Using Google Tag Manager — what should we watch out for regarding data privacy and DSGVO in Germany?

On the technical side, don't skip setting up Consent Mode v2. When configuring triggers, listen for custom events pushed by the CMP instead of using "All Pages". Check outgoing requests in your browser's network tab yourself to make sure scripts definitely don't fire when consent isn't granted.

Open a spreadsheet right now and log every active tag: 1) Tag name 2) Provider and server location, 3) Purpose, 4) Required consent category (statistics, marketing, etc.). If you switch to a tag manager without this inventory, nobody will know what code is firing or when three months from now.

Some agencies brush it off saying "GTM is just a container, it doesn't set cookies itself so you don't need consent." That mindset is super risky in Germany. When the container script downloads, the visitor's IP address hits a third-party server. That's why it absolutely has to sit right behind your consent mechanism.

we went through the exact same thing with our hamburg agency last year. like lawyer had us rewrite the datenschutzerklärung from scratch and billed us 600 eur for the consult. but it gave us total peace of mind, we have our audit-ready binder if an inspection letter ever shows up.

We tracked our consent rates when we made the switch. Around 68 percent of visitors opted into analytics cookies, while marketing pixels only hit about 42 percent. If you don't configure your consent setup properly, you risk losing all that data completely.

Does your current consent banner support server-side tagging (Server-Side GTM)? If you want to stop data from routing directly to Google's servers, have you thought about proxying it through an EU-hosted server?

I’d recommend reviewing the guidance issued by your state's data protection supervisory authority (Landesbeauftragte für Datenschutz). When audits happen, the presence of standard contractual clauses (SCC) for third-country data transfers and the transparency of your cookie disclosure are the very first things they check.

I felt relieved reading this answer, so it's not just me. Start with a small trial; don't commit to everything at once.

Everyone rushing into google tag manager data privacy gets stuck at the same point. That's all, sorry if I went on too long.

Following.

I felt relieved reading this answer, so it's not just me. When we decide without measuring, we always end up in the same place.

That's all, sorry if I went on too long.

Just a heads-up. Don't rely on a single measure; go layer by layer.

If I were you, I'd go this route.

The opposite happened to me, thats why Im writing. Taking notes for two weeks yields better results than a six-month estimate.

This is my opinion Im not claiming its absolute truth.

I'd appreciate it if you shared the outcome.

I feel the same way. Having backups accessible on the same network and with the same identity makes them part of the target.

An untested backup is not a backup. If you post the result here, it will help others too.

Exactly like that. An untested backup is not a backup.

This is my opinion, I'm not claiming it's absolute truth.

We've heard this a lot, but it never happened like that for us. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Proven by experience.

Let me share my experience. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

An automated scan report is not the same as a penetration test. Hope this helps.

I agree.