Hacker News Reader

Comment by aerzen | Hacker News Reader

Am I dumb or does this article fail to explain what does the tag manager actually do? And not just with a loaded word, such as surveillance or spying, but actually technically explain what they are selling for and why it is bad.

View on HN

Google Tag Manager is a single place for you to drop in and manage all the tracking snippets you might want to add to your site. When I've worked on B2C sites that run a lot of paid advertising campaigns, the marketing team would frequently ask me to add this tracking pixel or another, usually when we were testing a new ad channel. Want to start running ads on Snapchat? Gotta ad the Snapchat tracker to your site to know when users convert. Now doing TikTok? That's another snippet. Sometimes there would be additional business logic for which pages to fire or not fire, and this would change more often. Sometimes it was so they could use a different analytics tool.

While these were almost always very easy tickets to do, they were just one more interruption for us and a blocker for the stakeholders, who liked to have an extremely rapid iteration cycle themselves.

GTM was a way to make this self-service, instead of the eng team having to keep this updated, and also it was clear to everyone what all the different trackers were.

The self-service thing is such a nightmare. There are two things that you almost certainly cannot trust your marketing team with:

1. Understanding the security implications of code they add via tag manager. How good are they at auditing the third parties that they introduce to make sure they have rock-solid security? Even worse, do they understand that they need to be very careful not to add JavaScript code that someone emailed to them with a message that says "Important! The CEO says add this code right now!".

2. Understand the performance overhead of new code. Did they just drop in a tag that loads a full 1MB of JavaScript code before the page becomes responsive? Can they figure that out themselves? Are they positioned to make good decisions on trade-offs with respect to analytics compared to site performance?

Yep it's vibe coding before vibe coding existed. Paste in the script. No code review. No staging. No roll-out. Just straight in prod. And it can break stuff.

You effectively delegate code-review on a XSS path to your marketing team. I refused to do that anywhere users could be logged in.

I agree with this and can add two more problems that are super common.

Firstly, people will add all sorts of things on a whim without telling anybody. So your privacy policy won’t capture any of this.

Secondly, nobody ever cleans up after themselves. So a year down the line, you’ll have a dozen different services, all doing the same thing, all added by different people, and half of them aren’t even being used by anybody because the people that added them forgot about them or left the company.

I don’t think I’ve ever seen GTM used responsibly.

If there is one thing you can trust marketing departments with, it's their ability to ruin any website they have the chance of ruining.

Agreed that it's a nightmare, but what usually happens then is that an MBA-type VP will come in and demand the marketing team be allowed to insert whatever they want. Not many dev teams have the political clout to push back.

Google Tag Manager lets you add tracking stuff on your website without needing to touch the code every time. So if you want to track things like link clicks, PDF downloads, or people adding stuff to their cart.

It doesn't track things by itself. It just links your data to other tools like Google Analytics or Facebook Pixel to do the tracking.

This kind of data lets businesses do stuff like send coupon emails to people who left something in their cart.

There are lots of other uses. Basically, any time you want to add code or track behavior without dealing with a developer.

I was tasked with auditing third party scripts at a client a couple of years ago, the marketing people where unable to explain wtf tag manager does concretely without resorting to ‚it tracks campaign engagement´ mumbo jumbo, but were adamant they they can’t live without it.

XSS-as-a-service. It lets people drop in random JavaScript to be injected on to the page without any oversight.

It’s used by marketing people to add the 1001 trackers they love to use.

The chief reason is that websites pay for advertising and want to know if the advertising is working and Google tag manager is the way to do that, for Google Ads.

This is not unreasonable! People spend a lot of money on ads and would like to find out if and when they work. But people act like its an unspeakable nebulous crime but this is probably the most common case by miles.

If running spyware on people's browsers just to see if your ads are working is "not unreasonable", what is?

Try responding in good faith on a non-throwaway account.

This is not unreasonable! People spend a lot of money on ads and would like to find out if and when they work.

Companies were doing this for hundreds of years before Google even existed. You can learn if your ads work without invasive tracking.

Why should an advertiser have a right to know if their ads work, regardless of privacy considerations. EU brought out a freaking legal framework around this. I can't take seriously how you've over simplified it.

Tracking website ads has become so normalised, it doesn't seem to even cross the minds of web-only marketing people to think: how has this always worked for advertising via TV, radio, billboards, newspapers/magazines, etc?

Website-based advertising is a special case - the only one that makes this tracking possible. Advertisers need to understand the huge advantage they've been given, rather than taking it as a given and thinking they have more of a right to the data, than the user has a right to not provide it.

It feels that way for a lot of privacy concerns. "Telemetry" is the scare word for debug log, core dumps, and stack traces. I think it’s completely reasonable to want those.

It's reasonable to want and ask for debug data. Not so reasonable to exfiltrate it without the owner's permission.

This may have changed, I last used Tag Manager 9-10 ago. You basically added a single Javascript snippet to you website, then you could inject other Javascript into the pages, using various rules. So rather than having to redeploy our site every time the marketing department wanted to add a new tracking or retargeting script, we could just add it in Tag Manager. I think is a great tool if you insist on doing these types of thing. You can also extract and transform variables, so all the customization required to adapt to each service could be done within Tag Manager, keeping your website simpler.

One major issue Tag Manager solved for us was that a bunch of these online marketing companies that have their own tracking pixels/scripts absolutely suck at running IT infrastructure. More than ones we experienced poorly written 3rd. party scripts would break our site. Rather than having to do a redeployment, to temporarily disable a script, I could easily pop into the Tag Manager console and disable to offending service.

Maybe Google Tag Manager has changed, but it was a good tool, if you where in the business of doing those sorts of things. I suppose it's also a clever way of blocking all tracking from a site by just stopping the Tag Manager script from loading.

> This may have changed, I last used Tag Manager 9-10 ago.

GTM from 9-10 years ago and GTM today have nothing in common.

It’s a little bit like dependency injection for websites, used by marketing teams.

The people responsible for maintaining a site don’t want to know about all the different analytics tools the marketing team wants to use, and don’t want to be involved whenever any changes need to be made. So they expose a mechanism where the marketing team can inject functionality onto the page. Then all the marketing tools tell the marketing team how to use GTM to inject their tool.

Maybe you’re being misled by the cryptic name. It’s got nothing to do with managing tags, it’s a behaviour tracker and fingerprint machine.

I mean technically you can use it to manage HTML tags to inject into a site.

This is in fact what it is primarily used for.

Well I can inject HTML tags (or elements) with native JavaScript. Or manage them. Why would I want a bloated third party piece of software doing that?

Since you're asking, you could use it to tie together triggers and actions to embed code in specific situations (eg. based on the URL or page state). It has automatic versioning. There's a preview feature for testing code changes before deploying, and a permission system for sharing view/edit access with others.

So that your sales and marketing team can add the third-party tracker for a new ad campaign service without bothering the engineering team.

They can also add features! Yes have fun!

There's a section in the article titled, "WHAT DOES GOOGLE TAG MANAGER DO?":

> Whilst Google would love the general public to believe that Tag Manager covers a wide range of general purpose duties, it's almost exclusively used for one thing: surveillance.

That’s a single word, not much of an actual explanation.

the "general public" probably has no idea that Tag Manager is a thing that exists.

Reply on news.ycombinator.com