An Analysis of Client-and Server-Side Google Tag Manager and its Tags on the Web

Google Tag Manager (GTM) enables website Publishers to install analytics, advertising, and other tracking services as "Tags" on their websites. Traditionally, in Client-Side GTM, Tags collect and send data directly from the browser to third-party servers. However, as today's browsers and extensions increasingly block third-party trackers, Google introduced a Server-Side GTM in 2020. This GTM version allows to install and execute Tags directly on a first-party server, thus hiding the presence of third-party trackers. In this study, we perform a crawl of 80K popular websites worldwide to analyze the adoption of Client-and Server-Side GTM and the prevalence of their Tags. Our results show that GTM is present on 28.8% of websites, with 6.7% of these sites obfuscating its presence. Our Tags detection methodology is able to measure the prevalence of all GTM Tags -Official, Template, HTML and Image Tags -globally and reveals a strong dominance of Tags provided by Google, which appear on 95.3% of sites. We further analyze 386K HTML Tags and find that they invoke third-party libraries on at least 81.2% of websites, to potentially share personal data. Finally, we detect the presence of Server-Side GTM on 3K websites and 398 Server-Side Tags instances on the Web. We also propose a GTM-Eye browser extension that detects GTM and its Tags accessible to everyone.