I had this idea that if I used Google Tag Manager to set up a custom dimension with the value true and removed all data that doesn't have that data through a filter, then I could effectively remove all spam from my site due to the Measurement Protocol of Google Analytics. I just finished setting this up and had this revelation that there might be spam that comes through Google Tag Manager itself. So, I decided to look it up and found http://www.lunametrics.com/blog/2015/03/19/eliminating-dumb-ghost-referral-traffic/. Now my question is, do I need to set a cookie on my site to prevent spam from any protocols, or does having a custom dimension added to every tag in Google Tag Manager itself do enough?
Using Measurement Protocol spammers can send hits to your GA property not even visiting your site. And this hits will be processed by GA. So cookies do not play any role in here.
Some filters also do not block hits sent by Measurement Protocol.