Google Tag Manager is loaded when it shouldn't be

[litzinger]

So we just deployed, and our production site is loading in Bing, AdWords, and Linked in scripts/cookies b/c those are enabled via Google Tag Manager in production as an integration. When Before the user has accepted consent, our integrations config is the following:

integrations: {
    'All': false,
    'Google Analytics': true
}

Once the user has accepted cookies, we set the integrations to:

integrations: {
    'All': true
}

So given the documentation it should only load GA, but GTM is also being included and delivered to the page, thus multiple ad tracking tools are being included before the user has accepted cookies.

It seems like a pretty big problem that GTM is lumped in with GA and those additional integrations are loading in the page even though we have not told them to and the user has not accepted consent.

To test, I commented out the additional .page() calls, so only the single .load() call with the default options, which has all integrations set to false is called. Even then, the GTM is loaded into the page, thus Bing, Twitter, LinkedIn etc are coming in. This is not good for GDPR. Is there something we're doing wrong? We've tested before without GTM as an enabled destination and it appeared to respect our integrations settings on load, but GTM seems to be the outlier... Segment just is not respecting that setting and loading GTM all the time, even if we have 'All' set to false.

[f2prateek]

It depends how you are using it, but integrations object sent as part of your track/identify/etc calls does not control which integrations are loaded, it only decides whether to send that particular event to that integration or not.

To control which tools are loaded you can either use https://github.com/segmentio/consent-manager or see how it sends load options which controls which tools are loaded in the first place.

[litzinger]

It depends how you are using it, but integrations object sent as part of your track/identify/etc calls does not control which integrations are loaded

We had Olark and Marketo enabled in a local environment, and those scripts were not loaded into the page until after we accepted consent and then called 'All': true, where it clearly injected additional JS into the page.

[litzinger]

The consent manager, while a neat tool, is not an option for us, especially since it was released 2 days before GDPR compliance was required, which gives us and everyone hardly any time at all to implement, test, and get it into release cycles.

[f2prateek]

As I mentioned earlier (despite the behaviour you're seeing in your local environment), the integration options passed with events does not control whether integrations are loaded or not.

You don't have to use the consent manager, but you can see how it is using the load options (which are similar to integration options) to control which tools are loaded on the page.

If you're still having issues with this, I'd recommend reaching out to our support team https://segment.com/contact.

[litzinger]

Would you mind pointing me to the source code that handles that part?

[litzinger]

I still don't see how this is true

the integration options passed with events does not control whether integrations are loaded or not.

Additional integrations (Olark and Marketo) were not loaded when 'All' was set to false. No additional cookies or JS were added to the page. As soon as 'All' is set to true, then those additional JS and cookies were loaded. How is this not considered controlling if integrations are loaded or not?

[f2prateek]

I don't know what to tell you other than - that's not how analytics.js loads integrations.

I don't know the details about your testing environment or website, but here's a small isolated example that you can test this with - https://gist.github.com/f2prateek/684cfd34c0119228fa915d872e671d56 This is only calling using the Segment snippet to initialize analytics.js, and calls analytics.load with a writeKey. This isn't sending any messages. However if you open this page, you'll see all the scripts associated with this writeKey are loaded (https://cloudup.com/ckfVtRvyRWg).

The consent managers works by removing the analytics.load("4txshy8l73"); call from the head script, and calling this only after you get consent from your users (see https://github.com/segmentio/consent-manager/blob/master/README.md#usage and https://github.com/segmentio/consent-manager/blob/master/src/consent-manager-builder/analytics.js#L42).

Then once you have consent, you can send custom options in the load call. These options can include which tools to load. Note that to use this custom load functionality, you have to be using the latest snippet from https://segment.com/docs/sources/website/analytics.js/quickstart/#step-1-copy-the-snippet.

e.g. if you use analytics.load("4txshy8l73", { integrations: { All: false } }); (runnable example here https://gist.github.com/f2prateek/dd4cf1804c99cf821d67c61f70d85eb5), you'll see none of your integrations will load on the page. You can customize the options as you need, e.g. {integrations: { Mixpanel: false } } will only disable Mixpanel.

If you're still having issues with this, please reach out to our support team with https://segment.com/contact.

[litzinger]

I've reached out to the support team via friends@segment.com but have not heard back. For context, here is our loading script. I commented out the additional .page() calls. You can see in the defaultSegmentOptions that 'All' is false, but its clearly working as I described it. Only GA is loaded, user accepts cookies, I reload the page, GA, Olark, then Marketo are loaded.

Am I correctly stating this is what you're describing? - Additional scripts from integrations can be loaded into the page but not actively tracked b/c 'All' is set to false? If thats the case then that is not the behavior we're seeing. We were testing locally with Olark and Marketo, their JS and cookies were only added to the page after accepting consent ('All': true), and never before. But now we're seeing GTM and Bing come in before consent ('All': false). There is clearly some inconsistent behavior happening here.

[redacted example code]

[f2prateek]

I'm not sure if you saw, but I included a working example of this API in the last post https://gist.github.com/f2prateek/dd4cf1804c99cf821d67c61f70d85eb5.

It sounds like you're still having issues with this on your website. Our support team is looking into your setup and will reach out to you via the ticket you opened.

[litzinger]

It seems our loading script was a bit out of date, it doesn't have the second parameter on the load() function, thus _loadOptions was never getting set.

:(

Sorry for the hassle... but thanks for your patience which eventually identified the flaw on our side.