loaded from a different domain than www.googletagmanager.com. We therefore developed the following method to detect such cases and measure how often Containers are obfuscated on the Web. Upon detecting a Container with the JavaScript-based method, we identify its unique identifier, GTM-XYZ, but obtain no additional information about the name of the JavaScript library or the domain from which it is loaded. To download a copy of the gtm.js JavaScript library, our crawler makes a request to http://googletagmanager.com/gt m.js?id=GTM-XYZ outside the browser context. As all Containers are hosted on googletagmanager.com regardless of how they are deployed on websites [37], this method enables us to obtain the original unobfuscated gtm.js (see step Ⓐ in Figure 3). We then analyze the body of all HTTP responses on a website where the GTM- XYZ unique identifier of the Container was detected, and compare them to the content of gtm.js script we stored (see step Ⓑ in Figure 3). By detecting the corresponding HTTP request, we identify the specific URL (and domain) from which the Container was loaded and determine whether the gtm.js script was renamed.

3.3.2 *Evaluation of block lists.* Many content blockers use block lists to prevent the loading of trackers on websites. DNS-based block lists are used to block whole domains and contain only domain names. Blockers such as AdGuard DNS [1], Pi-hole [67], or user-defined host files [53, 84] commonly use these lists. In contrast, URL-based block lists match full or partial URLs and are typically used by browser-based blockers, including uBlock Origin [47], Adblock Plus [3], and AdGuard [5]. To evaluate whether GTM obfuscation techniques successfully circumvent block lists, we tested whether such lists block the URLs from which obfuscated Containers are loaded. We conducted all tests using the ubo-core library [48], a filter-list parser, used in uBlock Origin. We evaluated three DNS-based block lists: the AdGuard DNS Filter [6], used by AdGuard DNS; Steven Black's unified host file [77], used by Pi-hole; and Dan Pollock's host file [22]. In addition, we evaluated three URL-based block lists: the EasyPrivacy list [26], which Adblock Plus uses; uBlock Origin's Privacy Filter [81]; and AdGuard Spyware Filter [7], used by AdGuard's browser extension.

## 3.4 Detection of Client-Side Tags

To answer RQ3 about the popularity of Tags, we identify Tags embedded on websites through Containers by reverse engineering the gtm.js script. As described in Section 2, the gtm.js script is dynamically generated by Google, embedding the Tags selected by the Publisher and executing them in the end-user's browser.

We created a GTM account and set up a Container, where we added Tags incrementally, one at a time, and downloaded the resulting gtm.js script after each modification. By comparing the differences between these scripts and knowing which Tag was added at each step, we identified how Tags are embedded in the gtm.js script. We then developed a custom software library, called

GTM-EyE lib, which we use to detect and analyze the Tags embedded within Containers (see step Ⓐ in Figure 3). In the following, we describe the identification process for different categories of Tags:

3.4.1 *Identifying Officially supported Tags.* We found that the gtm.js script contains a unique identifier for each of the officially supported Tags. For example, when we install the "Hotjar Tracking Code" Tag, the identifier "__hjtc" will appear in the gtm.js script. However, in the gtm.js script, there is no straightforward mapping of such identifier to the official Tag name. We however found that the GTM configuration interface, when displaying the list of officially supported Tags, downloads a file (available in the supplementary materials [55]) in the background mapping each Tag name and Tag Provider with the Tag identifier visible in the gtm.js script.

3.4.2 *Identifying HTML and Image Tags.* Similarly, HTML and Image Tags use the identifiers __html and __img, respectively.

3.4.3 *Identifying Template Tags.* Unlike Officially Supported, HTML, or Image Tags, a Template Tag has a different identifier in each Container, making it impossible to recognize them based on this identifier. The identifier of Template Tags always start with "__cvt" followed a numeric code (e.g., "__cvt_169991386_257"). To identify Template Tags, we developed a different detection method.

Template Tags, submitted to GTM's Community Template Gallery, are available in a ".tpl" file format, available on GitHub. Although we could not find a formal specification or parser for .tpl files, our inspection reveals that they contain the Tag name, source code, and a list of permissions (see Section 2.1.1). When a Template Tag is installed in a Container, its code is compiled and embedded, along with its permissions, into the gtm.js script. The description of permissions in the gtm.js are in a different format than in the .tpl file. By analyzing the formats, we found a direct match and developed a program to convert formats. We downloaded the .tpl files of all the 1045 Template Tags available in the GTM interface, converted their permissions to match the format found in gtm.js scripts and added them to a database along with the Tag name. We then use this database to identify Template Tags using their permissions. During our preliminary crawls this technique enabled us to identify 69% of Template Tags encountered during our preliminary crawl.

When the provider of a Template Tag updates the Tag's code and uploads it to the Community Template Gallery, this new version is not automatically included in Containers. The website owner needs to confirm the new version of the Tag in the GTM interface before the Tag is updated in the gtm.js script. As a consequence, for each Template Tag, older versions of the same Tag can exist across Containers on the web. To identify such older versions Template Tags, we use the git history to extract older versions of .tpls, convert their permissions and also add them to our database. When also taking such older Tag versions into account, we could identify 78.9% of Template Tags during preliminary crawls. In total, we analyzed 2085 .tpl files from 1045 Template Tags available in the Template Gallery. On average, we find that Template Tags have 2.0 versions, with the "Data Tag" having 20 distinct versions.

3.4.4 *Limitations in identifying Template Tags.* Our approach to identify Template Tags using permissions has an inherent limitation since different Tags may have identical permissions, making it impossible to disambiguate them based on permissions alone.
Among the 1045 Template Tags analyzed, we identified 221 Tags (21.1%) that share the same permissions with another Tag. In these cases, we were not able to identify the Tag and excluded such 221 Tags from further analysis. Additionally, our approach does not identify Template Tags which are not published in the Template Gallery, for which we do not have a .tpl file.

## 3.5 Analysis of HTML Tags

HTML Tags allow Publishers to insert arbitrary HTML code in a website. To the best of our knowledge, these Tags have not been studied prior to this work (see Section 6). Unlike other types, HTML Tags do not have metadata about their origin, making it difficult to determine who created them. To further analyze HTML Tags, we extract their code from the gtm.js script. To do this we created our own HTML Tags using our testing Container and downloaded the resulting gtm.js script. Then, we searched for the code of our HTML Tag in the gtm.js script to identify where this HTML code is stored. HTML Tags can include JavaScript in two forms: external scripts, loaded from remote servers, and inline JavaScript, embedded directly within the HTML Tag. These inline and external scripts can access the page's content, interact with browser APIs, and communicate with third-party servers. Moreover, they can execute arbitrary code. We aim to fill this gap by investigating the provenance and characteristics of HTML Tags observed in the wild.

### 3.5.1 Provenance of HTML Tags.
Since HTML Tags are not registered in the GTM interface and their owners are not defined, we rely on the domains that the Tags include as a heuristic to link the Tag to the company that owns this domain. To achieve this we scan for domain names embedded in the code, using the expression `"/(?:[\w-]+\.)+[\w-]+\/"` and we verify the validity of the domain extracted with the *Public Suffix List* [65]. We then use Tracker Radar [25] to map each domain to the corresponding company. Next, to analyze the behavior of HTML Tags at scale, we focus on detecting interactions with third-party JavaScript libraries. Such interactions may occur either through direct inclusion of external libraries or through function calls to external libraries or other Tags.

### 3.5.2 Detecting inclusion of JavaScript libraries.
HTML Tags use two methods to inject external JavaScript libraries: 1) `<script>` HTML element with an `src` attribute, and 2) calling the `createElement("script")` JavaScript API to add a `<script>` element in the DOM of the web page. To detect scripts included via the `<script>` element, we parse and analyze the HTML code of each Tag [79]. To identify script inclusion via the `documentElement` API, we use the regular expression on the Tag's code: `/createElement("["']script["']\)/mi`. With this approach, we identified that 43.5% of HTML Tags indeed include external JavaScript libraries (see Section 4.4). The remaining 56.5% of HTML Tags may not include external JavaScript libraries but instead embed only inline JavaScript. We therefore further analyze function calls within the HTML Tags to better understand their potential functionality.

### 3.5.3 Detecting function calls to third-party libraries.
To capture functions calls from the inline JavaScript code of the HTML Tags, we use the regular expression `"/[a-zA-Z\._]{2,}\/(mig"`. To avoid capturing standard JavaScript APIs and less popular functions, we remove from our analysis all calls to standard JavaScript APIs (e.g.,

`document.createElement()` or `JSON.stringify()`), available in the supplementary materials [55], and functions that appear in fewer than 2,000 HTML Tags. For each remaining function, we identify relevant documentation using the search query `"<function name> function <company name>"` on Google search, where the company name is derived from the provenance analysis described above (see Section 3.5.1). We read this documentation to understand the purpose and functionality of the identified function calls.

### 3.5.4 Limitations.
Our approach for detecting script inclusion relies on a regular expression, which may miss dynamic inclusion of scripts. For example, code such as `"let a = "script"; document.createElement(a)"` would not be detected by our method. As a result, our measurements likely underestimate the true extent of script inclusions, and should be interpreted as a lower bound.

## 3.6 Detection of Server-Side Containers

In Server-Side GTM Publishers include the desired Tags on the server (see Figure 1b). In this section, we describe our method to detect Server-Side Containers and evaluate their prevalence on the web, thus answering **RQ4**.

### 3.6.1 Detecting potential Collector Tags.
A typical Server-Side GTM configuration contains a Client-Side Container, where a Collector Tag collects data and transmits it to the server (see step ④ in Figure 1b). On the server, the Server-Side Container receives the data and dispatches it to the Server Tags installed in this Container. Tags then send this data to the corresponding Data Recipients servers. GTM's official documentation recommends using as Collector Tag either the "Google Tag" or the "Google Analytics: GA4 Event". Such Tags are not always collector Tags. These Tags are Collector Tags only when the Publisher configures the URL of a Server-Side Container in the GTM interface. Without any additional information, they are only potential Collector Tags. Additionally, we also reviewed the technical documentation of three other companies that provide a server for GTM Server-Side Containers, Stape.io [76], TAGGRS [78], and Addingwell [75]. Only one of them, Stape.io, provides its own Collector Tag, called "Data Tag", compatible with all the implementations of GTM Server-Side Containers, and used exclusively as a Collector Tag. We therefore search for one of these three potential Collector Tags in the Client-Side Container, using the methodology described in Section 3.4.

### 3.6.2 Detecting the URL of Server-Side Containers.
Each potential Collector Tag must be configured with a "destination URL" pointing to a Server-Side Container, to act as *actual* Collector Tag. To extract this URL in the wild, we followed an approach similar to that used for Client-Side Tags. We created an empty Client-Side Container, and installed the three Collector Tags, one at a time. We created a URL to be used for a hypothetical Server-Side Container and configured each tested Collector Tag with this URL as the destination URL. Finally we downloaded the corresponding gtm.js script. In this script, the destination URL was found in a specific variable: the "Google Tag" and "Google Analytics: GA4 Event" store it in the `server container url` variable, while the "Data Tag" stores it in the `vtp_gtm_server_domain` variable. By detecting these variables, we are able to recognize Collector Tags and the presence of Server-Side Containers in the wild. On the opposite, when the
"serverContainer_url" variable is not set, the "Google Tag" and "Google Analytics: GA4 Event" Tags are not Collector Tags.

### 3.6.3 Limitations.
Our approach to detecting Server-Side GTM relies on three Collector Tags and therefore could miss some Server-Side deployments. However, the "Google Tag" and "Google Analytics: GA4 Event" tags appear on 88.0% and 77.2% of websites, respectively (see Table 3) and therefore if Publishers use these Tags as Collector Tags, our method covers a large portion Server-Side deployments in the wild. In principle, alternative mechanisms for collecting and transmitting data from the browser to a Server-Side Container exist, such as custom JavaScript code that sends data via the fetch API. We do not examine such mechanisms in this paper and as a result, our findings represents a lower bound on the actual prevalence of Server-Side Containers in the wild.

## 3.7 Detection of Server-Side Tags

In this section, we provide a methodology to detect Server-Side Tags and address RQ5. Similar to Template Tags in Client-Side GTM, Tags in Server-Side GTM have a permission system. One such permission allows a Tag to create cookies in the user's browser via the Set-Cookie header in HTTP responses from the Server-Side Container. We therefore analyzed all 9 Official and 170 Template Gallery Tags for Server-Side GTM and extracted the names of the cookies that each Tag specifies in their permissions. We compiled a list of cookies that each Tag can create (see step ⑦ in Figure 3). Then, we examined HTTP responses from domains where a Server-Side Container was detected (see step ⑧ in Figure 3). By matching the cookies present in the "Set-Cookie" header of these responses with the cookie names from the permission declarations, we inferred the likely presence of specific Server-Side Tags (see step ⑨ in Figure 3).

Limitations. We found that some Server-Side Tags create cookies with the same name which means that upon detection we are unable to identify which exact Tag is installed on the server. We manually analyzed such Tags and found they correspond to the same third-party company receiving the data. For instance, 5 Tags related to Facebook ("GDPR Ready Meta/Facebook CAPI by Sirdata", "Conversions API Tag", "Facebook Conversion API", "Meta CAPI Tag - TRKKN version" and "SignalSight Conversion API") create 3 cookies with the same name: "_fbc", "_fbp", "_gtmeec". We group these Tags as it is not possible to identify which one is installed. Furthermore, among the 202 Server-Side Tags available, only 94 Server-Side Tags potentially store cookies, according to their permissions. Moreover, 11 Tags have the permission to store cookies but do not declare the names of such cookies.

# 4 FINDINGS

In this section, we present the results of our large-scale measurement of 80,605 websites, where we detect the presence of Client- or Server-Side installations of GTM, as well as the embedded Tags, thus answering our research questions.

## 4.1 Prevalence of Client-Side GTM

We present our findings and answer RQ1 about the popularity of Client-Side GTM by detecting Containers with our JavaScript-based detection method described in Section 3.2.

### 4.1.1 One third of websites contain GTM.
Our analysis reveals that 28.8% (23,175) of websites contain Containers, indicating a widespread adoption of GTM on the Web. Interestingly, 11.1% of them (2,568 websites) contain several Containers. On 3.7% (867) of websites, the Container does not contain any Tags.

### 4.1.2 Publicly available data overestimate the prevalence of GTM.
While the prevalence of GTM was not studied in previous academic works, websites measuring trends, such as builtwith.com or w3techs.com estimate that GTM is present on between 49% and 60% of top 10K websites [16, 68]. In contrast, we detect GTM Containers on 28.8% of websites. While these sources do not reveal their methodology to detect GTM, our hypothesis is that they rely on HTTP requests to googletagmanager.com. To compare with our results, we analyzed outgoing HTTP requests to googletagmanager.com and found out that in addition to loading the gtm.js script, it is also used to load the Google Analytics script gtag.js. In our dataset, 53.5% (43,161) of websites made at least one request to googletagmanager.com, which is close to the reported numbers of 49% (w3techs.com) and 60% (builtwith.com). When further exploring these 45,781 websites, we found that only 22,247 indeed loaded a GTM Client-Side Container from googletagmanager.com, while 19,988 websites loaded only a gtag.js script from this domain without a gtm.js script. The remaining 3,546 websites did not load neither the gtm.js nor gtag.js scripts. This result suggests that relying on HTTP requests to googletagmanager.com overestimates the presence of GTM on the Web which has likely led to the overestimation presented by the website measuring trends.

## 4.2 Obfuscated Containers

In Section 4.1, we have detected Containers on 23,175 websites. We will report the findings in this section based on this dataset. To answer the RQ2, whether Publishers use techniques to obfuscate the presence of Google Tag Management on their websites, in this section we analyze the provenance and renaming strategies of the Container scripts (see Section 3.3). Table 1 presents the number of websites using the obfuscations methods we detected.

### 4.2.1 Containers not loaded from googletagmanager.com.
While our analysis reveals that 94.5% (21,908) of websites load their Container from Google's default domain, googletagmanager.com, we observe that some websites deviate from this. Specifically, we find that 5.7% (1,319) of websites load at least one Container from a first-party domain. Moreover, 1.1% (247) websites load the Container from other third-party domains, and among them, 156 websites load the Container from other domains owned by Google: google-analytics.com (115 websites) and googleoptimize.com

<table><caption>Table 1: Prevalence of renaming and origins of Containers.</caption><thead><tr><th>Origin of Containers</th><th>Container not renamed</th><th>Container renamed</th><th>Total</th></tr></thead><tbody><tr><td>1p sub domain</td><td>642 websites</td><td>421 websites</td><td>1,061 websites</td></tr><tr><td>1p same domain</td><td>30 websites</td><td>228 websites</td><td>258 websites</td></tr><tr><td>3p domain</td><td>149 websites</td><td>98 websites</td><td>247 websites</td></tr><tr><td>Total</td><td>819 websites</td><td>734 websites</td><td>1,557 websites</td></tr></tbody></table>
<table><caption>Table 2: Overview of the Diversity and Prevalence of Client-Side Tags.</caption><thead><tr><th>Type of Tag</th><th>Distinct Tags</th><th>Tag Instances</th><th>Websites containing one of such Tag</th><th>Mean number of Tags on a website</th></tr></thead><tbody><tr><td>Official</td><td>56 (0.0%)</td><td>831,853 (61.3%)</td><td>21,420 (96.0%)</td><td>37.3</td></tr><tr><td>HTML</td><td>244,291 (99.5%)</td><td>386,230 (28.5%)</td><td>17,528 (78.6%)</td><td>17.3</td></tr><tr><td>Template</td><td>408 (0.2%)</td><td>127,972 (9.4%)</td><td>11,717 (52.5%)</td><td>5.7</td></tr><tr><td>Image</td><td>643 (0.3%)</td><td>10,973 (0.8%)</td><td>1,818 (8.1%)</td><td>0.5</td></tr><tr><td>Total</td><td>245,398 (100%)</td><td>1,357,028 (100%)</td><td>23,175 (100%)</td><td>60.8</td></tr></tbody></table>

(41 websites). Note that some websites embed multiple Containers served from different domain (see Section 4.1).

### 4.2.2 Containers loaded from first-party domains.
Among the 5.7% (1,319) of websites that load a Container from a first-party domain, two distinct methods are used: 4.6% (1,061) of websites use a subdomain and 1.1% (258) use their first-party domain to load a Container. Websites may load Containers from a first-party subdomain to avoid block lists. DNS-based block lists would need to list each domain that serves a Container individually, which makes comprehensive blocking difficult. When a website loads the Container from its first-party domain, DNS-based block lists cannot block it without breaking the website. In our dataset, among the 1,061 websites that load a Container from a first-party subdomain, the 3 DNS-based block lists together block it in only 21.2% (225) of cases. As expected, none of the 3 DNS-based block lists blocks the Container on the 258 websites loading a Container from their first-party domain.

### 4.2.3 Publishers rename Container scripts.
Container scripts are called gtm.js by default (see Section 2). However, we find that 3.3% (734) of websites change this default filename. For example, 41 websites rename the Container script to optimize.js, 24 rename it to main.js and 7 renaming it to tools.js. In total we found 422 different names for Container scripts, often with a randomized name (e.g., cxwtwjgsknnz.js). Websites may rename Container scripts to avoid block lists blocking gtm.js. In our dataset, among the 734 websites that rename the gtm.js, the three URL-based block lists together block the Container in only 53.8% (395) of cases.

In total, we find that 6.7% (1,557) of websites use an obfuscation method. On 25.3% (399) of such websites using obfuscation methods, Containers are missed by the 6 block lists we tested.

## 4.3 Popularity of Client-Side Tags

In Section 4.1 we detected Containers with at least one Tag on 22,308 websites, and in Section 4.2 we found that 6.7% (1,557) of websites obfuscate the presence of Containers. In this section, we analyze the Tags embedded in all Containers, including obfuscated, to address RQ3 on the popularity of Tags within the GTM ecosystem. Our findings are based on the this dataset of 22,308 websites.

### 4.3.1 Diversity and Prevalence of Client-Side Tags.
In total, we identify the presence of 1,357,028 instances of 245,398 distinct Tags across all 22,308 websites we have successfully crawled that contain at least one Client-Side Tag. Interestingly, such a high number of distinct Tags occur because of a high diversity of HTML Tags – HTML Tags represent 99.5% (244,291) of the distinct Tags found in our crawl. A summary of the Tags detected is present in Table 2. Regarding the popularity of each category, Official Tags are the

<figure><img src="image_6.png" /><figcaption>Figure 4: Prevalence of companies that provide 20 most popular Official and Template Gallery Tags.</figcaption></figure>

most prevalent – they appear on 96.0% (21,420) of the websites. Template Tags are relatively popular – we find them on 52.5% (11,717) of websites. Unexpectedly, HTML Tags – that contain the code defined by the Website owner – are also quite prevalent, found on 78.6% (17,528) websites (we further explore them in Section 4.4). The least popular are Image Tags found on 8.1% (1,818) of websites. On average, websites contain 60.8 Tag instances, where on average, 37.3 Official Tags instances are present (see Table 2). In Section 4.1, we found that 11.1% (2,568) of websites include more than one Container to integrate Tags. Surprisingly, we find that websites with only one Container contain on average 52.1 Tags, while websites with multiple Containers include on average 128.5 Tags.

### 4.3.2 Tags provided by Google are the most popular.
As some websites have multiple instances of some Tags, to rank the popularity of Tags, we count the number of websites in our dataset that contain each Tag at least once. Table 3 presents the 20 most popular Official and Template Tags. Our analysis reveals that Tags provided by Google are the most widely used Tags, representing 9 of the 20 most popular Tags. Figure 4 shows the popularity of Tags by provider, as identified in the GTM interface for Official Tags and on GitHub for Template Tags. We find that Tags provided by Google appear on 95.3% of websites in our dataset. Interestingly, the second most popular provider is Simo Ahava, an independent developer, whose Tags are present on 23.7% of websites in our dataset: “Facebook Pixel” present on 19.18% of websites and “Consent Mode (Google + Microsoft tags)” present on 7.37% websites. Additionally, we observe that the GTM interface prominently displays Tags provided by Google in the “Featured” category (see Figure 6 in the Appendix). When installing “Floodlight Sales” or “Google Ads”, the interface also recommends installing the “Google Tag” and “Conversion Linker” Tags (see Figure 7a and 7b in the Appendix) which may explain the high popularity of Tags provided by Google.

### 4.3.3 Multiple instances of a Tag on a website.
Websites often install multiple instances of the same Tag. Table 4 shows the 8 Tags having
<table><caption>**Table 3: The most popular Officially supported and Template Tags (marked with a star).**</caption><thead><tr><th>%sites</th><th>Tag Name</th><th>Provider</th></tr></thead><tbody><tr><td>88.0</td><td>Google Tag</td><td>Google</td></tr><tr><td>77.2</td><td>Google Analytics: GA4 Event</td><td>Google</td></tr><tr><td>55.1</td><td>Conversion Linker</td><td>Google</td></tr><tr><td>47.3</td><td>Google Ads Conversion Tracking</td><td>Google</td></tr><tr><td>32.0</td><td>Google Ads Remarketing</td><td>Google</td></tr><tr><td>24.1</td><td>Google Analytics: Universal Analytics</td><td>Google</td></tr><tr><td>19.2</td><td>Facebook Pixel*</td><td>Simo Ahava</td></tr><tr><td>16.6</td><td>Microsoft Advertising Universal Event*</td><td>Microsoft</td></tr><tr><td>15.3</td><td>Floodlight Counter</td><td>Google</td></tr><tr><td>11.8</td><td>Hotjar Tracking Code</td><td>Hotjar</td></tr><tr><td>9.3</td><td>TikTok Pixel*</td><td>Tiktok</td></tr><tr><td>7.5</td><td>Floodlight Sales</td><td>Google</td></tr><tr><td>7.4</td><td>Consent Mode (Google + Microsoft tags)*</td><td>Simo Ahava</td></tr><tr><td>6.0</td><td>Pinterest Tag</td><td>Pinterest</td></tr><tr><td>4.8</td><td>LinkedIn Insight</td><td>Microsoft</td></tr><tr><td>4.7</td><td>Google Ads User-provided Data Event</td><td>Google</td></tr><tr><td>4.1</td><td>LinkedIn InsightTag 2.0*</td><td>Microsoft</td></tr><tr><td>3.8</td><td>Cookiebot CMP*</td><td>Usercentrics</td></tr><tr><td>3.6</td><td>Twitter Base Pixel*</td><td>X</td></tr><tr><td>3.4</td><td>RTB House Hosted Tag*</td><td>RTB House</td></tr></tbody></table>

<table><caption>**Table 4: Average number of instances of a Tag on websites embedding this Tag.**</caption><thead><tr><th>average instances</th><th>prevalence on websites</th><th>Tag name</th></tr></thead><tbody><tr><td>36.5</td><td>0.6 %</td><td>Amplitude Analytics Browser SDK</td></tr><tr><td>29.0</td><td>77.2 %</td><td>Google Analytics: GA4 Event</td></tr><tr><td>15.6</td><td>0.7 %</td><td>Piano Analytics - Tagging</td></tr><tr><td>15.0</td><td>24.1 %</td><td>Google Analytics: Universal Analytics</td></tr><tr><td>14.4</td><td>15.3 %</td><td>Floodlight Counter</td></tr><tr><td>10.3</td><td>3.3 %</td><td>RTB House Hosted Tag</td></tr><tr><td>7.2</td><td>47.3 %</td><td>Google Ads Conversion Tracking</td></tr><tr><td>7.1</td><td>19.2 %</td><td>Facebook Pixel</td></tr></tbody></table>

the most instances installed on average on websites. For example, the “Amplitude Analytics Browser SDK” Tag – present on 0.6% of websites in our dataset – is installed an average of 36.5 times per site. Interestingly, some popular Tags show a similar behavior. The “Google Analytics: GA4 Event” Tag averages 29.0 instances per site, with an extreme case on https://corporativo.compensar.com where we observe 1,247 instances. According to the “Google Analytics” documentation, this Tag tracks individual events such as button clicks or newsletter signups with each distinct event using its own Tag instance [41, 42]. The documentation for the “Facebook Pixel” [71] Tag – installed 7.1 times on average – describes the same behavior. Like the “Google Analytics: GA4 Event” Tag, each specific action, such as a button click or a visit to a particular page, requires its own Tag instance. This suggests that the number of instances of “Google Analytics: GA4 Event” and “Facebook Pixel” indicate the number of user actions that are tracked on the website.

**4.3.4 Outdated Template Tags.** As discussed in Section 3.4, Template Tags from the Template Gallery do not update automatically. By comparing Template Tags in our dataset with their latest version on GitHub we find that 27.5% (3,218) of websites using Template Tags contain an outdated Template Tag. Among these, 17.3% (2,027) have Template Tags that have not been updated for over a year.

## 4.4 Analysis of HTML Tags

In Section 4.3 we found that HTML Tags are present on 78.6% (17,528) of websites and represent 99.5% (244,291) of the distinct Tags found in our dataset. In this section, we analyze the code of the 386,230 instances of HTML Tags in our dataset. According to the GTM documentation, website owners can use HTML Tags to integrate Tags that are not available within GTM’s interface [36].

**4.4.1 HTML Tags include external scripts on half of websites.** Our analysis shows that inlined JavaScript code appears within 96.9% (374,281) of HTML Tags. 23.4% (90,407) of HTML Tags load external JavaScript libraries (see Section 3.5), but find these on 57.7% (12,876) of websites. This shows that HTML Tags frequently serve as a mechanism for loading and executing external scripts.

**4.4.2 Facebook domains are the most prevalent in HTML Tags.** We find domain names in 44.2% (170,985) of HTML Tags, representing 9,000 distinct domains and identified the companies owning these domains using Tracker Radar [25]. Table 5 presents the 10 companies that own the most frequent domains in HTML Tags. Interestingly, we find that the domains facebook.com and facebook.net owned by Facebook are present in only 7.9% (30,386) of HTML Tags but that 40.1% (9,056) of websites contain one of such Tags. We also find that many of the domains present in HTML Tags are owned by companies that also provide officially supported or Template Tags. For example, Facebook, which owns the most popular domains, has a Tag available in the GTM interface and used by 19.2% of websites. This raises the question of why website owners choose to use HTML Tags for certain providers when a Tag is available in the GTM interface. A user survey targeting Publishers could help clarify the reasons behind this choice.

<table><caption>**Table 5: Companies owning the domains most found in HTML Tag’s code.**</caption><thead><tr><th>% Tags</th><th>%Websites</th><th>Domain</th><th>Company</th></tr></thead><tbody><tr><td>7.9</td><td>40.0 (8913)</td><td>facebook.com, facebook.net</td><td>Facebook</td></tr><tr><td>2.5</td><td>11.2 (2489)</td><td>googletagmanager.com, doubleclick.net</td><td>Google</td></tr><tr><td>2.1</td><td>18.5 (4137)</td><td>clarity.ms, bing.com, adnxs.com</td><td>Microsoft</td></tr><tr><td>2.1</td><td>19.5 (4355)</td><td>tiktok.com</td><td>ByteDance</td></tr><tr><td>1.2</td><td>4.1 (907)</td><td>adform.net</td><td>Adform</td></tr><tr><td>1.1</td><td>3.2 (717)</td><td>creativecdn.com</td><td>RTB House</td></tr><tr><td>1.0</td><td>2.8 (614)</td><td>taboola.com</td><td>Taboola,</td></tr><tr><td>0.9</td><td>2.9 (644)</td><td>adsrvr.org</td><td>The Trade Desk</td></tr><tr><td>0.7</td><td>2.3 (502)</td><td>yimg.jp, line.me</td><td>LY-Corporation</td></tr><tr><td>0.7</td><td>4.5 (1015)</td><td>criteo.com, criteo.net</td><td>Criteo</td></tr></tbody></table>
<table><caption>Table 6: JavaScript functions called by at least 2,000 HTML Tags, with the number of websites using an HTML Tag calling the function, the corresponding company we identified and examples of data that could be collected by such functions.</caption><thead><tr><th>%websites</th><th>function</th><th>company</th><th>Examples from the documentation of data types that could be collected</th></tr></thead><tbody><tr><td>41.4 (9,236)</td><td>dataLayer.push</td><td>Google [38, 44]</td><td>hashed email, name, surname, phone, address, user actions on website</td></tr><tr><td>41.2 (9,190)</td><td>fbq</td><td>Facebook [60]</td><td>hashed email, name, surname, phone, location, user actions on website</td></tr><tr><td>9.8 (2,189)</td><td>gtag</td><td>Google [39, 44]</td><td>hashed email, name, surname, phone, address, user actions on website</td></tr><tr><td>7.1 (1,594)</td><td>uetq.push</td><td>Microsoft [61, 62]</td><td>items added to the basket, results of a search</td></tr><tr><td>6.2 (1,389)</td><td>ttq track</td><td>Tiktok [80]</td><td>contents of the basket, user actions on website</td></tr><tr><td>4.4 (976)</td><td>_lt</td><td>Line [57]</td><td>hashed phone number, hashed email</td></tr><tr><td>4.3 (967)</td><td>creiteo_q.push</td><td>Criteo [20]</td><td>trimmed email, zip code, items purchased</td></tr><tr><td>4.1 (912)</td><td>ym</td><td>Yandex [87, 88]</td><td>hashed email, name, surname, phone, user actions on website</td></tr><tr><td>4.0 (886)</td><td>twq</td><td>Twitter (X) [85]</td><td>hashed email, hashed phone number, items purchased</td></tr><tr><td>3.3 (734)</td><td>_adftrack.push</td><td>Adform [4]</td><td>items purchased, total price of purchase, gender, age, country</td></tr><tr><td>3.1 (700)</td><td>hj</td><td>Hotjar [50]</td><td>actions of the user on the website (e.g., added an item to cart)</td></tr><tr><td>2.2 (493)</td><td>snaptr</td><td>Snapchat [73]</td><td>hashed email, total price of purchase</td></tr><tr><td>1.5 (327)</td><td>ytag</td><td>Yahoo [86]</td><td>total price of purchase</td></tr><tr><td>1.5 (334)</td><td>_uxa.push</td><td>Contentsquare [19]</td><td>urls of pages viewed, items purchased, total price of purchase</td></tr><tr><td>1.3 (295)</td><td>_paq.push</td><td>Matomo [58]</td><td>title of the page, search keywords</td></tr></tbody></table>

### 4.4.3 Use of third-party functions to communicate user data.
To analyze the behavior of HTML Tags and identify their potential provider, we extracted JavaScript functions from HTML Tags. Due to the high diversity of functions, we only report on 15 functions that are present in at least 2,000 HTML Tags instances (see Section 3.5). We successfully attributed 15 functions to 14 distinct companies. A review of their documentation shows that all these functions are used to transmit user data to the external library or Tag that provides this function. For example, the documentation for Snapchat's `snapttr()` function shows how to send a user's email address to Snapchat [73], while Facebook's `fbq()` function documentation shows how to send shopping cart contents to Facebook [60]. The most frequently used functions are Facebook's `fbq()` and Google's `dataLayer.push()`, each appearing on over 40% of websites. Table 6 summarizes the functions we identified, their providers, and examples of data they collect. Overall, 41.3% (159,340) of HTML Tags use one of these 15 functions, and 81.2% (14,224) of websites using HTML Tags integrate these functions. These figures are a lower bound, as we focused only on functions present in over 2,000 HTML Tags out of the 419,787 HTML Tags identified.

## 4.5 Prevalence of Server-Side Containers

In this section, we measure the prevalence of Server-Side Containers on 80,605 websites, thus answering **RQ4**.

### 4.5.1 4% of websites use a Server-Side Container.
In our dataset of 80,605 websites, we found a Collector Tag (see Section 3.6) indicating the presence of Server-Side GTM on 3.8% (3,095) of websites. This represents 13.8% of the 22,308 websites where we have detected Client-Side Containers containing at least one Tag. Interestingly, “Google Tag” and “Google Analytics: GA4 Event” are the most popular Collector Tags, observed on 12.6% (2,821) websites, while “Data Tag” of Stape.io is found on 1.2% (274) of websites.

### 4.5.2 Installation of Server-Side Containers.
To analyze where Server-Side Containers are installed, we extracted the “destination URLs”

(see Section 3.6) from the Collector Tags found on 3,095 websites. We found that 60.4% (1,869) of websites install Server-Side Containers on the first-party subdomain (such as `gtm.example.com`), as was recommended by the Google official documentation until January 2024 [35]; while 3.0% (94) of websites install them on the first party domain itself (such as `example.com`), as recommended since January 2024 [34]. This change in the recommendation may be related to the actions of content blocking extensions and browsers that may more easily separate subdomains from the main websites' functionality. Similar to obfuscated Client-Side Containers (see Section 4.2), deploying Server-Side Containers on the first-party domain renders DNS-based blocklists ineffective at blocking communication with these Server-Side Containers. Finally, 28.3% (877) of websites install Server-Side Containers on a third-party domain. Interestingly, several third-party domains host many Server-Side Containers. For example, 164 websites host their Server-Side Containers on `run.app` and 65 on `appspot.com`, domains owned by Google. Finally, on 8.2% (255) of websites, the URL exacted from the Collector Tag was invalid.

## 4.6 Detection of hidden Server-Side Tags

In this section, we report on the Server-Side Tags detected on 3,095 websites where we identified a Server-Side Container (see Section 4.5), thus answering **RQ5**.

### 4.6.1 Detection of Server-Side Tags.
Relying on our method based on cookies (see Section 3.7), we detect 398 Server-Side Tags instances on 325 websites. Table 7 shows the 12 distinct Server-Side Tags detected showing the cookie used for the detection. Note that some cookies are set by several Tags, and we therefore cannot identify which of the Tags is actually present (see Section 4.5). We find that Tags that provide the “Facebook Conversion” service are the most popular, followed by Tags provided by Google: “Conversion Linker”, “Google Analytics: GA4” and “Cloud Retail”.
<table><caption>Table 7: Server-Side Tags detected by our method.</caption><thead><tr><th># websites</th><th>Cookies detected</th><th>Tag(s) detected</th></tr></thead><tbody><tr><td>161</td><td>_gtmeec,<br>_fbp</td><td>Conversions API Tag, Facebook Conversion API, Meta CAPI Tag - TRKKN version, GDPR Ready Meta/Facebook CAPI by Sirdata, SignalSight Conversion API</td></tr><tr><td>111</td><td>FPAU</td><td>Conversion Linker</td></tr><tr><td>69</td><td>FPGSID</td><td>Google Analytics: GA4</td></tr><tr><td>19</td><td>_ga</td><td>Cloud Retail</td></tr><tr><td>15</td><td>_scid</td><td>Snap Conversions API Tag, Snapchat Conversion API</td></tr><tr><td>9</td><td>_ttp</td><td>TikTok Events API, Tiktok Events API by Addingwell</td></tr><tr><td>6</td><td>ouid</td><td>OWOX BI GA4 Web Streaming To Google BigQuery</td></tr><tr><td>2</td><td>_pk_id</td><td>Matomo Analytics</td></tr><tr><td>2</td><td>_uetsid</td><td>GDPR Ready Bing/Microsoft Ads Conversions by Sirdata</td></tr><tr><td>2</td><td>channel_-<br>flow</td><td>Channel Flow</td></tr><tr><td>1</td><td>uet_vid</td><td>Microsoft Ads UET Conversion API by Stape</td></tr><tr><td>1</td><td>__lt__cid</td><td>LINE Conversion API</td></tr></tbody></table>

### 4.6.2 Server-Side Tags are difficult to detect.
We detect at least one Server-Side Tag on only 10.5% of websites where we detected a Server-Side Container, meaning that the majority of Tags executed in the Server-Side Containers remain undetectable with our method. Our cookie-based detection approach has an inherent limitation, as not all Server-Side Tags can be identified using this method. As discussed in Section 3.7, of the 202 Tags available in Server-Side Containers, only 94 have permissions to store cookies in the user's browser, including 11 Tags that have the permission to store cookies but do not declare the names of such cookies. Consequently, 58.4% of Server-Side Tags remain undetectable with our approach.

## 5 GTM-EYE BROWSER EXTENSION

We developed an extension for Chromium-based browsers using our GTM-EyE library, the core component of our GTM analyses. A screenshot of its user interface is shown in Figure 5 in the Appendix. The extension is capable of detecting Containers, identifying the embedded Tags, and providing detailed information for each Tag. For Template Tags, the extension displays the provider of the Tag and a link to the source code. For custom HTML Tags, it only shows the Tags code. It also detects Collector Tags that send data to Server-Side GTM (see Section 3.6) and reveals the URL of this server. The extension is capable of analyzing any website thereby bringing transparency. While Google provides a tool called “Tag assistant” that displays the Tags installed in a GTM Container and indicates when they are executed, it is only available to the Publisher who created the Container, whereas GTM-EyE is accessible to everyone. Furthermore, GTM-EyE allows to selectively disable Tags within a Container to perform tests, such as examining the network traffic

generated by individual Tags. The extension and its source code are provided in the supplementary materials [55].

## 6 RELATED WORK

*First party tracking.* To avoid browser-level tracking restrictions, trackers have adopted techniques that make third-party tracking appear as if it is occurring in a first-party context. One such method is CNAME cloaking, which leverages DNS aliasing to mask third-party domains as subdomains of the website being visited. This effectively conceals the true origin of tracking requests. Ren et al. [69] examined the security and privacy risks associated with this approach, demonstrating that it can undermine browser cookie policies and inadvertently expose sensitive user data to trackers. Dao et al. [23] showed that between 2016 and 2020 the top websites have significantly increased usage of CNAME cloaking-based tracking and proposed a machine learning-based detection method. Dimova et al. [24] conducted a scan of over 5M web pages to study the prevalence of CNAME tracking, discovered 10,474 unique domains pointing to CNAME-based tracking infrastructure and that nearly 10% of the top 10,000 websites deploy at least one such tracker.

*Cookie Syncing.* is a technique that enables ad companies to exchange user identifiers stored in cookies, allowing them to track users across different websites and amplifying their cross-site tracking capabilities. Acar et al. [2] showed that major third-party trackers could leverage this technique to reconstruct substantial portions of users' browsing histories, exceeding 50% in some cases. Papadopoulos et al. [66] reported that up to 97% of users are exposed to cookie syncing activities. Chen et al. [17] highlighted a related concern known as “cookie leakage”, wherein third-parties exploit first-party cookies to facilitate tracking and user data exchange, effectively bypassing traditional third-party cookie limitations.

*Techniques to bypass content blockers.* Alternative methods to circumvent content blockers have also been investigated by the research community. Amjad et al. [10] showed that 14.6% of scripts on 100K websites mix both tracking and essential functionality, meaning blocking them can break sites and proposed a technique for selectively blocking only the tracking components of such scripts. Alrizah et al. [9] examined nine years of history of the EasyList filter list used by content blockers. They identified 15 distinct evasion techniques employed by Publishers to enable trackers on their websites to bypass content blockers.

*Server-Side Tracking.* El Fraihi et al. [27] explored the usage and effectiveness of Meta's server-side technology to link website visitors with their user accounts on Meta products and showed that 34% and 51% of users can be linked. Bekos et al. [13] investigated how Meta's tracking cookies (e.g., `_fbp`), which we found on 161 websites could be utilized to collect detailed user browsing behavior through server-side mechanisms. Fouad et al. [31] found 69 trackers that shifted from client- to server-side on 7,369 websites, noting that 58% would have been blocked if deployed client-side.

*Google Tag Manager.* Mertens et al. [59] analyzed GTM Client-Side Tags in isolation on a controlled website and compared each Tag's behavior with the corresponding company's declared data collection practices. Their results show that companies provide
inconsistent disclosures across different documents regarding the types of data collected, the cookies used, and the recipients of the data. They also found that Google's "Consent Mode" used by the Google Tag leaks personal data even when users deny consent.

Alegria et al. [8] analyzed 279K websites to detect Client-Side GTM, study embedded Tags, and assess GTM's permission system. They reported that GTM's permission system is flawed and identified flaws on 51% of websites. Contrary to our study, they neither identify Template Tags nor study Collector Tags. They detected GTM on 28.9% of websites, closely matching our JavaScript-based detection rate of 29.4%. However, their method did not identify renamed gtm.js scripts, which account for 3.6% of the Containers we detected. They reported an average of 81.6 Tags per website, whereas we observed 60.8. In contrast, we found a higher proportion of HTML Tags (28.5% compared to 15%). Although the counting methods differ (we count websites that include a Tag, whereas they count Containers that contain it) both studies show similar Tag popularity rankings, with Google as the most prominent provider.

Moti et al. [63] conducted a study on Server-Side GTM across 50 online pharmacy websites, found that 19 of the 50 websites employed Server-Side GTM and that 14 of them transmitted user data even when consent was explicitly denied. Their approach differs from ours as they identified Server-Side GTM through URL parameters associated with Google Analytics, which are also used for transmitting data to Server-Side, while we use the presence of Collector Tags. They did not attempt to identify Server-Side Tags.

# 7 DISCUSSION

*Understanding Publisher motivations.* Our current analysis focuses on the technical aspects of GTM usage in both Client- and Server-Side configurations. However, further research could help to understand the motivations and decision-making processes of website Publishers using GTM. A qualitative study, such as a survey or interviews with web developers and Publishers, could provide insights into why GTM is chosen, how Tags are selected, and why certain patterns, such as the extensive use of HTML Tags, are common. Such research could also provide a clearer understanding of why some Publishers choose to obfuscate their GTM Containers.

*Server-Side GTM is invisible for regulatory monitoring and auditing.* Server-Side GTM, along with other server-side tracking methods, present a significant challenge for regulatory oversight, compliance auditing, and academic research as, unlike traditional browser-based tracking, data collection occurs remotely, rendering it largely invisible to conventional auditing techniques. In our analysis, we could identify Server-Side Containers, however, we detected Server-Side Tags on only 10.5% of Server-Side Containers, meaning that the majority of Tags executed within the Server-Side GTM environment remain undetectable with our method. While it is technically feasible to monitor the data transmitted to the GTM Server-Side Container, it is not possible to determine which third-party companies may have access to this data. Moreover, auditing is only possible through direct cooperation from the website Publisher, who must grant access to the Server-Side GTM configuration. This "obscure-by-design" architecture introduces a critical vulnerability: Publishers can modify the GTM Server-Side Container configuration at any time, including prior to regulatory investigations,

potentially concealing evidence of non-compliance. Companies collecting data, such as those who provide Tags, and companies which facilitate such data collection, such as GTM, should provide transparency mechanisms that enable auditing by regulators and facilitate end-user access to this information. This mechanism should be enabled by default and should not be put on Publisher shoulders.

*Legal compliance of Server-Side GTM.* Data collected through Server-Side GTM may include personal data, defined under the GDPR as any information relating to an identifiable individual [32, Art. 4(1)]. Because this data is not strictly necessary for website functionality, Publishers must obtain user consent before collection [32, Art. 6(1a)]. However, current documentation is unclear on how consent signals are transmitted to Server-Side GTM and whether Server-Side Tags respect them. To our knowledge, the Collector Tags we studied (Google Tag, GA4 Event, and Data Tag) transmit consent choices for the two purposes in Google's Consent Mode v2 (ad_storage and analytics_storage), and four Server-Side Tags (Google Analytics 4, Google Ads Conversions/Remarketing, and Floodlight Counter/Sales) automatically adapt to user choices [40]. However, the handling of consent by other Tags remains unclear, as Google provides no unified mechanism—only community-made tutorials are exist [72, 74]. This gap risks GDPR non-compliance, as Server-Side GTM lacks built-in consent enforcement tools and may not meet the GDPR's "data protection by design and by default" principles, which require the highest privacy settings by default [32, Art. 25]. We urge Google to integrate comprehensive consent-management in Server-Side GTM and encourage Data Protection Authorities to investigate these shortcomings.

# 8 CONCLUSION

This analysis confirms the widespread use of Client-Side GTM across the web, with nearly one third of the 80,605 websites in our dataset utilizing it. However, our findings highlight the limitations of relying solely on requests to googletagmanager.com or the presence of the gtm.js script as indicators of Client-Side GTM usage since we found that some Publishers actively obfuscate it by loading the script from alternative domains and renaming the script file, potentially, in an effort to evade detection and blocking. To address this, we developed a methodology for detecting Client-Side GTM more reliably, using JavaScript and identify the Tags that it contains. Our results show that the most commonly used Tags are those provided directly by Google, plus custom HTML Tags that allow Publishers to embed arbitrary HTML and JavaScript code on their website through GTM. In addition, we introduced a novel approach for detecting Server-Side GTM configurations and identifying some of the Tags installed in those environments. While functional, our method can detect only a subset of Server-Side Tags, as most do not leave observable Client-Side traces such as cookies. This underscores the increasing opacity of Server-Side tracking and the challenges it poses for transparency.

# 9 ETHICAL CONSIDERATIONS

This research does not involve human subjects, nor does it include the collection or processing of personal data. All websites were accessed from an institutional server using a clean browsing profile, thus not revealing any personal information of the experimenter.
We did not identify any security vulnerabilities during the course of
this study; however, we did observe potential legal concerns related
to compliance with EU data protection regulations. To minimize
the burden placed on the websites under study, each site was ac-
cessed only once and only a single page was loaded. If a website
was unavailable or if our crawler encountered an error, no further
access attempts were made. We did not attempt to circumvent bot-
detection mechanisms, aside from using a standard desktop browser
configuration.

10 OPEN SCIENCE

Artifacts associated with this paper are available in an anonymized
repository [55]. We provide the code of our crawler, the scripts to
analyze the data, and the list of visited websites. The code for our
GTM-EyE extension along with instructions to install it are also
available in the same repository.

11 ACKNOWLEDGMENTS

The text in this article was revised with the assistance of ChatGPT
to improve clarity, grammar, and flow. The authors would like to
thank <redacted>...

REFERENCES

[1] [n. d.]. Adguard DNS. https://web.archive.org/web/20251008063413/https://adguard-dns.io/en/welcome.html?_plc=en.

[2] Gunes Acar, Christian Eubank, Steven Englehardt, Marc Juarez, Arvind Narayanan, and Claudia Diaz. 2014. The Web Never Forgets: Persistent Tracking Mechanisms in the Wild. In *Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security*. ACM, Scottsdale Arizona USA, 674–689. https://doi.org/10.1145/2660267.2660347 https://dl.acm.org/doi/10.1145/2660267.2660347.

[3] Ad-IP. [n. d.]. Surf the web with no annoying ads. https://adblockplus.org/.

[4] Adform. [n. d.]. Variables (JavaScript). https://web.archive.org/web/20250710050216/https://www.adformhelp.com/hc/en-us/articles/10023217401617-Variables-JavaScript.

[5] Adguard. [n. d.]. AdGuard Browser Extension. https://adguard.com/en/adguard-browser-extension/overview.html.

[6] Adguard. [n. d.]. Advertising networks. https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt.

[7] Adguard. [n. d.]. General javascript, CSS and HTML extensions. https://raw.githubusercontent.com/AdguardTeam/FiltersRegistry/master/filters/filter_3_Spyware/filter.txt.

[8] Javiera Alegria, Ivana Bachmann, and Javier Bustos-Jiménez. 2026. Google Tag Manager and Its Privacy Issues. In *Security and Trust Management*. Vol. 16137. Springer Nature Switzerland, 173–189. https://doi.org/10.1007/978-3-032-06155-3_10 Series Title: Lecture Notes in Computer Science.

[9] Mshabab Alrizah, Sencun Zhu, Xinyu Xing, and Gang Wang. 2019. Errors, Misunderstandings, and Attacks: Analyzing the Crowdsourcing Process of Ad-blocking Systems. In *Proceedings of the Internet Measurement Conference*. ACM, Amsterdam Netherlands, 230–244. https://doi.org/10.1145/3355369.3355588 https://dl.acm.org/doi/10.1145/3355369.3355588.

[10] Abdul Haddi Amjad, Zubair Shafiq, and Muhammad Ali Gulzar. 2023. Blocking JavaScript Without Breaking the Web: An Empirical Investigation. *Proceedings on Privacy Enhancing Technologies 2023*, 3 (July 2023), 391–404. https://doi.org/10.56553/popets-2023-0087 https://petsymposium.org/popets/2023/popets-2023-0087.php.

[11] Ansherina Opena. [n. d.]. Ad Blockers Usage Statistics [2025]: Who's Blocking Ads & Why? https://web.archive.org/web/20250723225313/https://cropink.com/ad-blockers-usage-statistics.

[12] Backlinko Team. [n. d.]. Ad Blocker Usage and Demographic Statistics. https://web.archive.org/web/20250913061020/https://backlinko.com/ad-blockers-users.

[13] Paschalis Bekos, Panagiotis Papadopoulos, Evangelos P. Markatos, and Nicolas Kourtellis. 2023. The Hitchhiker's Guide to Facebook Web Tracking with Invisible Pixels and Click IDs. In *Proceedings of the ACM Web Conference 2023*. ACM, Austin TX USA, 2132–2143. https://doi.org/10.1145/3543507.3583311 https://dl.acm.org/doi/10.1145/3543507.3583311.

[14] Ahmed Bouhoula, Karel Kubicek, Amit Zac, Carlos Cotrini, and David Basin. 2024. Automated Large-Scale Analysis of Cookie Notice Compliance. In *33st USENIX Security Symposium (USENIX Security 24)*. USENIX Association, Philadelphia, PA, TBA. https://www.usenix.org/conference/usenixsecurity24/presentation/bouhoula https://www.usenix.org/conference/usenixsecurity24/presentation/bouhoula.

[15] Brave Software, Inc. n.d.. Brave Shields. https://brave.com/shields/ (Consulted on June 27th 2023).

[16] BuiltWith Pty Ltd. [n. d.]. Google Tag Manager Usage Statistics. https://web.archive.org/web/20250328093948/https://trends.builtwith.com/widgets/Google-Tag-Manager.

[17] Quan Chen, Panagiotis Ilia, Michalis Polychronakis, and Alexandros Kapravelos. 2021. Cookie Swap Party: Abusing First-Party Cookies for Web Tracking. In *Proceedings of the Web Conference 2021*. ACM, Ljubljana Slovenia, 2117–2129. https://doi.org/10.1145/3442381.3449837 https://dl.acm.org/doi/10.1145/3442381.3449837.

[18] Salim Chouaki, Islem Bouzenia, Oana Goga, and Beatrice Roussillon. 2022. Exploring the Online Micro-targeting Practices of Small, Medium, and Large Businesses. *Proceedings of the ACM on Human-Computer Interaction 6*, CSCW2 (Nov. 2022), 1–23. https://doi.org/10.1145/3555103 https://dl.acm.org/doi/10.1145/3555103.

[19] Contentsquare. [n. d.]. Tag API reference. https://web.archive.org/web/20240624062727/https://docs contentsquare com/en/web/command-reference.

[20] Criteo. [n. d.]. Capture online store intent with Criteo OneTag. https://help.criteo.com/kb/guide/en/capture-online-store-intent-with-criteo-onetag-qRtjqWgKzF/Steps/775618 (visited on July 24th 2025).

[21] crux [n. d.]. Metrics | Chrome UX Report | Chrome for Developers. https://web.archive.org/web/20251005100813/https://developer chrome.com/docs/crux/methodology/metrics#popularity-metric.

[22] Dan Pollock. [n. d.]. how to make the internet not suck (as much). https://someonewhocares.org/hosts/.

[23] Ha Dao, Johan Mazel, and Kensuke Fukuda. 2021. CNAME Cloaking-Based Tracking on the Web: Characterization, Detection, and Protection. *IEEE Transactions on Network and Service Management* 18, 3 (Sept. 2021), 3873–3888. https://doi.org/10.1109/TNSM.2021.3072874 https://ieeexplore.ieee.org/document/9403411/.

[24] Yana Dimova, Gunes Acar, Lukasz Olejnik, Wouter Joosen, and Tom Van Goethem. 2021. The CNAME of the Game: Large-scale Analysis of DNS-based Tracking Evasion. *Proceedings on Privacy Enhancing Technologies* 2021, 3 (July 2021), 394–412. https://doi.org/10.2478/popets-2021-0053 https://petsymposium.org/popets/2021/popets-2021-0053.php.

[25] DuckDuckGo. 2020. DuckDuckGo Tracker Radar. https://github.com/duckduckgo/tracker-radar (Consulted on October 25th 2024).

[26] easylist. [n. d.]. EasyPrivacy. https://easylist.to/easylist/easyprivacy.txt.

[27] Asmaa El Fraihi, Nardjes Amieur, Walter Rudametkin, and Oana Goga. 2024. Client-side and Server-side Tracking on Meta: Effectiveness and Accuracy. *Proceedings on Privacy Enhancing Technologies* 2024, 3 (July 2024), 431–445. https://doi.org/10.56553/popets-2024-0086 https://petsymposium.org/popets/2024/popets-2024-0086.php.

[28] Steven Englehardt and Arvind Narayanan. 2016. Online Tracking: A 1-million-site Measurement and Analysis. In *Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security* (Vienna, Austria) (CCS '16). Association for Computing Machinery, New York, NY, USA, 1388–1401. https://doi.org/10.1145/2976749.2978313 https://doi.org/10.1145/2976749.2978313.

[29] Fabio Duarte. [n. d.]. Number of Ad Block Users Worldwide (2024). https://web.archive.org/web/20250815194343/https://explodingtopics.com/blog/ad-block-users.

[30] Imane Fouad, Nataliia Bielova, Arnaud Legout, and Natasa Sarafijanovic-Djukic. 2020. Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels. *Proceedings on Privacy Enhancing Technologies* 2020, 2 (April 2020), 499–518. https://doi.org/10.2478/popets-2020-0038 https://petsymposium.org/popets/2020/popets-2020-0038.php.

[31] Imane Fouad, Cristiana Santos, and Pierre Laperdrix. 2024. The Devil is in the Details: Detection, Measurement and Lawfulness of Server-Side Tracking on the Web, Vol. 2024. https://hal.science/hal-04617727 https://hal.science/hal-04617727.

[32] GDPR 2016. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32016R0679.

[33] Google. [n. d.]. Analytics Tools & Solutions for Your Business - Google Analytics. https://web.archive.org/web/20250807062425/https://marketingplatform.google.com/about/analytics/.

[34] Google. [n. d.]. Custom domain configuration. https://web.archive.org/web/20240115162653/https://developers.google.com/tag-platform/tag-manager/server-side/custom-domain?option=same-origin.

[35] Google. [n. d.]. Custom domain configuration - recommendation to use a subdomain for Server-Side GTM. web.archive.org/web/20230402155835/https://developers.google.com/tag-platform/tag-manager/server-side/custom-domain.
[36] Google. [n. d.]. Custom tags. https://web.archive.org/web/20250829144804/https://support.google.com/tagmanager/answer/6107167?hl=en#CustomHTML.

[37] Google. [n. d.]. Get started with Tag Manager - 2. Install a web container. https://web.archive.org/web/20251007075734/https://support.google.com/tagmanager/answer/14847097.

[38] Google. [n. d.]. Google Ads User-provided Data Event. https://web.archive.org/web/20250908023313/https://developers.google.com/tag-platform/tag-manager/server-side/ads-user-data#code-configuration.

[39] Google. [n. d.]. Google tag API reference. https://web.archive.org/web/20250711220154/https://developers.google.com/tag-platform/gtags/reference.

[40] Google. [n. d.]. Implement consent mode with server-side Tag Manager. https://web.archive.org/web/20251002062522/https://developers.google.com/tag-platform/tag-manager/server-side/consent-mode.

[41] Google. [n. d.]. Set up events. https://web.archive.org/web/20250524191032/https://developers.google.com/analytics/devguides/collection/ga4/events?client_type=gtm.

[42] Google. [n. d.]. Set up Google Analytics events in Tag Manager. https://web.archive.org/web/20250805071542/https://support.google.com/tagmanager/answer/13034206?hl=en.

[43] Google. [n. d.]. Tagging for Google Analytics. https://web.archive.org/web/20240725230943/https://support.google.com/tagmanager/answer/9442095.

[44] Google. [n. d.]. The data layer. https://web.archive.org/web/20250710080532/https://developers.google.com/tag-platform/tag-manager/datalayer.

[45] Google. n.d.. Sandbox JavaScript. https://web.archive.org/web/20250425003734/https://developers.google.com/tag-platform/tag-manager/templates/sandboxed-javascript.

[46] Google. n.d.. Tag Manager - Server-Side. https://developers.google.com/tag-platform/tag-manager/server-side (Consulted on July 3rd 2023).

[47] Gorhill. [n. d.]. uBlock Origin - Free, open-source ad content blocker. https://ublockorigin.com/.

[48] Gorhill. [n. d.]. uBlock Origin Core. https://www.npmjs.com/package/@gorhill/ubo-core.

[49] gtm-web-csp [n. d.]. Use Tag Manager with a Content Security Policy. https://developers.google.com/tag-platform/security/guides/csp visited on December 6th 2024.

[50] Hotjar Ltd. [n. d.]. Events API Reference. https://web.archive.org/web/20250327223311/https://help.hotjar.com/hc/en-us/articles/4405109971095-Events-API-Reference.

[51] John Wilander. 2019. Intelligent Tracking Prevention. https://webkit.org/blog/7675/intelligent-tracking-prevention/ (Consulted on June 27th 2023).

[52] John Wilander. 2020. WebKit: full Third-Party Cookie Blocking and More. https://webkit.org/blog/10218/full-third-party cookie-blocking-and-more/ (Consulted on June 27th 2025).

[53] Justin Pot. [n. d.]. How to Use Your Computer's Hosts File to Block Tons of Malware, Porn, and Other Types of Websites. https://web.archive.org/web/20250820034015/https://www.howtogeek.com/31970/how-to-use-your-computers-hosts-file-to-block-tons-of-malware-porn-and-other-types-of-websites/.

[54] David Klein, Marius Musch, Thomas Barber, Moritz Kopmann, and Martin Johns. 2022. Accept All Exploits: Exploring the Security Impact of Cookie Banners. In *Proceedings of the 38th Annual Computer Security Applications Conference* (Austin, TX, USA) (ACSAC '22). Association for Computing Machinery, New York, NY, USA, 911–922. https://doi.org/10.1145/3564625.3564647 https://doi.org/10.1145/3564625.3564647.

[55] large-scale-supplementary-materials [n. d.]. Supplementary materials - Anonymous GitHub. https://anonymous.4open.science/r/gtm-large-scale-study-4867/README.md.

[56] Victor Le Pochat, Tom Van Goethem, Samaneh Tajalizadehkhoob, Maiej Korczyński, and Wouter Joosen. 2019. Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation. In *Proceedings of the 26th Annual Network and Distributed System Security Symposium (NDSS 2019)*. https://doi.org/10.14722/ndss.2019.23386

[57] Line. [n. d.]. LINE Conversion API v1 (1.0.0). https://web.archive.org/web/20250102154854/https://conversion-api-docs linebiz.com/en/#section/Development-Guidelines/Event-deduplication.

[58] Matomo. [n. d.]. JavaScript Tracking Client. https://web.archive.org/web/20250717043525/https://developer.matomo.org/guides/tracking-javascript-guide.

[59] Gilles Mertens, Natalia Bielova, Vincent Roca, and Cristiana Santos. 2025. You Can't Trust Your Tag Neither: Privacy Leaks and Potential Legal Violations within the Google Tag Manager. In *IEEE European Symposium on Security and Privacy*. Accepted for publication, https://hal.science/hal-05032798v1/document.

[60] Meta. [n. d.]. Meta Pixel - Advanced Matching. https://web.archive.org/web/20250818082256/https://developers.facebook.com/docs<meta/pixel/advanced/advanced-matching/.

[61] Microsoft. [n. d.]. How to track custom events with UET. https://web.archive.org/web/20250324032330/https://help.ads.microsoft.com/apex/index/3/en/56684.

[62] Microsoft. [n. d.]. Why track custom events. https://web.archive.org/web/202510113907/https://help.ads.microsoft.com/#apex/ads/en/56717/2.

[63] Z Moti, K Frings, K Utz, FZ Borgesius, and G Acar. 2025. The Bitter Pill: Tracking and Remarketing on EU Pharmacy Websites. In *Data Privacy Management*. https://gunesacar.net/assets/bitter-pill-pharmacy-privacy-dpm-25.pdf.

[64] Mozilla Corporation. n.d.. Enhanced Tracking Protection in Firefox for desktop. https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop (Consulted on June 27th 2023).

[65] Mozilla Foundation. [n. d.]. Public Suffix List. https://publicsuffix.org/.

[66] Panagiotis Papadopoulos, Nicolas Kourtellis, and Evangelos Markatos. 2019. Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask. In *The World Wide Web Conference*. ACM, San Francisco CA USA, 1432–1442. https://doi.org/10.1145/3308558.3313542 https://dl.acm.org/doi/10.1145/3308558.3313542.

[67] Pi-hole. [n. d.]. Pi-hole Network-wide Ad Blocking. https://pi-hole.net/.

[68] Q-Success. [n. d.]. Usage statistics and market shares of tag managers for websites. https://w3techs.com/technologies/details/tg-google (Visited on March 26th, 2025).

[69] Tongwei Ren, Alexander Wittman, Lorenzo De Carli, and Drew Davidson. 2021. An analysis of first-party cookie exfiltration due to cname redirections. Workshop on Measurements, Attacks, and Defenses for the Web. *MADWeb* (2021). https://ldklab.github.io/assets/papers/madweb21-cloaking.pdf https://ldklab.github.io/assets/papers/madweb21-cloaking.pdf.

[70] Kimberly Ruth, Deepak Kumar, Brandon Wang, Luke Valenta, and Zakir Dumeric. 2022. Toppling top lists: evaluating the accuracy of popular website lists. In *Proceedings of the 22nd ACM Internet Measurement Conference*. ACM, Nice France, 374–387. https://doi.org/10.1145/3517745.3561444 https://dl.acm.org/doi/10.1145/3517745.3561444.

[71] Simo Ahava. [n. d.]. Facebook Pixel - Custom Tag Template. https://web.archive.org/web/20250918130707/https://www.simoahava.com/custom-templates/facebook-pixel/.

[72] Simo Ahava. [n. d.]. Server-side Tagging In Google Tag Manager. https://web.archive.org/web/20250720180748/https://www.simoahava.com/analytics/server-side-tagging-google-tag-manager/.

[73] Snapchat. [n. d.]. Purchase Event Examples. https://businesshelp.twitter.com/article/additional-parameters?language=en_US (visited on July 24th 2025).

[74] Stape Inc. [n. d.]. Consent mode in server Google Tag Manager. https://stape.io/blog/consent-mode-server-google-tag-manager (Visited on 2025-11-26), snapshot available at https://archive.ph/WNaqQ.

[75] stape.io. [n. d.]. Addingwell by Didomi: Best Tagging Server for GTM server-side. https://web.archive.org/web/20250620141028/https://www.addingwell.com/.

[76] stape.io. [n. d.]. Stape | Server-Side Tracking Made Easy For Everyone. https://web.archive.org/web/20250806180936/https://stape.io/.

[77] Steven Black. [n. d.]. StevenBlack/hosts. https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts.

[78] taggrs.io. [n. d.]. Server Side Tracking software - TAGGRS. https://web.archive.org/web/20250616151839/https://taggrs.io/en/gtm-server-side-tagging-hosting/.

[79] taofq. [n. d.]. Fast HTML Parser. https://www.npmjs.com/package/node-htmlparser.

[80] Tiktok. [n. d.]. About Custom Events in TikTok Ads Manager. https://web.archive.org/web/20250625145346/https://ads.tiktok.com/help/article/custom-events?lang=en.

[81] uBlock. [n. d.]. uBlock filters - Privacy. https://raw.githubusercontent.com/uBlockOrigin/uAssets/refs/heads/master/filters/privacy.txt.

[82] Tobias Urban, Yash Vekaria, Zubair Shafiq, Chris Bottger, and Barry Pollard. 2024. *Third Parties*. HTTP Archive, Chapter 6. https://doi.org/10.5281/zenodo.14193384

[83] Wikipedia. [n. d.]. Behavioral retargeting. https://en.wikipedia.org/wiki/Behavioral retargeting.

[84] Wikipedia contributors. [n. d.]. DNS sinkhole. https://en.wikipedia.org/wiki/DNS_sinkhole.

[85] X Corp. [n. d.]. Conversion Tracking for Websites. https://web.archive.org/web/20250712094132/https://business.x.com/en/help/campaign-measurement-and-analytics/conversion-tracking-for-websites.

[86] Yahoo! Japan. [n. d.]. Dynamically get conversion value in conversion tracking [Auction]. https://ads-help.yahoo-net.jp/s/article/H000044918?language=en_US (visited on July 24th 2025).

[87] Yandex. [n. d.]. Yandex Metrica. https://yandex.ru/support/metrica/en/objects/extlink (visited on July 24th 2025).

[88] Yandex. [n. d.]. Yandex Metrica - firstPartyParams. https://web.archive.org/web/20251105163510/https://yandex.ru/support/metrica/en/objects/first-party-params.

APPENDIX
<figure><img src="image_7.png" /><figcaption>Figure 5: Screenshot of the GTM-EyE browser extension report for the https://togg.com/tr website (taken on 2025-12-03)</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Figure 6: Screenshot of the Google Tag Manager interface showing the list of Tags from which the Publisher can choose. Most of the Tags provided by Google are at the top in the "Featured" section.</figcaption></figure>
<figure><img src="image_9.png" /><figcaption>Figure 7: Screenshot of the Google Tag Manager interface showing the installation menu for “Google Ads” and “Google Floodlight”. For both Tags the interface recommends installing the “Google Tag” and proposes the “Conversion Linker” Tags.</figcaption></figure>