(Thanks for responding.)
How can this not come from a self-hosted, secure and privacy-respecting, analytics tool?
Even their existing normal HTTP/HTTPS Web server access logs give them all of the things you listed. Even at almost the start of the Web, they did.
Google Tag Manager is a surveillance tool for the benefit of Google. And they pitch it to companies as:
> Google Analytics lets you measure your advertising ROI as well as track your Flash, video, and social networking sites and applications
That's the first blurb on the first Web search hit. It's targeted as a tool for marketing people who brag about the large size of their ad spend on Google AdWords, and then need to make Powerpoints to justify that.
And who are often mimicked by people who don't know any better, but think it's best practice, because they saw a grownup doing it. Or they copy&pasted it from somewhere without understanding.
And when it's on a gov't public information system, it's leaking data about citizens to a private company known to snoop on everything it can, even secretly and against reasonable expectation of privacy.
(For example, in this case, who would know that by using a prominent Web site of the federal government, their behavior on that site is leaked to Google, who, due to other snooping, can attribute it to them personally as an individual. Like, if they walked into a Federal building, to consult an official, and Google had placed hidden cameras and microphones, that it controlled, throughout the building, and even followed them to and from the federal building.)
And, technically, it introduces an additional security weakness, by loading and running code from some site not under gov't control. Which, as we just saw for the nth time yesterday, is almost never well-placed trust. And for no good reason; only mistaken-at-best reasons.
That's just an example. Most other techbro "best practice" third-party requests have similar problems, or even worse, and are similarly unnecessary.