Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement prohibits users from uploading to GTM any data that personally identifies an individual, including names, email addresses, and billing information, as well as data that Google can reasonably link to such identifying information.
This analysis describes what Google's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a direct contractual obligation on GTM users to configure tags and data layer implementations so that no personally identifiable or reasonably linkable data is transmitted through the GTM platform. Breach of this restriction constitutes a terms violation and may also implicate applicable data protection law depending on jurisdiction.
Under this clause, users are contractually required to ensure that no PII, including names, email addresses, or billing data, passes through the GTM service, and this obligation extends to preventing third parties from doing so as well through the user's account.
Cross-platform context
See how other platforms handle Prohibition on Uploading Personally Identifiable Information and similar clauses.
Compare across platforms →Monitoring
Google has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"You agree not to, and not to allow third parties to use the Service or interfaces provided with the Service: to upload any data to Google Tag Manager that personally identifies an individual (such as a name, email address or billing information), or other data which can be reasonably linked to such information by GoogleExcerpt from Google's Tag Manager Terms of Service
(1) REGULATORY LANDSCAPE: This provision interacts with GDPR Article 5 data minimization and purpose limitation principles, as well as Article 25 data protection by design obligations for EU/EEA deployments. CCPA Section 1798.100 is relevant for California deployments where consumer personal information may be involved. The FTC Act applies in US contexts where consumer data collection practices are at issue. Enforcement authority in the EU rests with national data protection authorities under GDPR. (2) GOVERNANCE EXPOSURE: High. Tag management implementations frequently involve dynamic data layer pushes that can inadvertently transmit PII if not carefully governed. Misconfiguration of GTM containers is a common source of unintended personal data transmission, and this clause places full contractual and operational responsibility on the user to prevent such transmission. (3) JURISDICTION FLAGS: EU/EEA deployments face heightened exposure given GDPR's broad definition of personal data, which may encompass data that GTM users do not categorize as PII but that Google could reasonably link to an individual. California deployments engage CCPA where GTM facilitates collection of personal information about California residents. (4) CONTRACT AND VENDOR IMPLICATIONS: Organizations using GTM in B2B or agency contexts should include contractual representations from tag implementation vendors or agencies confirming compliance with this PII restriction, as the guarantee runs from the user to Google and does not automatically bind downstream implementers. This clause does not assert an indemnification obligation explicitly, but a breach would constitute a terms violation with potential account-level consequences. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should conduct a data layer audit across all GTM-managed properties to identify any variables, triggers, or tags that may capture or transmit PII. Consent management platform configurations should be reviewed to ensure PII is not passed to GTM prior to or absent user consent. Tag governance policies should include explicit prohibitions on PII in data layer variables.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a direct contractual obligation on GTM users to configure tags and data layer implementations so that no personally identifiable or reasonably linkable data is transmitted through the GTM platform. Breach of this restriction constitutes a terms violation and may also implicate applicable data protection law depending on jurisdiction.
Under this clause, users are contractually required to ensure that no PII, including names, email addresses, or billing data, passes through the GTM service, and this obligation extends to preventing third parties from doing so as well through the user's account.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Google.