# Poster: Client-Side GTM Tags: hidden data leaks and potential violations of GDPR

Gilles Mertens, Nataliia Bielova, Vincent Roca, Cristiana Santos

<figure><img src="image_1.png" /></figure>

## To cite this version:

Gilles Mertens, Nataliia Bielova, Vincent Roca, Cristiana Santos. Poster: Client-Side GTM Tags: hidden data leaks and potential violations of GDPR. PETS 2024 - 24th Privacy Enhancing Technologies Symposium, Jul 2024, Bristol, United Kingdom. pp.1-1, 2024. [hal-04699754](https://hal.science/hal-04699754v1)

HAL Id: hal-04699754

https://hal.science/hal-04699754v1

Submitted on 17 Sep 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>
<figure><img src="image_3.png" /></figure>

## Background
Websites collect their visitors' data for various purposes, such as targeted advertising, and rely on third parties for such collection. One option for Website Publishers to share visitor data with these 3rd parties is to install Tags they provide and use Google Tag Manager (GTM) to manage them. Until now research considers GTM as a single tracking script, our work casts light on the internals of GTM.

## Methods
We study Tags from the point of view of the Publisher on an empty website. This approach enables us to install tags in an environment we fully control.

* **In-depth analysis.** We analyze 6 tags in-depth by hand to list types of data collected from: technical and legal documentation, tag dashboard and network traffic.

* **Large-scale study.** We develop a program that automatically installs 719 Tags and collects their traffic on our website. For the 352 Tags making network requests, we study both the data collected and with whom it is shared.

* **Policy analysis.** With a legal scholar (Cristiana Santos), we study the privacy policies of the 3rd party providing the tag. We especially focus on the clarity of the reference to the tag, the disclosure of third parties collecting data and use of cookies.

* **Consent mode.** Finally we study Google Consent mode, a feature that enables tags to be aware of user consent: we install the Google Tag on our website and visit it twice, refusing and accepting consent, to assess potential differences in data collection practices.

## Findings
Tags collect information about the website visited, device features and use first- and third-party cookies. We found that **49 tags share data with multiple companies**, with one tag contacting 26 of them! Analysis of privacy policies shows that **Tag providers often omit to declare with whom the data is shared** and the cookies used. Moreover, privacy policies studied never mention tags explicitly, leaving Publisher to guess whether declarations apply to the tag they installed. Finally, we discovered that the Google Tag through its use of Google Consent Mode collects personal data when users decline consent, potentially violating EU data protection laws.

Browser visiting a website where GTM is installed

<figure><img src="image_4.png" /></figure>

**In-depth analysis:** Architecture of a GTM installation. Tags run in the browser, collect data and send it to third parties.

<table><thead><tr><th>URL param. name</th><th>Value of url parameter when refusing all</th><th>Value of url parameter when accepting all</th></tr></thead><tbody><tr><td>v</td><td>2</td><td>2</td></tr><tr><td>tid</td><td>G-XSKNFL9CWM</td><td>G-XSKNFL9CWM</td></tr><tr><td>gtm</td><td>45je43p0v9181346581za200</td><td>45je43p0v9181346581za200</td></tr><tr><td>_p</td><td>1711640211524</td><td>1711640309156</td></tr><tr><td>gcs</td><td>G100</td><td>G111</td></tr><tr><td>gcd</td><td>13p3p3p2p5</td><td>13t3t3t2t5</td></tr><tr><td>npa</td><td>1</td><td>0</td></tr><tr><td>dma_cps</td><td>-</td><td>sypham</td></tr><tr><td>dma</td><td>1</td><td>1</td></tr><tr><td>cid</td><td>1337464789.17116</td><td>1994365208.17116</td></tr><tr><td>ul</td><td>en-us</td><td>en-us</td></tr><tr><td>sr</td><td>2560x1440</td><td>2560x1440</td></tr><tr><td>uaa</td><td>x86</td><td>x86</td></tr><tr><td>uab</td><td>64</td><td>64</td></tr><tr><td>uafvl</td><td>Chromium%3B122.0.6261.94%7CNot(...)</td><td>Chromium%3B122.0.6261.94%7CNot(...)</td></tr><tr><td>uamb</td><td>0</td><td>0</td></tr><tr><td>uap</td><td>Linux</td><td>Linux</td></tr><tr><td>uapv</td><td>6.6.17</td><td>6.6.17</td></tr><tr><td>uaw</td><td>0</td><td>0</td></tr><tr><td>pscdl</td><td>denied</td><td>noapi</td></tr><tr><td>_s</td><td>2</td><td>2</td></tr><tr><td>sid</td><td>1711640211</td><td>1711640280</td></tr><tr><td>sct</td><td>1</td><td>1</td></tr><tr><td>seg</td><td>0</td><td>1</td></tr><tr><td>dl</td><td>https%3A%2F%2Fga4consent.webexp...</td><td>https%3A%2F%2Fga4consent.webexp...</td></tr><tr><td>dr</td><td>https%3A%2F%2Fga4consent.webexp...</td><td>https%3A%2F%2Fga4consent.webexp...</td></tr><tr><td>dt</td><td>My%20experiment%20page%20title</td><td>My%20experiment%20page%20title</td></tr><tr><td>en</td><td>view_search_results</td><td>view_search_results</td></tr><tr><td>tfd</td><td>5620</td><td>5613</td></tr><tr><td>_eu</td><td>AEA</td><td>AEA</td></tr><tr><td>_et</td><td>2</td><td></td></tr><tr><td>ep.search_term</td><td>my%20search</td><td>my%20search</td></tr></tbody></table>

**Consent mode:** Data actively sent by the Google Tag when accepting and refusing consent. The values in red are sent independently of consent.

<figure><img src="image_5.png" /></figure>

<figure><img src="image_6.png" /></figure>

**Large-scale & Policy analysis:** Tags send data to multiple companies and don't declare it.

<figure><img src="image_7.png" /></figure>

**Large-scale study:** A broad set of personal data types is actively collected by the tags