4 ms·

Citing adblock feels like clickbait. Google Tag Manager can't run ads so I don't follow the comparison. Marketing analytics could always side-step anti-adblocki

Citing adblock feels like clickbait. Google Tag Manager can't run ads so I don't follow the comparison. Marketing analytics could always side-step anti-adblocking tools through server-side tracking.

sodality2 5y ago
Server side tracking based on what, server access logs? That's not particularly helpful compared to the info you get with clientside analytics libraries.
- matt_heimer 5y ago
  No, the gtag in the browser sends all the data to the server-side proxy. Then on the server-side config you can pick which parts of the data to share with 3rd parties. So there is still client side data capture, its just reduced to one component capturing the data.
coffeefirst 5y ago
Right. Everything in the article is wrong. GTM is still GTM and can be trivially blocked; the container itself isn't moving server-side. It's just gained the ability to proxy data to third parties instead of needing to load scripts for every tracker. This is better for performance, and should be explicitly in control of exactly what data is passed on to where. All you really lose is the ability to block a subset of analytics scripts selectively.
- probotect0r 5y ago
  How are you going to block it "trivially" if you don't know which script to block? They recommend changing the name of the GTM script, and paired with changing the content slightly, you won't be able to tell which script is GTM and which is actually important to the functioning of the site.
  - jacquesm 5y ago
    You'll know that after loading the first couple of bytes though.
    - _flux 5y ago
      So they need to change the first couple bytes then, automatically. Essentially I don't understand how possibly could free adblocking lists defeat advertisers or trackers if they truly cared about them: simply have a system running with the latest adblock lists against their test site, and if it is able to filter them, have an engineer make a modification—or have the system automatically pull up a pre-made modification or even generate a new one. In addition, the content-driving JS and the site JS could be bundled in one and obfuscated. Best functioning filters are secret ones and thus only the technically minded minority has access to them.
  - gizzlon 5y ago
    If it's 99.99% the same I think we will manage :)
    - coffeefirst 5y ago
      This was my exact thought when I wrote that comment. Then I remembered Manifest v3. ITP, ETP, and plugins that can block requests based on heuristics will make pretty short work of this. In Chrome, come Manifest v3, plugins won't be allowed to. So... this is all uglier and more complicated than I thought.
  - c0balt 5y ago
    +It's gonna be very hard to detect once they actually bundle up (which I suspect only a few will do) the tag manager and obfuscate
  - dlubarov 5y ago
    Where does Google recommend changing the name of the script? The author claims that they do, but their link just recommends self-hosting the script. In Google's recommended JS, the path is exactly the same, only the hostname is different ("www.googletagmanager.com" replaced with "<DOMAIN NAME>"). Self-hosting by itself might make blocking marginally more difficult, but there are other reasons to do it: - Browsers these days segment caches by origin, so there's no caching benefit to using Google as a CDN. - With HTTP2, a first-party request is likely to immediately go through an existing (multiplexed) connection, saving a handshake. - It's arguably better for privacy, as users and legislators seem to be concerned about links to Google leaking IPs (https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264).
- iamacyborg 5y ago
  > GTM is still GTM and can be trivially blocked; the container itself isn't moving server-side. Not when the script sending data to the server side GTM is a first party one.
- deleted 5y ago
  [deleted]
fay59 5y ago
Saying that Adblock users want it 100% to block ads and 0% to protect their privacy is a misleadingly narrow analysis, even this use isn’t completely effective.
matt_heimer 5y ago
Adblockers block ads and tracking, if the new gtag manager makes easier to defeat the tracking protections of an ad blocker then it seems accurate. I think the key thing here is that ad/tracking blockers often rely on domains or requests being 3rd party. In the past it was more work to hide the 3rd party trackers as 1st party, this makes it easy so its more likely to happen now.

Citing adblock feels like clickbait. Google Tag Manager can't run ads so I don't follow the comparison. Marketing analytics could always side-step anti-adblocking tools through server-side tracking.

sodality2 5y ago

Server side tracking based on what, server access logs? That's not particularly helpful compared to the info you get with clientside analytics libraries.

matt_heimer 5y ago
No, the gtag in the browser sends all the data to the server-side proxy. Then on the server-side config you can pick which parts of the data to share with 3rd parties. So there is still client side data capture, its just reduced to one component capturing the data.

coffeefirst 5y ago

Right. Everything in the article is wrong. GTM is still GTM and can be trivially blocked; the container itself isn't moving server-side. It's just gained the ability to proxy data to third parties instead of needing to load scripts for every tracker. This is better for performance, and should be explicitly in control of exactly what data is passed on to where. All you really lose is the ability to block a subset of analytics scripts selectively.

probotect0r 5y ago
How are you going to block it "trivially" if you don't know which script to block? They recommend changing the name of the GTM script, and paired with changing the content slightly, you won't be able to tell which script is GTM and which is actually important to the functioning of the site.
- jacquesm 5y ago
  You'll know that after loading the first couple of bytes though.
  - _flux 5y ago
    So they need to change the first couple bytes then, automatically. Essentially I don't understand how possibly could free adblocking lists defeat advertisers or trackers if they truly cared about them: simply have a system running with the latest adblock lists against their test site, and if it is able to filter them, have an engineer make a modification—or have the system automatically pull up a pre-made modification or even generate a new one. In addition, the content-driving JS and the site JS could be bundled in one and obfuscated. Best functioning filters are secret ones and thus only the technically minded minority has access to them.
- gizzlon 5y ago
  If it's 99.99% the same I think we will manage :)
  - coffeefirst 5y ago
    This was my exact thought when I wrote that comment. Then I remembered Manifest v3. ITP, ETP, and plugins that can block requests based on heuristics will make pretty short work of this. In Chrome, come Manifest v3, plugins won't be allowed to. So... this is all uglier and more complicated than I thought.
- c0balt 5y ago
  +It's gonna be very hard to detect once they actually bundle up (which I suspect only a few will do) the tag manager and obfuscate
- dlubarov 5y ago
  Where does Google recommend changing the name of the script? The author claims that they do, but their link just recommends self-hosting the script. In Google's recommended JS, the path is exactly the same, only the hostname is different ("www.googletagmanager.com" replaced with "<DOMAIN NAME>"). Self-hosting by itself might make blocking marginally more difficult, but there are other reasons to do it: - Browsers these days segment caches by origin, so there's no caching benefit to using Google as a CDN. - With HTTP2, a first-party request is likely to immediately go through an existing (multiplexed) connection, saving a handshake. - It's arguably better for privacy, as users and legislators seem to be concerned about links to Google leaking IPs (https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264).
iamacyborg 5y ago
> GTM is still GTM and can be trivially blocked; the container itself isn't moving server-side. Not when the script sending data to the server side GTM is a first party one.
deleted 5y ago
[deleted]

fay59 5y ago

Saying that Adblock users want it 100% to block ads and 0% to protect their privacy is a misleadingly narrow analysis, even this use isn’t completely effective.

matt_heimer 5y ago

Adblockers block ads and tracking, if the new gtag manager makes easier to defeat the tracking protections of an ad blocker then it seems accurate. I think the key thing here is that ad/tracking blockers often rely on domains or requests being 3rd party. In the past it was more work to hide the 3rd party trackers as 1st party, this makes it easy so its more likely to happen now.