I'm using GTM to filter out PII in the data sent to Google Analytics. I do this by only letting GTM send non-PII values to GA. So the data flow is the following :

app ->(sends full payload)-> GTM ->(sends filtered data)->GA

However, I'm wondering if it's unwise to do this if the payload sent from the app contains sensitive information. I know GTM doesn't store them, but if they are going off-platform by going to GTM, I think that might constitute a breach of user trust. Is that a correct assessment of the issue?

  • 1
    This does send the full data to a third party, so I (not a lawyer) think that could be an issue. It would be safer to remove the PII before sending it anywhere.
    – WebElaine
    Jun 22, 2018 at 21:36

2 Answers 2


You've assumed that communication between app and GTM is sent over the network whereas it's quite likely the data remains local to the browser & being transformed by GTM's script before being sent anywhere. You can see what network requests are made, complete with headers and bodies in a browser's debugger.

I've created custom variables in GTM that are populated by scrubbing PII from standard variables via JS functions. I send only the custom variables to analytics, and have not observed any of the original variables being sent over the network. The effect is the same as filtering the data before sending it to GTM, though it's actually not possible to completely scrub data before it touches GTM, e.g. the URL of the pages GTM is on cannot be hidden from GTM, so you must scrub it in GTM before you send it anywhere.

  • I knew that wasn't necessarily a correct assumption and was hoping someone would bring it up if it wasn't :)
    – Jad S
    Aug 22, 2018 at 8:29

This depends on multiple factors. One might be the EU GDPR, which clearly states you cannot gather personally identifiable information (some exceptions to the rule - ask a lawyer for that).

In any case you need to have a data processing agreement with the third party. Google Analytics has this, but Google Tag Manager does not. Since you are not sending your data packets to GA directly, but instead to GTM which in turn sends it to GA, you may be in violation. Why may? Because GDPR states that you need to have control over what data is saved and you need to be able to delete this information if asked by the user.

Since GTM doesn't save any of this (as GTM claims), but give you no option to verify or sign a data processing agreement you are in the dark. The combination of multiple tools running through GTM may make non-personally-identifiable information for Google identifiable information this leaves you at risk.

To be sure you need to speak to a lawyer and/or a data protection registrar. In any case, I would make sure to minimise risk and thus not send any data to GTM which I do not plan on tracking, filtering the data beforehand.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.