Incapacitating Google Tag Manager (2022) • Hacker News Board

Re: Incapacitating Google Tag Manager (2022)

#141

Post by jeroenhd » Sat, Jul 05, 2025, 4:56 PM UTC

culi wrote: post #87

BurnerBotje wrote: post #22

I have an idea that another way of preventing being tracked is just massively spamming trash in the data layer object, pushing thousands of dollars worth of purchase events and such, pushing randomly generated user details and other such events. Perhaps by doing this your real data will be hard to filter out. A side effect is also that data becomes unreliable overall, helping less privacy aware people in the process.

You're talking about Adnauseum https://adnauseam.io/ Chrome banned it from their add on store but it can still be installed manually

AdNaueam works against ads, but does it also work against Google Tag Manager?

I've already got most ads blocked by simply Piholing them, but GTM tracking my every move using first-party content is a different kind of interaction to attack.

Re: Incapacitating Google Tag Manager (2022)

#142

Post by jeroenhd » Sat, Jul 05, 2025, 5:01 PM UTC

paradox460 wrote: post #93

Years ago, I worked on a site where we constantly had requests from the non technical side of the company to make the site load faster. We were perplexed in engineering. The site loaded and was ready for us in less than a fraction of a second. Eventually we realized that every dev ran ubo, and tried loading the site without it. It took about 5 seconds. Marketing and other parts of the company had loaded so much crap…

This is why I generally keep a mostly-clean browser around for development (only including some dev extensions). I've wasted half an hour when I had a stray uBO filter go off on a component I was working on once (wasn't even an ad) and that taught me a valuable lesson.

If you're testing a website, you've got to test it like your customers use it. I shake my head at the incompetence of web designers every time I encounter a website filled with scroll bars because the devs on macOS haven't bothered testing any other device.

Re: Incapacitating Google Tag Manager (2022)

#143

Post by mrweasel » Sat, Jul 05, 2025, 5:51 PM UTC

aerzen wrote: post #20

Am I dumb or does this article fail to explain what does the tag manager actually do? And not just with a loaded word, such as surveillance or spying, but actually technically explain what they are selling for and why it is bad.

This may have changed, I last used Tag Manager 9-10 ago. You basically added a single Javascript snippet to you website, then you could inject other Javascript into the pages, using various rules. So rather than having to redeploy our site every time the marketing department wanted to add a new tracking or retargeting script, we could just add it in Tag Manager. I think is a great tool if you insist on doing these types of thing. You can also extract and transform variables, so all the customization required to adapt to each service could be done within Tag Manager, keeping your website simpler.

One major issue Tag Manager solved for us was that a bunch of these online marketing companies that have their own tracking pixels/scripts absolutely suck at running IT infrastructure. More than ones we experienced poorly written 3rd. party scripts would break our site. Rather than having to do a redeployment, to temporarily disable a script, I could easily pop into the Tag Manager console and disable to offending service.

Maybe Google Tag Manager has changed, but it was a good tool, if you where in the business of doing those sorts of things. I suppose it's also a clever way of blocking all tracking from a site by just stopping the Tag Manager script from loading.

Re: Incapacitating Google Tag Manager (2022)

#144

Post by pests » Sat, Jul 05, 2025, 6:49 PM UTC

behringer wrote: post #85

cj wrote: post #43

Earlier quoted context omitted.

[Preface: I hate ads, I love uBlock origin, I use pihole, I'm a proponent of ad blockers] I manage a Google Ads account with a $500,000 budget. That budget is spent on a mix of display ads, google search, and youtube ads. If I knew that 10% of our budget was wasted on bot clicks, there's nothing I can do as an advertiser. We can't stop advertising... we want to grow our business and advertising is how you get your na…

This is great. I seek out competitors to the companies that advertise so I can get the product without rewarding advertisers. Man scape? Nah, generic women's razers. Pcbway? Nope. JLCPCB. Screw your ads. Find a better way.

JLCPCB does tons of sponsored segments on YT. I see them more than Pcbway.

Re: Incapacitating Google Tag Manager (2022)

#145

Post by ndriscoll » Sat, Jul 05, 2025, 7:29 PM UTC

jppittma wrote: post #135

simonsarris wrote: post #77

Earlier quoted context omitted.

The chief reason is that websites pay for advertising and want to know if the advertising is working and Google tag manager is the way to do that, for Google Ads. This is not unreasonable! People spend a lot of money on ads and would like to find out if and when they work. But people act like its an unspeakable nebulous crime but this is probably the most common case by miles.

It feels that way for a lot of privacy concerns. "Telemetry" is the scare word for debug log, core dumps, and stack traces. I think it’s completely reasonable to want those.

It's reasonable to want and ask for debug data. Not so reasonable to exfiltrate it without the owner's permission.

Re: Incapacitating Google Tag Manager (2022)

#146

Post by Timwi » Sat, Jul 05, 2025, 7:53 PM UTC

adamiscool8 wrote: post #28

I don't think this article makes a good case for why you should. >The more of us who incapacitate Google's analytics products and their support mechanism, the better. Not just for the good of each individual person implementing the blocks - but in a wider sense, because if enough people block Google Analytics 4, it will go the same way as Universal Google Analytics. These products rely on gaining access to the majori…

> if site owners can't easily assess the performance of their site

I would be more than happy to opt in to performance metrics or other reports if only I could have some level of trust that improving the UX is all it's gonna be used for. I want to live in a world where that is the everyday normal, and where the non-consensual collection and sale of personal data is a high-profile public scandal with severe legal consequences.

Re: Incapacitating Google Tag Manager (2022)

#147

Post by zelphirkalt » Sat, Jul 05, 2025, 7:56 PM UTC

1vuio0pswjnm7 wrote: post #41

gleenn wrote: post #2

I'm all for blocking surveillance but how tiring is it to block JavaScript as suggested and then watch the majority of the internet not work?

Impossible to know because when I disable Javascript "the majority of the internet" works fine. As does a majority of the web. I read HN and every site submitted to HN using TCP clients and a text-only browser, that has no Javascript engine, to convert HTML to text. The keyword is "read". Javascript is not necessary for requesting or reading documents. Web developers may use it but that doesn't mean it is necessary f…

[dead]

Re: Incapacitating Google Tag Manager (2022)

#148

Post by Timwi » Sat, Jul 05, 2025, 7:57 PM UTC

alganet wrote: post #12

Animats wrote: post #8

Blocking Google Tag Manager script injection seems to have few side effects. Blocking third party cookies also seems to have few side effects. Turning off Javascript breaks too much.

Use a whitelist-based extension such as NoScript: https://noscript.net You can then enable just enough JS to make sites work, slowly building a list of just what is necessary. It can also block fonts, webgl, prefetch, ping and all those other supercookie-enabling techniques. The same with traditional cookies. I use Cookie AutoDelete to remove _all_ cookies as soon as I close the tab. I can then whitelist the ones I n…

Why would JIT be more likely to have such a vulnerability than a JavaScript engine without JIT?

Re: Incapacitating Google Tag Manager (2022)

#149

Post by Timwi » Sat, Jul 05, 2025, 8:05 PM UTC

lerp-io wrote: post #74

ugh... if you think the internet should be a "static webpage" i got bad news for you bud

The term is a little ambiguous. They're not referring to a website that is served from static files that never change (which would exclude forums like Hacker News). They're referring to websites that still work if you disable JavaScript, so Hacker News would still be included.

Re: Incapacitating Google Tag Manager (2022)

#150

Post by wglb » Sat, Jul 05, 2025, 8:16 PM UTC

zelphirkalt wrote: post #133

wglb wrote: post #125

Earlier quoted context omitted.

What do you expect this to do, long term? I’m curious.

Even if it merely makes using Google shenanigans unattractive for advertisers, that would be a huge win against one of the biggest perpetrators, privacy and data protection violators out there.

How unattractive do you think it will make it for them?