This depends on multiple factors. One might be the EU GDPR, which clearly states you cannot gather personally identifiable information (some exceptions to the rule - ask a lawyer for that).
In any case you need to have a data processing agreement with the third party. Google Analytics has this, but Google Tag Manager does not. Since you are not sending your data packets to GA directly, but instead to GTM which in turn sends it to GA, you may be in violation. Why may? Because GDPR states that you need to have control over what data is saved and you need to be able to delete this information if asked by the user.
Since GTM doesn't save any of this (as GTM claims), but give you no option to verify or sign a data processing agreement you are in the dark. The combination of multiple tools running through GTM may make non-personally-identifiable information for Google identifiable information this leaves you at risk.
To be sure you need to speak to a lawyer and/or a data protection registrar. In any case, I would make sure to minimise risk and thus not send any data to GTM which I do not plan on tracking, filtering the data beforehand.