Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement requires users who deploy any tags through GTM, whether third-party or Google-provided, to maintain an appropriate privacy policy and to comply with the EU user consent policy and all applicable regulations relating to data collection.
This analysis describes what Google's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision contractually obligates GTM users to comply with the EU user consent policy, which operationalizes consent requirements under the ePrivacy Directive and GDPR for EU/EEA user data. The obligation applies to users deploying any tags, not only those targeting EU users.
Under this clause, GTM users are required to implement and maintain a privacy policy and to obtain user consent in compliance with the EU user consent policy before firing applicable tags, with this obligation running as a contractual requirement to Google.
Cross-platform context
See how other platforms handle EU User Consent Policy Compliance Requirement and similar clauses.
Compare across platforms →Monitoring
Google has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If You use the Service to support products or services from a 3rd party or designed by You (together, "3rd Party Tags") or Google, You will have and abide by an appropriate privacy policy and will comply with the EU user consent policy (located at https://www.google.com/about/company/user-consent-policy.html ) and all applicable agreements and regulations (also relating to the collection of information)Excerpt from Google's Tag Manager Terms of Service
(1) REGULATORY LANDSCAPE: This provision directly engages the EU user consent policy, which implements requirements of the ePrivacy Directive and GDPR Articles 6 and 7 regarding lawful basis and conditions for consent. Enforcement authority rests with national data protection authorities in EU/EEA member states. The requirement to comply with all applicable regulations relating to collection of information is broadly stated and may encompass CCPA, PIPEDA, and other national data protection laws depending on deployment geography. (2) GOVERNANCE EXPOSURE: High for organizations with EU/EEA user bases. The EU user consent policy requires that consent be obtained before personal data is used for advertising personalization or analytics where consent is the lawful basis, and GTM deployments that fire advertising or analytics tags without a valid consent signal may be in breach of both the GTM terms and GDPR. (3) JURISDICTION FLAGS: EU/EEA deployments face the highest exposure. The EU user consent policy is specifically designed for GDPR and ePrivacy compliance. UK deployments post-Brexit engage the UK GDPR and PECR. California deployments engage CCPA's opt-out and disclosure requirements, though the EU user consent policy is not directly applicable to California. (4) CONTRACT AND VENDOR IMPLICATIONS: Organizations should confirm that their consent management platform generates consent signals recognized by Google's consent mode or equivalent mechanism, and that tag firing rules in GTM are correctly conditioned on valid consent signals. Agency or vendor agreements should specify which party is responsible for consent mechanism implementation and maintenance. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit GTM trigger configurations to confirm that tags requiring consent do not fire prior to a valid consent signal. Privacy policies should be reviewed to confirm they accurately describe all tags deployed through GTM and the purposes of associated data collection. The EU user consent policy URL should be monitored for updates as it is referenced by URL rather than reproduced in the document.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision contractually obligates GTM users to comply with the EU user consent policy, which operationalizes consent requirements under the ePrivacy Directive and GDPR for EU/EEA user data. The obligation applies to users deploying any tags, not only those targeting EU users.
Under this clause, GTM users are required to implement and maintain a privacy policy and to obtain user consent in compliance with the EU user consent policy before firing applicable tags, with this obligation running as a contractual requirement to Google.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Google.