Google Tag Manager: what it is, why it matters and how to use it

The purpose of Google Tag Manager has changed. It used to be mostly about getting scripts (Google Analytics or Hotjar, for example) onto a website without booking a developer. Today it is just as much about control: which tags run, when they run and with what consent.

With GTM you can also send events to Google Analytics and see what your marketing actually leads to. If you would like help with GTM and your measurement, get in touch with me. It is part of the measurement and analytics work Sunbird does.

Google Tag Manager (GTM) is Google’s tool for adding and managing tags on your website from a single interface. Tags are snippets of code that pass data on to other systems. GTM is often used alongside Google’s other tools, such as Google Analytics and Google Ads, but it works for any tag.

According to W3Techs (October 2026), GTM is used on 44.7 per cent of all websites, and on 99.6 per cent of the websites whose tag manager W3Techs can identify. If a website uses a tag manager, it is almost always GTM.

The tool is built from four parts:

With GTM you can create events and conversions, such as the number of contact forms submitted, clicks on buttons, outbound links, phone numbers and email addresses.

The best thing about Google Tag Manager is that in most cases it takes only a minute or so to install. After that, you no longer need a developer for every new tag. The data layer, consent and more advanced setups, however, usually still need a developer (and it is not the place to cut corners).

To install Google Tag Manager you add two snippets of code: one in the head and one in the body section. If you use WordPress there are plugins for this, although we prefer to add the code directly to the theme or website. As a rule it should sit at the very top of those sections. Always make sure you have only one installation.

Below is a step-by-step guide. We assume you already have a Google Analytics account.

Search for “Google Tag Manager”, open the first result, click “Get started” and follow the instructions. The names you choose are not critical, but do name things properly, for example after the URL of the website the container is for, and select “Web”.

Google will give you two snippets of code to add to your website. The first goes as high up as possible in the <head>. The second also goes as high up as possible, in the <body>. You may need to ask your web developer or web agency to do this step. If you use WordPress and cannot edit the code yourself, there are plugins that will do it.

Tip: developers and web agencies often work in staging environments. If you make the change on the live site, let them know, so that it is not overwritten.

Remember that consent has to be handled before any tag runs. Your cookie banner (CMP) is added in GTM with the “Consent Initialization – All Pages” trigger and should set every consent type to denied by default. Only once the visitor says yes should the marketing tags run, and the analytics tags too, unless your analytics setup genuinely falls within PECR’s statistical purposes exception (more on that below).

Do not put tags that slow the page down on the “Page View” trigger without good reason. According to the HTTP Archive Web Almanac (2021), the GTM script had a median transfer size of 39 KiB on mobile, and the script grows as the container fills up. Tags that do not need to run straight away can wait for “DOM Ready”, “Window Loaded” or a click, so the page can respond to the visitor first.

Use Tag Assistant, Google’s debugging tool for tags.

In Tag Manager, click Preview in your workspace → enter your website’s URL → Connect. Your website opens in a new window, and Tag Assistant shows it as connected and lists the container and the tags that fire. If you install the optional Tag Assistant Companion extension for Chrome, the site opens in a new tab instead.

The next step is to connect your Google Analytics account to GTM.

Tags → New → click “Tag Configuration” (a panel should now slide out from the right) → click “Google Tag”

Under “Tag ID”, enter the measurement ID from Google Analytics.

Log in to Google Analytics and select the right account. Admin → Data streams → Web → click the existing stream, or click “Add stream”. That is where you will find the “Measurement ID”.

Before you publish: Advanced Settings → Consent Settings → “Require additional consent for tag to fire” → add analytics_storage. The GA4 tag then does not run until the visitor has accepted analytics cookies.

Once you have added the tag, it is not live straight away. You first have to click the “Submit” button in the top right to publish your changes.

If Google Analytics is already installed on your website, but not through Google Tag Manager, you now need to remove the old Google Analytics installation. You can check this in Tag Assistant too; it warns you if there is more than one.

Once everything is in place and you have cleared the cache, you should start to see traffic in your Google Analytics account. The standard reports do not show the data straight away, so expect to wait until the next day. To see data in real time, go to Reports → Realtime.

Now that Google Tag Manager is installed, you can create the events you need. Examples of events:

• Forms
• Purchases
• Clicks on phone numbers and email addresses
• Newsletter sign-ups
• Visits to the contact page
• Clicks on an important external link

Not every event has to count as a conversion. In Google Analytics, conversions are now called key events, and you choose which events count as key events under Admin → Data display → Events, by clicking the star next to the event.

To create an event for a form, do this:

• Step 1: Click “Tags” in the left-hand menu, then “New”.
• Step 2: Give the tag a name, for example “Form – contact”.
• Step 3: Under “Tag Configuration”, choose “Google Analytics: GA4 Event”. Under “Measurement ID”, enter the same measurement ID as in the Google tag.
• Step 4: Enter the event name, for example “form_contact” (GA4 event names use letters, numbers and underscores, with no spaces). Choose a name you will still understand later on.
• Step 5: Click “Triggering” and then the “Plus” sign to create a new trigger.
• Step 6: Choose “Form Submission”, select “Some Forms” and add a condition that matches your form, for example “Page Path contains /contact/”.

If you leave the trigger on “All Forms”, every form on the website will fire it, newsletter sign-ups included.

If there are several forms on the same page, such as a newsletter sign-up in the footer, you need to be able to tell the right form apart. Look for something unique to it, such as the URL or the text that appears after a successful submission.

Remember to test everything in preview. Test both successful and failed submissions, so that the trigger fires exactly once per successful submission.

Once a few forms have come in, check whether the number of events in Analytics matches the real figures. It is common for the number of leads and the number recorded not to match exactly. For example, visitors who do not accept the cookie banner are not counted.

• Step 1: Repeat steps 1 to 3 above
• Step 2: Enter the event name, for example “click_email” or “click_phone”.
• Step 3: Click “Triggering” and then the “Plus” sign to create a new trigger.
• Step 4: Choose “Click – Just Links”, select “Some Link Clicks” and set the condition to “Click URL contains mailto:” for email clicks or “Click URL contains tel:” for phone clicks.
• Step 5: When you have created all your tags, click “Save”.
• Step 6: Go back to the workspace and click “Submit” to publish your changes.

When you are done, test every new tag to make sure it works as expected.

Consent Mode v2 is Google’s way of letting the visitor’s consent decide what the tags in GTM are allowed to do. Without it, you are probably collecting data you have no right to, and as the website owner you carry the risk.

In the UK, the rules on cookies and similar technologies sit in PECR, personal data is covered by UK GDPR, and the Information Commission (until September 2026 the ICO) is the regulator. Its current guidance includes a statistical purposes exception for analytics, but it is narrow: it covers aggregate statistics collected solely to improve your own service, you must give clear information and a free, simple way to object, and a third-party analytics provider must act only on your behalf. The guidance is clear that advertising purposes, including ad measurement, are not exempt and need consent.

If you add tags with default settings and hope for the best, it is the website owner who gets the bill.

Google’s EU user consent policy covers visitors in the UK as well as the EEA and Switzerland. Consent Mode v2 passes their choices to Google through four consent signals:

• analytics_storage controls cookies for statistics and analytics.
• ad_storage controls cookies for advertising.
• ad_user_data controls whether user data may be sent to Google for ad measurement.
• ad_personalization controls whether the data may be used for personalised ads and remarketing.

You then choose between Basic and Advanced Consent Mode:

Consider who gains from what. Advanced gives Google more data to model with, but you carry the legal risk.

Many people object that “it’s cookieless”. Unfortunately, that is not how the law works. According to the regulator, PECR applies to any technology that stores information on, or accesses information from, a user’s device, not just cookies: tracking pixels, web storage, fingerprinting, and scripts and tags are all covered. And measuring ad performance is an advertising purpose, which always needs consent.

For most UK companies, Basic is therefore usually the safer choice (we are not a law firm, so do check with your legal adviser).

Server-side GTM is a container that runs on a server you control, rather than in the visitor’s browser. The browser sends the data to your server first, and the server passes it on to GA4, Google Ads or Meta.

Why does it matter? Safari. According to WebKit’s tracking prevention documentation, Safari detects third-party CNAME cloaking and third-party IP address cloaking, and caps the expiry of any cookies set in those HTTP responses at 7 days. That hits the classic setup, where your own subdomain points via a CNAME to a tracking server at a cloud provider.

Say a customer clicks your ad on a Monday in Safari and buys 10 days later. With that limit, the purchase looks as if it came from a new visitor, and the ad that did the work gets no credit. You are then likely to bid too low on exactly the campaigns that lead to sales.

The solution is to put the measurement under the same origin as the website. Instead of a separate subdomain, requests go through a reverse proxy to a path on the main domain, for example yourcompany.co.uk/metrics/. Cookies set that way are not subject to the 7-day cap.

Bear in mind that server-side does not solve data protection on its own. If the server passes the full IP address and identifiers on to providers in the US, that is still a transfer of personal data abroad. It only makes a difference once you actively strip out personal data and mask IP addresses in the server container.

Help with Google Tag Manager pays off when the figures in GA4 are the basis for decisions about money. Most people can add a GA4 tag themselves with the guide above. Consent, the data layer and server-side are a different matter.

Do the maths: if GA4 shows 40 leads a month while your sales team received 25, you are bidding in Google Ads on leads that do not exist. Your ad budget ends up on the wrong campaigns, while a competitor with clean data pulls ahead.

• Tags run before the visitor has responded to the cookie banner.
• Conversions are counted twice or credited to the wrong campaign.
• The number of leads in GA4 differs widely from what your sales team sees.
• Tracking relies on button text and CSS classes that break at the slightest design change.
• Your online shop is built as a single page application.
• A large share of your customers come through Safari on iPhone.

Single page applications are a common source of broken data. GTM merges everything pushed into the data layer, so products and transaction IDs from the previous page view can carry over into the next event. The fix is to clear the ecommerce object before each new ecommerce event:

Never reset it with window.dataLayer = []. That disconnects GTM, and subsequent events are no longer picked up.

This is rarely something you fix in the GTM interface. It sits in the website’s code, which is why the developer and whoever owns the measurement need to work together.

If you want help getting GTM, consent and the data layer in order, that is exactly what our measurement and analytics work covers. We build tracking you can trust, so that you can see which channels actually lead to business.

If you want to be able to account for every pound of your marketing spend, get in touch with me.

A tag is a snippet of code that sends data to a system, for example to Google Analytics or Google Ads.

In practice, that might be your Google Analytics 4 installation, Google Ads remarketing or the Meta Pixel (formerly the Facebook Pixel).

A trigger picks up specific events on the website, for example when a visitor is on a particular URL, sees a specific piece of text or clicks a button. One trigger can be connected to several tags. When the trigger fires, the event is sent, for example to Google Analytics.

With GTM you can preview your changes before you go live. That way you avoid sending bad data to Google Analytics and make sure your tracking is right from the start.

Once you have set everything up, open preview mode and trigger every event you have created. Make sure each one fires exactly once. Also test actions that are wrong but similar, such as clicking “Send” on a form you have not filled in, where no lead should be sent.

Google Tag Manager can be integrated with a wide range of tools, including Google Analytics, Google Ads, the Meta Pixel and Hotjar. The advantage is that every tag is managed, tested and tied to consent in one place, instead of being scattered across the website’s code.

GTM generally does not track anything on its own. It is a container that loads other tags, and it is the tags, such as GA4 or the Meta Pixel, that collect data about the visitor. That is why the tags are what consent has to control, and you handle that through Consent Mode in GTM.

Yes, Google Tag Manager is a free tool from Google. If you run server-side GTM, though, there are ongoing costs for the server and its upkeep.

In the end, Google Tag Manager is only as good as what is in the container. A tag that runs without consent is a legal risk, and a tag that counts every lead twice gives you the wrong basis for your decisions. Measure fewer things, but measure them properly. That is easier said than done.

Sunbird is a search agency with 14 years in search. If you want measurement you can base decisions on, read more about our measurement and analytics work, or start with a free search audit.