Google Tag Manager for a small business: what it is, when the Google tag is enough, and who should own it

Google describes Tag Manager as "a tag management system that allows you to set up and manage tags on your site without changing your website's code". It costs nothing. You add two snippets of code to each page, and after that, Google says, you don't need to change your code much, because tags are set up and managed on the Tag Manager website.

Its parts have plain names:

Each time a container is published, Tag Manager records a version, which Google calls "a snapshot of a container configuration at a particular time". A mistake is undone by publishing an earlier version, and Tag Manager keeps a publish history showing when each version was live and who published it.

Preview mode lets you browse your own site as if the unpublished changes were live, connected to Google's Tag Assistant, so you can see which tags fired and in which order before you publish.

The Google tag is the tag Google Ads and Google Analytics 4 need to receive data. Google's help says it suits marketers without a web developer, or sites on a website builder or content management system, and that "if you only need the default metrics, such as page views, clicks and scrolls, you can set up the Google tag once and you're all set."

Google's developer guide is more specific. It says the Google tag "may be the fastest and easiest method to get started" if you "only intend to tag your pages for one product (e.g. Google Ads) with few changes over time", and suggests it where the main goal is ad performance, or measuring all the traffic to a site.

The limit is that the Google tag sends data only to Google. A container whose ID starts with G- or AW- "is limited to Google tags", in Google's words, and one whose ID starts with GTM- can also run other companies' scripts and custom code.

Google's own guidance points to Tag Manager in four cases:

Google's help page on the change, dated 20 August 2026, says Google tags "will be upgraded to fully capable Google Tag Manager containers". A site that uses only the Google tag gains the option of Tag Manager's interface, debugging and version control, and Google says the upgrade will not change how the Google tag behaves on the page.

For sites already on Tag Manager, Google recommends optimising the container, and says no changes will be made automatically. The optimisation links the container to the Google accounts it sends data to, and grants them read access by default, so check the container's users afterwards.

In Ireland the rule is Regulation 5(3) of S.I. No. 336 of 2011, the ePrivacy Regulations. A person "shall not use an electronic communications network to store information, or to gain access to information already stored in the terminal equipment of a subscriber or user", unless the user has consented and has been given clear and comprehensive information. Regulation 5(5) has two exemptions: storage or access for the sole purpose of transmitting a communication, and what is strictly necessary for a service the user explicitly asked for. The Data Protection Commission's guidance says analytics cookies require consent.

Tag Manager does not collect consent itself. Google says consent mode "does not provide a consent banner or widget", recommends a consent management platform or your content management system for collecting consent, and says you are responsible for obtaining users' consent on your website. What a container can do is hold each tag back until the visitor's answer allows it. The DPC's guidance adds that a site should be aware of what data it sends to the third parties whose tools it deploys, and that it may be considered a controller of any personal data it collects and discloses to them. What the DPC asks of the banner itself is set out separately.

Google documents three Tag Manager features for this:

Consent mode passes the visitor's answer to Google's tags, which adjust their behaviour to it, and Google documents two ways to set it up. In basic mode, Google's tags do not load until the visitor interacts with the banner, and Google says this setup "transmits no data to Google prior to user interaction with the consent banner"; if the visitor does not consent, "no data is transferred to Google at all". In advanced mode, the tags load when the page opens, with defaults set to denied unless configured otherwise, and while consent is denied they send measurements without cookies, which Google uses for modelling.

Google's Analytics help says that while analytics storage is denied, no Analytics cookies are set, accessed or read from the device, and that the cookieless pings can include the user agent, the screen resolution and the IP address. It adds that Google Analytics does not store or log IP addresses.

The DPC's 2020 guidance and the European Data Protection Board's 2023 guidelines word the rule differently for a measurement like that. The DPC says the Regulations apply when any information is stored on or accessed from the device. The Board's Guidelines 2/2023, adopted on 7 October 2024, say that where JavaScript code instructs the browser to send information from the device, that access "clearly falls within the scope" of Article 5(3) of the ePrivacy Directive, the EU provision behind Regulation 5(3). What your website sets before anyone clicks accept sets out both readings in full.

Moving tags off the page into a server container, one of Tag Manager's container types, is a separate decision, and what server-side conversion tracking does explains why it is not a way around consent.

The business whose website it is. Google's developer guide says the organisation whose tags are managed should create the Tag Manager account: if an agency manages tags for your company, your company creates the account and adds the agency's Google account as a user. Access can be given only to Google accounts.

Google's help on users and permissions asks for at least two active administrators, with real accounts and not shared logins, managed by someone in your organisation and not an outside agency or consultant. Google says it cannot add users on request, so an account with no administrator left can end with nobody able to manage it. An account or container with no administrator is deleted automatically, and users with read access then have 30 days to export it.

Access is set for each container, at five levels, under an account role of User, who can view basic account information, or Administrator, who can also create containers and change users' permissions: