Privacy ComplianceWeb Tracking
Does Google Tag Manager Require Consent? Why Views Differ Globally
Most businesses treat Google Tag Manager (GTM), a container that loads website tags, as strictly necessary and exempt from consent choices. A German court disagreed in 2025, in part because loading the container sends visitors' IP addresses to Google. That stance is stricter than the prevailing view. In the U.S., the larger risk tends to sit with the tags inside the container, and with whether those tags are blocked or only adjusted when visitors disable tracking.
By Alex Proctor
Published October 18, 2026
Summary
Google Tag Manager (GTM) is a tool that loads and manages tags, from analytics tools and advertising pixels to functional scripts, through a single container. Google says that the container itself does not collect information about visitors beyond standard request logs, although an October 2026 update lets containers send data directly to Google's measurement products. No U.S. law addresses tag managers directly, while a German court held in 2025 that the container requires consent under European law. I recommend that businesses decide deliberately whether the container loads before consent, and confirm that the tags inside it respond to visitors' choices.
What Does the GTM Container Do by Itself?
On its own, the GTM container is built to load other tags rather than to collect information. Google's documentation states that, other than standard request logs that are deleted within 14 days, Tag Manager "does not collect, retain, or share any information about visitors to our customers' properties, including page URLs visited." This is the main basis for treating the container as strictly necessary.
Technically, visitors' browsers still have to request the container from Google's servers, which receive an IP address with each request, as with any web request. Google has also been expanding what containers do. Since October 2026, containers can "send data directly to Google measurement products," according to Google's release notes, instead of loading a separate Google tag to do it. For containers that use this option, the line between the container and the tags inside it is harder to draw.
The container also loads every tag that businesses add to it, not only analytics and advertising tools. Many businesses use it for essential and functional scripts as well, and many load their consent platform through it.
Tag Manager is also one of the most common places to apply consent logic to individual tags. For many businesses, it is the key to gating scripts well, because each tag can be set to wait for the consent that it needs.
Why Did a German Court Require Consent?
In March 2025, an administrative court in Hannover ruled that the use of GTM requires consent. The case involved a news publisher that loaded the container before visitors interacted with its banner, and that had challenged an order from the state's data protection authority over its banner and its use of GTM. According to the judgment, the authority's test showed that visitors' IP addresses and device information went to Google's servers at that point. Under German law, even downloading the container's script onto visitors' devices counted as storing information there.
The court concluded that the container was neither requested by visitors nor needed to use the website, and that it served the publisher's interest in selling advertising. It added that websites can load their tags without it, for example with their own script.
The ruling is something of an outlier, as a first-instance decision about one website. I am not aware of another court that has reached the same conclusion. However, European regulators' 2024 guidance reads the consent rule broadly, covering JavaScript code that instructs browsers to send information back. So similar arguments may appear elsewhere in Europe.
How Is the Container Treated in the U.S.?
No U.S. privacy law addresses tag managers directly. Tracking complaints often list GTM among the tools at issue, alongside the pixels that it loads. That should be read in context, because templated complaints and demand letters tend to list a wide range of website technology, including essential tools. I have even seen consent platform scripts in the screenshots attached to demand letters.
Still, the container does come up in rulings. A recent hospital tracking ruling quoted a complaint that named GTM together with the Meta Pixel, Google Analytics, and the LinkedIn Insight Tag.
I am not aware of a U.S. ruling that analyzed the container separately from its tags. In practice, the exposure in the U.S. comes from what the tags send and whether they respond to visitors' choices. That is why the consent settings on each tag usually matter more than whether the container itself loads.
Should the Container Load Before Consent?
Businesses generally choose among three setups:
- Load the container for all visitors. This is the most common approach in the U.S. It considers the container itself essential infrastructure and relies on the consent settings of each tag inside the container to gate them individually. It also makes it easier to apply region-specific gating to each tag and to manage Google's tags with Consent Mode.
- Load the container after consent. Google documents this option, although it also cautions that it "may lead to loss in data." It can also hold back the essential tags, and the Google-based consent logic, that run through the container. For this to work, the consent banner's script has to be installed directly on the website rather than through the container.
- Use a hybrid setup. The container loads after consent in the regions where regulators or courts expect it, and by default elsewhere. This requires the container and the banner script to be installed directly on the website, along with a location-based rule that decides whether the container loads.
Each setup is a risk decision. I recommend that businesses make it deliberately, with regard for where their visitors are. Regardless of the setup, the non-essential tags in the container should be gated behind consent logic derived from the banner, so that they stop when visitors disable tracking.
Questions
Does Google Tag Manager set cookies?+
Usually not. Google's privacy documentation for Tag Manager does not describe the container as setting cookies. However, the German authority's test found that the container's script was downloaded to visitors' devices and that an identifier was sent to Google. German law treated that as storing information on visitors' devices, whether or not a cookie was set.
Does server-side tagging change the answer?+
No, because server-side tagging moves some tags from visitors' browsers to a server but does not remove the consent question. Google says that its tags in a server container are aware of consent, based on the Consent Mode settings in the web container. Tags from other vendors do not necessarily respond the same way. The same notice and consent requirements apply no matter where the tags run.
Does the German ruling apply outside of Germany?+
No, the ruling is not binding outside of Germany. It applied German law and the GDPR to one website, in a first-instance decision. Businesses with visitors in Europe may still want to account for it when they choose a setup.
Briefings are informational and do not constitute legal advice.
Running analytics or marketing tools?
I'll trace what leaves the browser, and when.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.