Your tag manager may send data to companies your privacy page never mentions. Researchers tested it, one tag at a time.
A team from Inria and Utrecht University installed Google Tag Manager tags alone on test sites and watched the traffic. They studied 6 popular tags in depth and 718 in an automated run. They report undisclosed third parties and cookies, and call them potential legal violations under EU law.
They covered the browser version only, and the tests are limited. Every container is a small bet that someone read the docs.
Who on your team reads them?
arxiv.org/html/…