Google Tag Manager

[ChristopherGlaeser]

I recently discovered the Google Tag Manager and I am in the process of updating many of my websites with this feature.  I am using Tag Manager to mange Google Analytics, Google Remarketing, Alive Chat, Woopra, etc.  I have one question about how Tag Manager actually works.

As best I can tell, the Tag Manager code snippet that I insert into my web pages is the same for all my websites and does not include a unique ID.  If that is the case, then Tag Manager must search all the URLs in the TM database to find a match.  What is to stop someone else from adding some rules for my URLs to their containers?  I expect Google has a method to ensure proper matching, but I'm not clear on how that is enforced.

Best,
Christopher

[ChristopherGlaeser]

You're right, the codes are unique.  They are so small (4 characters) I did not recognize them as unique IDs.

Thanks for the info on the hostname filter as well.

Best,
Christopher

[ThompsonPaul]

There is a unique ID embedded in your Tag Manager code, Christopher. It's specific and different for each container you create for each site (i.e. each container has a different ID). So the Tag Manager code on your pages is calling rules from your specific container. Nobody else's rules could affect your account unless you let them add their snippet to your site.

Here's an example of the Tag Manager snippet showing the unique ID In this case anonymized to GTM-XXXX:

<noscript><iframe src="//www.googletagmanager.com/ns.html?id=<strong>GTM-XXXX</strong>"<br />height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>

This is assuming, of course that you've followed the best practices of creating a new container for each website. If you're using cross-domain tracking or rollup reporting, I suppose to might be possible to implement all within one container even for multiple sites.

All that said - there's nothing to stop another website from maliciously adding your Analytics code to their own website (whether through Tag Manager or regular manual methods) to mess up your stats. The way to avoid this (and best practice for any site) is to ensure you have a hostname filter to remove all GA calls except those from your own approved hostnames. This also helps filter out "accidental" cases like where somebody has scraped your page contents including your GA code. You'd be surprised how often this happens.

Paul