<\/p>\n
We asked the question, do companies in the Consumer Goods & Services industry have robust website tag security?\u00a0 Or are they at risk of leaking personal data through their website tags?<\/p>\n
We found that almost 80% of the\u00a0top 1,000 Consumer Goods & Services websites^ hosted ‘piggyback’ tags – tags that are neither deployed directly\u00a0onto the site nor via a Tag Management System.\u00a0\u00a0While piggyback tags can be legitimate they can also pose risks of data leakage if the company is not aware those tags are present on their site.<\/p>\n<\/blockquote>\n
Introduction<\/h2>\n
Companies are collecting ever-increasing amounts of data on their customers, to personalize user experience and to optimize marketing efforts.\u00a0 With this comes increasing responsibility to protect the data collected.\u00a0 Failing to do so can result in a significant breach of trust and brand damage, additional to legal consequences.<\/p>\n
Most\u00a0companies\u00a0have tags on\u00a0their\u00a0websites that collect data about visitors.\u00a0 This data is often shared\u00a0with third-party vendors to drive advertising, marketing and optimization tools.\u00a0 While companies seek to directly manage\u00a0the\u00a0tags on their site, data can be unknowingly shared with fourth or fifth-party tags that are not in the direct control of the company.\u00a0 We call these\u00a0‘piggyback’\u00a0tags.\u00a0\u00a0As much of the data collected on websites is personal or sensitive, these piggyback tags\u00a0can pose risk.<\/p>\n
At DataTrue, we monitor thousands of websites for data leakage<\/a> by auditing and reporting on tags that may be collecting sensitive data.\u00a0 We used this capability to better understand the potential risk website tags present to data protection in the Consumer Goods & Services industry.\u00a0 To do this we analyzed the website tags on the Alexa Top 1,000 Consumer Goods and Services websites worldwide^.<\/p>\n We found that there was an average of 11 tags per site with a broad distribution.\u00a0 While over half of the websites had fewer than 10 tags, on one site the tag count exceeded 70.<\/p>\n More than\u00a070%\u00a0of\u00a0all\u00a0the tags related to\u00a0campaign marketing\u00a0activities\u00a0–\u00a0Digital\u00a0Advertising, Social\u00a0Media and Data Aggregators\u00a0–\u00a0indicating the influence that marketing teams and their suppliers have on\u00a0website tags, and ultimately on\u00a0data\u00a0security.<\/p>\n Tags relating to\u00a0Analytics\u00a0and Tag Management Systems, the traditional territory of website tags, made up\u00a0slightly over 20% of\u00a0all\u00a0the tags.<\/p>\n While 44% of all the tags were piggyback tags, we also found that 79% of the sites had at least one piggyback tag present.\u00a0 It is possible that the site owners are not aware that these piggyback tags are present on their site, or are not fully briefed on the data that these tags collect and share.\u00a0 As such they may not be in full control of their users’ data.\u00a0 The clear majority of these piggyback tags related to Digital Advertising activities.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_3,1_3,1_3″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”1_3″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/datatrue.wpengine.com\/wp-content\/uploads\/2021\/05\/v5_Case-Study_DataTrue-01-1.png” title_text=”v5_Case-Study_DataTrue-01-1″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][\/et_pb_column][et_pb_column type=”1_3″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/datatrue.wpengine.com\/wp-content\/uploads\/2021\/05\/v5_Case-Study_DataTrue-02.png” title_text=”v5_Case-Study_DataTrue-02″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][\/et_pb_column][et_pb_column type=”1_3″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/datatrue.wpengine.com\/wp-content\/uploads\/2021\/05\/top-1000-CGS-execsumm-03.png” title_text=”top-1000-CGS-execsumm-03″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ _builder_version=”4.16″ _module_preset=”default” background_color=”#f4f4f4″ global_colors_info=”{}”][et_pb_row column_structure=”1_2,1_2″ _builder_version=”4.16″ _module_preset=”default” background_enable_color=”off” global_colors_info=”{}”][et_pb_column type=”1_2″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][dipl_flipbox layout1_3d_depth=”off” front_title=”How many tags are on the websites?” front_content=”While the average number of tags per site is 11, we found a broad distribution (chart 1). Almost 10% of sites had just one tag, and 58% of sites had fewer than ten tags. At the other end of the scale, 11% of the websites hosted more than 30 tags, with one site reporting over 70 tags. That\u2019s a lot of tags to keep track of!” back_title=”Chart 1″ _builder_version=”4.16″ _module_preset=”default” front_general_settings_text_align=”left” background_enable_color=”off” border_color_all_front_box=”#D4E3E9″ global_colors_info=”{}”]<\/p>\n [\/dipl_flipbox][dipl_flipbox layout1_flip_style=”right” layout1_3d_depth=”off” front_title=”Chart 2″ front_content=” Our analysis identified that just over 50% of all tags present were in the Digital Advertising category. Additional to this, Social Media tags accounted for over 16% of all tags and Data Aggregators tags tallied to just over 3%. These three tag categories, which are likely to be instigated by the marketing function in a company, accounted for 70.5% of all the tags on the websites analyzed.<\/p>\n While a lesser 20% of the tags deployed were for Tag Management Systems or Analytics purposes, the single most commonly used tag across all sites was Google Analytics, with Google Tag Manager the 6th most common tag.<\/p>\n In the Analytics and Tag Management Systems categories a small list of well-known tags is used, making knowledge and control of these tags far easier. Conversely in the Digital Analytics category, while there is a selection of predominant tags deployed across many sites, there is also a long tail of possibly lesser-known tags and vendors, all of which need to be researched and approved for data security according to individual companies\u2019 processes.<\/p>\n While Marketing teams have an increasing demand for and influence on website tags, typically the deployment of tags and security of websites is the remit of IT or Analyst teams. This evolution creates a growing intersect between Marketing, Analytics and IT functions. However corporate structures often house these roles and responsibilities in different specialist teams, often with different priorities. To deliver on evolving and fast-moving Marketing data needs, while also maintaining website tag security, companies will need to embed governance protocols and effective ways of working between these functions.<\/p>\n [\/dipl_flipbox][dipl_flipbox layout1_flip_style=”right” layout1_3d_depth=”off” front_title=”The impact of Tag Management Systems (TMS)” front_content=”<\/p>\n Our analysis found that 48% of the Top 1,000 Consumer Goods & Services sites use a Tag Management System (TMS). While one of the benefits of a TMS is that it enables a company to deploy and manage multiple tags through a central container and control point, we found that still 42% of tags on these sites were indirectly deployed tags \u2013 that is that were not deployed either within the TMS or directly onto the site. Again, the majority of these piggyback tags were in the Digital Advertising category. This is influenced by the capability to enable features and associated tags in the administrative interfaces of tools such as Google Analytics, rather than a traditional tag deployment process.<\/p>\n While there is not necessarily anything sinister about the tags deployed in this manner, this represents a point where the \u2018owner\u2019 of website tags and data security (often Analysts or IT team members) may not be included in the tag approval and deployment process and by extension may not be aware the tag is on the site.<\/p>\n ” back_title=”Chart 5″ _builder_version=”4.16″ _module_preset=”default” front_general_settings_text_align=”left” background_enable_color=”off” border_color_all_front_box=”#D4E3E9″ global_colors_info=”{}”]<\/p>\n [\/dipl_flipbox][dipl_flipbox layout1_flip_style=”right” layout1_3d_depth=”off” front_title=”Chart 6″ front_content=” We then peeled the onion back another level and analyzed the depth of the tags to show how removed these tags are from the direct control of the company (chart 6).\u00a0 For example a 4th\u00a0level tag would be a tag that is piggybacking an indirect tag that itself is piggybacking a tag that is attached to a direct tag.<\/p>\n We evaluated the types of tags that are not under direct control of companies and found\u00a0tags\u00a0as many\u00a0as\u00a0six\u00a0layers deep.\u00a0 While this occurred to an extent across\u00a0most of\u00a0the tag categories, the highest volume of\u00a0tags at\u00a0three\u00a0or more layers deep related to\u00a0Digital\u00a0Advertising.<\/p>\n It should also be noted in the chart below (chart 6), that the presence of \u2018direct\u2019 tags at layer two, is a demonstration of a tag being deployed\u00a0into a Tag\u00a0Management\u00a0System.\u00a0 As this is in the direct control of the company, we\u00a0define\u00a0these as direct tags.<\/p>\n [\/dipl_flipbox][\/et_pb_column][et_pb_column type=”1_2″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][dipl_flipbox layout1_flip_style=”right” layout1_3d_depth=”off” front_title=”Image 1″ front_content=” While companies seek to directly manage tags on their websites, data is often also on-shared with other tags that are not in the direct control of the company.<\/p>\n In the visual example of a tag hierarchy (image 1), we see Google Tag Manager and DART DFP tags directly on the site. We also see a number of tags that are at the second level deep, but deployed within the Google Tag Manager container, so also controlled by the company. We classify all of these as Direct tags, as they are clearly visible and within the control of the site owner.<\/p>\n Finally, we see one additional tag at the third level deep which is \u2018piggybacking\u2019 off the Google Analytics tag. We classify this as a piggyback tag, also known as an indirect tag. As anyone with administration permissions to Google Analytics can potentially enable this tag, those responsible for tag management and data security on this website may or may not be aware of this piggyback tag, what it collects, or where else it shares data.<\/p>\n While piggyback tagging can be legitimate, for example for identifying syncing, it can also pose risks if the company is not aware this piggyback tag is attached to the site, nor what data it is collecting and sharing.<\/p>\n [\/dipl_flipbox][dipl_flipbox layout1_flip_style=”right” layout1_3d_depth=”off” front_title=”Are Consumer Goods & Services Sites in Control of the Data they Collect? ” front_content=”<\/p>\n We evaluated how many tags were within the direct control of the top 1,000 Consumer Goods & Services sites. We classified as \u2018Direct\u2019 any tags that are coded directly onto the site or coded through a Tag Management System deployed on the site (indicating that the company has proactively deployed this tag and is aware of its presence). All other tags were classified as piggyback tags as they were not directly deployed.<\/p>\n Overall 58% of the tags were directly deployed and controlled by the website owner, with the remaining 42% piggyback tags. A significant 79% of the tagged sites we analyzed hosted at least one piggyback tag.<\/p>\n While not all piggyback tags are unknown to the site owner, there is a greater likelihood that the site owner is either not aware the tag exists or is not fully briefed on the data collected and shared via these tags.<\/p>\n 79% of the Top 1000 Consumer Goods & Services sites hosted tags that were not under their direct control.<\/strong><\/p>\n We analysed this data by category (chart 3) and found that predictably 100% of Tag Management System tags were Direct. At the other extreme, only 31% of Digital Advertising tags were directly deployed onto the site or a Tag Management System, leaving 69% piggyback tags.<\/p>\n ” back_title=”Chart 3″ _builder_version=”4.16″ _module_preset=”default” front_general_settings_text_align=”left” background_enable_color=”off” border_color_all_front_box=”#D4E3E9″ global_colors_info=”{}”]<\/p>\n [\/dipl_flipbox][dipl_flipbox layout1_flip_style=”right” layout1_3d_depth=”off” front_title=”Direct & Piggyback tags by category and tag” front_content=”<\/p>\n We found that the Google Adwords Remarketing tag was indirectly deployed in 100% of cases. Other significant contributors to the piggyback tag count included: the GA Audiences tag, the Google Analytics Display Features tag and the Double Click Remarketing tag.<\/p>\n In many instances, these particular tags can be enabled through the administration interface of the parent tag, without a need for technical skills to deploy the tag. As such, anyone with the relevant permission level to that administration interface can enable the tag to be deployed. It may not even be apparent to the person enabling the feature that a tag is being deployed. As well as staff having access to these interfaces, suppliers are also sometimes given administrative permissions, meaning they could also enable the tags.<\/p>\n This demonstrates a scenario whereby piggyback tags could be deployed to a company\u2019s website without activating the usual internal governance required for tag deployment, and therefore those who are ultimately responsible for website tag security may be inadvertently excluded and unaware the tag is present.<\/p>\n ” back_title=”Chart 4″ _builder_version=”4.16″ _module_preset=”default” front_general_settings_text_align=”left” background_enable_color=”off” border_color_all_front_box=”#D4E3E9″ global_colors_info=”{}”]<\/p>\n [\/dipl_flipbox][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_row admin_label=”row” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text admin_label=”Text” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” width=”80%” width_tablet=”100%” width_phone=”” width_last_edited=”on|desktop” module_alignment=”center” global_colors_info=”{}”]<\/p>\n <\/p>\n Our analysis shows us that 79% of the top 1,000 Consumer Goods & Service sites host at least one piggyback tag and that 44% of all the tags on these sites are piggybacking.\u00a0 From this, we draw the conclusion that the industry is presented with an ongoing risk of data leakage or non-compliance.<\/p>\n While it is necessary to share data via third-party tags to drive success for websites, companies need to manage the risk of unknown tags that are piggybacking off approved tags.\u00a0 It is important that companies understand all the tags – direct and piggyback – that are on their site and understand how each tag vendor manages and shares data collected from the site.<\/p>\n The rise of marketing campaign data collection and sharing is clear.\u00a0 From a marketing perspective, plenty of attention is usually given to data collection, use and permissions for databases, however marketing teams may be less aware of the risks posed by their website tags.\u00a0\u00a0Marketing is often not the team responsible for tag deployment and website data security, and campaign marketing staff may not be fully cognizant of company protocols relating to tag deployments, nor the potential or consequences of data leakage.<\/p>\n There may tags on sites that companies are not aware of. As companies are responsible for the data associated with all tags on their sites, it is important to understand all of these tags.<\/p>\n<\/blockquote>\n \u00a0Marketing teams and their suppliers may not be aware of the risks associated with their website tags.<\/p>\n<\/blockquote>\n Internal corporate structures, specialist skill sets, trust placed in supplier agencies, and fast-paced environments can all transpire to allow leaky tags onto websites.\u00a0\u00a0But neither ignorance nor process is a defence for a breach of privacy, so it is the company\u2019s responsibility to understand all the tags on their site, including what data they are collecting and sharing, with whom.<\/p>\n The critical first step that lays the foundations for this is conducting a tag audit<\/a> and creating a map of the relationships of all the current tags on your site.\u00a0 Once you have this visualized it is easy for you to then isolate and manage any tags that you are not in direct control of.<\/p>\n ^ Data analysis source data: Alexa top sites for the Consumer Goods and Services category, 7 May 2018 https:\/\/www.alexa.com\/topsites\/category\/Top\/Business\/Consumer_Goods_and_Services<\/p>\n [\/et_pb_text][et_pb_image src=”https:\/\/datatrue.wpengine.com\/wp-content\/uploads\/2021\/05\/DataTrue_Clipboard-01-768×929-1.png” title_text=”DataTrue_Clipboard-01-768×929″ align=”center” _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_cta button_url=”\/infographic-website-tag-security-consumer-goods-services\/” button_text=”Download Full Infographic” _builder_version=”4.16″ _module_preset=”default” background_enable_color=”off” global_colors_info=”{}”][\/et_pb_cta][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" [et_pb_section fb_built=”1″ _builder_version=”4.17.0″ _module_preset=”default” background_color=”gcid-8d4abd33-baae-4c93-954e-bc5ac9d25a4d” border_width_bottom=”10px” border_color_bottom=”#d4e3e9″ locked=”off” global_colors_info=”{%22gcid-8d4abd33-baae-4c93-954e-bc5ac9d25a4d%22:%91%22background_color%22%93}”][et_pb_row _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.17.0″ _module_preset=”default” text_font=”|700||on|||||” text_text_color=”gcid-9f2397ba-8f07-4010-b9b0-450fe1525327″ locked=”off” global_colors_info=”{%22gcid-9f2397ba-8f07-4010-b9b0-450fe1525327%22:%91%22text_text_color%22%93}”] The State of Website Tag Security [\/et_pb_text][et_pb_post_title meta=”off” featured_image=”off” text_color=”light” _builder_version=”4.16″ _module_preset=”default” custom_margin=”||-1px|||” global_colors_info=”{}”][\/et_pb_post_title][et_pb_text _builder_version=”4.16″ _module_preset=”default” background_layout=”dark” global_colors_info=”{}”] An analysis of the top 1,000 Consumer Goods & Services websites [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ admin_label=”section” _builder_version=”4.16″ […]<\/p>\n","protected":false},"author":5,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"\n\t\t\t\t[vc_row hcode_row_style=\"image\" hcode_row_image_type=\"background-image\" hcode_bg_image_type=\"fix-background\" padding_setting=\"1\" margin_setting=\"1\" desktop_margin=\"no-margin-bottom\" hcode_row_bg_image=\"485\" hcode_min_height=\"500px\"][vc_column width=\"1\/1\"][vc_custom_heading text=\"The State of Website Tag Security\" font_container=\"tag:h1|font_size:42px|text_align:center|color:%23ffffff\" google_fonts=\"font_family:Source%20Sans%20Pro%3A200%2C200italic%2C300%2C300italic%2Cregular%2Citalic%2C600%2C600italic%2C700%2C700italic%2C900%2C900italic|font_style:400%20regular%3A400%3Anormal\" css=\".vc_custom_1528345815168{padding-top: 1cm !important;}\"][vc_custom_heading text=\"An analysis of the top 1,000 Consumer Goods & Services websites\" font_container=\"tag:h2|font_size:30px|text_align:center|color:%23ffffff\" use_theme_fonts=\"yes\"][\/vc_column][\/vc_row][vc_row equal_height=\"yes\" padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"][vc_column width=\"1\/1\" css=\".vc_custom_1529382102852{margin-top: 2em !important;}\"][hcode_blockquote desktop_padding=\"no-padding\" desktop_margin=\"no-margin\" hcode_blockquote_font_size=\"24px\" hcode_blockquote_line_height=\"32px\"]We asked the question, do companies in the Consumer Goods & Services industry have robust website tag security?\u00a0\u00a0<\/em>Or are they at risk of leaking personal data through their website tags? <\/em>\n\nWe found that almost 80% of the\u00a0top 1,000 Consumer Goods & Services websites^ hosted 'piggyback' tags - tags that are neither deployed directly\u00a0onto the site nor via a Tag Management System.\u00a0\u00a0<\/em>While piggyback tags can be legitimate they can also pose risks of data leakage if the company is not aware those tags are present on their site.<\/em>[\/hcode_blockquote][vc_custom_heading text=\"Introduction\" font_container=\"tag:h2|text_align:left|color:%231e73be\" use_theme_fonts=\"yes\" css=\".vc_custom_1529380258571{margin-top: 1.5cm !important;}\"][vc_column_text]Companies are collecting ever-increasing amounts of data\u00a0on\u00a0their\u00a0customers, to personalize user\u00a0experience and\u00a0to\u00a0optimize marketing efforts.\u00a0 With this comes increasing responsibility to protect the data collected.\u00a0 Failing to do so can result in a significant breach of trust and brand damage, additional to legal consequences.\n\nMost\u00a0companies\u00a0have tags on\u00a0their\u00a0websites that collect data about visitors.\u00a0 This data is often shared\u00a0with third-party vendors to drive advertising, marketing and optimization tools.\u00a0 While companies seek to directly manage\u00a0the\u00a0tags on their site, data can be unknowingly shared with fourth or fifth-party tags that are not in the direct control of the company.\u00a0 We call these\u00a0'piggyback'\u00a0tags.\u00a0\u00a0As much of the data collected on websites is personal or sensitive, these piggyback tags\u00a0can pose risk.\n\nAt\u00a0DataTrue, we monitor thousands of\u00a0websites for data leakage\u00a0by\u00a0auditing\u00a0and reporting on\u00a0tags that may be collecting sensitive data.\u00a0 We used this capability to better understand the potential risk\u00a0website\u00a0tags present to\u00a0data protection in the\u00a0Consumer Goods & Services\u00a0industry.\u00a0 To do this we analyzed the website tags on the Alexa Top 1,000 Consumer Goods and Services websites worldwide^.[\/vc_column_text][\/vc_column][\/vc_row][vc_row equal_height=\"yes\" padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"][vc_column width=\"1\/1\" css=\".vc_custom_1529382102852{margin-top: 2em !important;}\"][hcode_divider hcode_row_border_position=\"border-top\" hcode_border_type=\"dotted\" hcode_row_border_color=\"#1e73be\"][\/vc_column][\/vc_row][vc_row equal_height=\"yes\" padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"][vc_column width=\"1\/1\" css=\".vc_custom_1529382102852{margin-top: 2em !important;}\"][vc_custom_heading text=\"Summary of Findings\" font_container=\"tag:h2|text_align:left|color:%231e73be\" use_theme_fonts=\"yes\"][vc_column_text]We found\u00a0that there was an average of 11 tags per site with a broad distribution.\u00a0 While over half of the websites had fewer than 10 tags, on one site the tag count exceeded 70.\n\nMore than\u00a070%\u00a0of\u00a0all\u00a0the tags related to\u00a0campaign marketing\u00a0activities\u00a0-\u00a0Digital\u00a0Advertising, Social\u00a0Media and Data Aggregators\u00a0-\u00a0indicating the influence that marketing teams and their suppliers have on\u00a0website tags, and ultimately on\u00a0data\u00a0security.\n\nTags relating to\u00a0Analytics\u00a0and Tag Management Systems, the traditional territory of website tags, made up\u00a0slightly over 20% of\u00a0all\u00a0the tags.\n\nWhile 44%\u00a0of all the tags were piggyback tags, we also found that 79% of the sites had at least one piggyback tag present.\u00a0 It is possible that the site owners are not aware\u00a0that\u00a0these piggyback tags are\u00a0present on their\u00a0site,\u00a0or\u00a0are not fully briefed on the data that these\u00a0tags\u00a0collect\u00a0and share.\u00a0 As such they may not be in full control of their users' data.\u00a0 The\u00a0clear majority\u00a0of these piggyback tags\u00a0related to\u00a0Digital Advertising activities.[\/vc_column_text][\/vc_column][\/vc_row][vc_row equal_height=\"yes\" content_placement=\"middle\" padding_setting=\"1\" desktop_padding=\"no-padding\" css=\".vc_custom_1529961370600{margin-top: 1cm !important;}\"][vc_column width=\"1\/3\"][hcode_simple_image hcode_image=\"1041\"][\/vc_column][vc_column width=\"1\/3\"][hcode_simple_image hcode_image=\"1030\"][\/vc_column][vc_column width=\"1\/3\"][hcode_simple_image hcode_image=\"894\"][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\" css=\".vc_custom_1529973759068{margin-top: 2cm !important;}\"][vc_column width=\"1\/1\"][hcode_divider hcode_row_border_position=\"border-top\" hcode_border_type=\"dotted\" hcode_row_border_color=\"#1e73be\"][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\" css=\".vc_custom_1529977502166{margin-top: 1em !important;}\"][vc_column width=\"1\/1\"][vc_custom_heading text=\"How many tags are on the websites?\" font_container=\"tag:h2|text_align:left|color:%231e73be\" use_theme_fonts=\"yes\"][vc_column_text]While the average number of tags per site\u00a0is\u00a011,\u00a0we found a broad distribution (chart 1).\u00a0 Almost\u00a010% of sites had just one tag, and 58% of sites had fewer than ten tags.\u00a0\u00a0At the other end of the scale,\u00a011% of the websites hosted more than 30 tags, with one site reporting over 70 tags.\u00a0 That\u2019s a lot of tags to keep track of![\/vc_column_text][vc_single_image image=\"1044\" img_size=\"full\"][vc_custom_heading text=\"Chart 1\" font_container=\"tag:p|font_size:14px|text_align:left|line_height:14px\" use_theme_fonts=\"yes\"][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\" css=\".vc_custom_1529292946848{margin-top: 1cm !important;}\"][vc_column width=\"1\/1\"][hcode_divider hcode_row_border_position=\"border-top\" hcode_border_type=\"dotted\" hcode_row_border_color=\"#1e73be\"][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"][vc_column width=\"1\/1\"][vc_custom_heading text=\"What is the purpose of the tags? \" font_container=\"tag:h2|text_align:left|color:%231e73be\" use_theme_fonts=\"yes\" css=\".vc_custom_1529975048188{margin-top: 2em !important;}\"][vc_custom_heading text=\"That's a lot of tags. What are they? And what are they used for?\" font_container=\"tag:h3|text_align:left|color:%231e73be\" use_theme_fonts=\"yes\"][\/vc_column][\/vc_row][vc_row equal_height=\"yes\" padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"][vc_column width=\"1\/2\" css=\".vc_custom_1529381770437{margin-bottom: 0cm !important;padding-bottom: 0cm !important;}\"][vc_column_text padding_setting=\"1\" desktop_padding=\"padding-right-three\" margin_setting=\"1\" desktop_margin=\"no-margin\"]Our analysis identified that just over 50% of all tags present were in the Digital Advertising category.\u00a0 Additional to this, Social Media tags accounted for over 16% of all tags and Data Aggregators tags tallied to just over 3%.\u00a0 These three tag categories, which are likely to be instigated by the marketing function in a company, accounted for 70.5% of all the tags on the websites analyzed.\n\nWhile a lesser 20% of the tags deployed were for Tag Management Systems or Analytics purposes, the single most commonly used tag across all sites was Google Analytics, with Google Tag Manager the 6th most common tag.\n\nIn the Analytics and Tag Management Systems categories a small list of well-known tags is used, making knowledge and control of these tags far easier.\u00a0 Conversely in the Digital Analytics category, while there is a selection of predominant tags deployed across many sites, there is also a long tail of possibly lesser-known tags and vendors, all of which need to be researched and approved for data security according to individual companies' processes.\n\nWhile Marketing teams have an increasing demand for and influence on website tags, typically the deployment of tags and security of websites is the remit of IT or Analyst teams.\u00a0 This evolution creates a growing intersect between Marketing, Analytics and IT functions.\u00a0 However corporate structures often house these roles and responsibilities in different specialist teams, often with different priorities.\u00a0 To deliver on evolving and fast-moving Marketing data needs, while also maintaining website tag security, companies will need\u00a0to embed governance protocols and effective ways of working between these functions.[\/vc_column_text][\/vc_column][vc_column width=\"1\/2\"][vc_single_image image=\"892\" img_size=\"large\" style=\"vc_box_shadow\"][vc_custom_heading text=\"Chart 2\" font_container=\"tag:p|font_size:14px|text_align:left|line_height:14px\" use_theme_fonts=\"yes\"][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\" css=\".vc_custom_1529292946848{margin-top: 1cm !important;}\"][vc_column width=\"1\/1\"][hcode_divider hcode_row_border_position=\"border-top\" hcode_border_type=\"dotted\" hcode_row_border_color=\"#1e73be\"][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"][vc_column width=\"1\/1\"][vc_custom_heading text=\"Direct and Piggyback Tags\" font_container=\"tag:h2|text_align:left|color:%231e73be\" use_theme_fonts=\"yes\" css=\".vc_custom_1529975067338{margin-top: 2em !important;}\"][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"][vc_column width=\"1\/2\"][vc_custom_heading text=\"What are Piggyback Tags?\" font_container=\"tag:h3|text_align:left|color:%231e73be\" use_theme_fonts=\"yes\"][vc_column_text padding_setting=\"1\" desktop_padding=\"padding-right-two\" margin_setting=\"1\" desktop_margin=\"no-margin\"]While companies\u00a0seek to directly manage tags on their websites,\u00a0data\u00a0is often also\u00a0on-shared with other tags that are not in the direct control of the company.\n\nIn the visual\u00a0example of a tag hierarchy (image 1),\u00a0we see Google Tag\u00a0Manager\u00a0and DART DFP tags directly on the site.\u00a0 We also see a number of tags that are at the second\u00a0level deep, but deployed within the\u00a0Google\u00a0Tag\u00a0Manager container, so also controlled by the company.\u00a0 We classify\u00a0all of\u00a0these as Direct tags, as they are clearly visible and within the control of the site owner.\n\nFinally,\u00a0we see one additional tag at the third level deep which is \u2018piggybacking\u2019 off the Google Analytics\u00a0tag.\u00a0 We classify this as a piggyback tag, also known as an indirect tag.\u00a0 As anyone with administration permissions to Google Analytics can potentially enable this tag, those responsible for tag management and data security on this website may or may not be aware of this piggyback tag, what it collects, or where else it shares\u00a0data.\n\nWhile piggyback tagging can be legitimate,\u00a0for example for identifying syncing, it can also pose risks if the company\u00a0is\u00a0not\u00a0aware this piggyback tag is attached to the site,\u00a0nor\u00a0what data it is collecting\u00a0and\u00a0sharing.[\/vc_column_text][\/vc_column][vc_column width=\"1\/2\"][vc_single_image image=\"681\" img_size=\"large\" style=\"vc_box_shadow\" onclick=\"img_link_large\"][vc_custom_heading text=\"Image 1\" font_container=\"tag:p|font_size:14px|text_align:left|line_height:14px\" use_theme_fonts=\"yes\" css=\".vc_custom_1529990264825{padding-left: 0.5cm !important;}\"][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"][vc_column width=\"1\/1\"][vc_custom_heading text=\"Are Consumer Goods & Services Sites in Control of the Data they Collect? \" font_container=\"tag:h3|text_align:left|color:%231e73be\" use_theme_fonts=\"yes\"][vc_column_text padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"]We evaluated how many tags were within the direct control of the\u00a0top 1,000\u00a0Consumer\u00a0Goods & Services sites.\u00a0 We classified as \u2018Direct\u2019 any tags that are\u00a0coded directly\u00a0onto the site\u00a0or coded through a Tag Management System\u00a0deployed on\u00a0the site\u00a0(indicating that the company has proactively deployed this tag and is aware of its presence).\u00a0 All other tags were classified as piggyback tags as they were not directly deployed.\n\nOverall\u00a058%\u00a0of the tags were directly deployed and controlled by the website owner, with the remaining\u00a042% piggyback tags.\u00a0 A significant 79% of the tagged sites we analyzed hosted at least one piggyback tag.\n\nWhile not all piggyback tags are\u00a0unknown\u00a0to the site owner, there is a greater likelihood that the site owner is\u00a0either not aware the tag\u00a0exists or is\u00a0not fully briefed on the data collected and shared via these tags.[\/vc_column_text][hcode_blockquote hcode_blockquote_bg_color=\"#f7f7f7\"]79% of the\u00a0Top 1000 Consumer Goods & Services sites hosted tags that were not under their direct control.[\/hcode_blockquote][vc_column_text padding_setting=\"1\" desktop_padding=\"padding-two-bottom\" margin_setting=\"1\" desktop_margin=\"no-margin\"]We analysed this data by category\u00a0(chart 3) and found\u00a0that\u00a0predictably\u00a0100%\u00a0of\u00a0Tag Management System tags were Direct. At the other extreme,\u00a0only 31% of Digital Advertising tags were directly deployed onto the site or a Tag Management System, leaving\u00a069% piggyback tags.[\/vc_column_text][vc_single_image image=\"1029\" img_size=\"large\" style=\"vc_box_shadow\"][vc_custom_heading text=\"Chart 3\" font_container=\"tag:p|font_size:14px|text_align:left|line_height:14px\" use_theme_fonts=\"yes\"][vc_column_text padding_setting=\"1\" desktop_padding=\"padding-two-top\" margin_setting=\"1\" desktop_margin=\"no-margin\"]Breaking this down to an individual tag level (chart 4) we found that the Google Adwords Remarketing tag was indirectly deployed in 100% of cases.\u00a0 Other significant contributors to the\u00a0piggyback tag count included:\u00a0the GA Audiences tag,\u00a0the Google\u00a0Analytics Display Features tag\u00a0and the Double Click\u00a0Remarketing\u00a0tag.\n\nIn many instances, these particular tags can be enabled through the administration interface of the parent tag,\u00a0without a need for technical\u00a0skills\u00a0to\u00a0deploy the\u00a0tag.\u00a0\u00a0As such, anyone with the\u00a0relevant\u00a0permission level\u00a0to that administration interface\u00a0can enable the tag to be deployed.\u00a0 It may not even be apparent to the person enabling the\u00a0feature that a tag is being deployed.\u00a0 As well as\u00a0staff having access to these interfaces, suppliers are also sometimes given\u00a0administrative\u00a0permissions, meaning they\u00a0could\u00a0also\u00a0enable the tags.\n\nThis demonstrates a scenario whereby piggyback tags could be deployed to a company\u2019s website without activating the usual internal governance required for tag deployment, and therefore those who are ultimately responsible for website tag security may be inadvertently excluded and unaware the tag is present.[\/vc_column_text][vc_single_image image=\"1028\" img_size=\"large\" style=\"vc_box_shadow\" css=\".vc_custom_1530665706337{margin-top: 1cm !important;}\"][vc_custom_heading text=\"Chart 4\" font_container=\"tag:p|font_size:14px|text_align:left|line_height:14px\" use_theme_fonts=\"yes\"][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\" css=\".vc_custom_1529292946848{margin-top: 1cm !important;}\"][vc_column width=\"1\/1\"][hcode_divider hcode_row_border_position=\"border-top\" hcode_border_type=\"dotted\" margin_setting=\"1\" desktop_margin=\"margin-one\" hcode_row_border_color=\"#1e73be\"][\/vc_column][\/vc_row][vc_row equal_height=\"yes\" padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"][vc_column width=\"1\/1\"][vc_custom_heading text=\"The impact of Tag Management Systems (TMS)\" font_container=\"tag:h2|text_align:left|color:%231e73be\" use_theme_fonts=\"yes\" css=\".vc_custom_1529975117496{margin-top: 1em !important;}\"][vc_column_text padding_setting=\"1\" desktop_padding=\"padding-two-bottom\" margin_setting=\"1\" desktop_margin=\"no-margin\"]Our analysis found that\u00a048% of the Top 1,000 Consumer Goods & Services sites use a\u00a0Tag\u00a0Management\u00a0System (TMS).\u00a0 While one of the benefits of\u00a0a\u00a0TMS is that\u00a0it\u00a0enables\u00a0a company to\u00a0deploy and\u00a0manage\u00a0multiple\u00a0tags\u00a0through a central container and control point, we found that still\u00a042%\u00a0of\u00a0tags on these sites were indirectly deployed tags \u2013 that is that were not deployed either within the TMS or directly onto the site. \u00a0Again, the\u00a0majority\u00a0of these piggyback tags were in the Digital Advertising category.\u00a0 This is influenced by the capability to\u00a0enable features and associated tags in the administrative interfaces of tools such as Google Analytics, rather than a traditional tag deployment process.\n\nWhile there is not necessarily anything sinister about the tags deployed in this manner,\u00a0this\u00a0represents\u00a0a point where the 'owner' of website tags and data security (often Analysts or IT team members) may not be included in the tag approval and deployment process and by extension may not be aware the tag is on the site.[\/vc_column_text][vc_single_image image=\"888\" img_size=\"large\" style=\"vc_box_shadow\"][vc_custom_heading text=\"Chart 5\" font_container=\"tag:p|font_size:14px|text_align:left|line_height:14px\" use_theme_fonts=\"yes\"][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\" css=\".vc_custom_1529292946848{margin-top: 1cm !important;}\"][vc_column width=\"1\/1\"][hcode_divider hcode_row_border_position=\"border-top\" hcode_border_type=\"dotted\" margin_setting=\"1\" desktop_margin=\"margin-one-top\" hcode_row_border_color=\"#1e73be\"][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"][vc_column margin_setting=\"1\" desktop_margin=\"no-margin-top\" width=\"1\/1\"][vc_custom_heading text=\"How indirect are the tags?\" font_container=\"tag:h2|text_align:left|color:%231e73be\" use_theme_fonts=\"yes\" css=\".vc_custom_1529382601078{margin-top: 1cm !important;}\"][vc_column_text padding_setting=\"1\" margin_setting=\"1\" desktop_margin=\"no-margin\"]We then peeled the onion back another level\u00a0and\u00a0analyzed\u00a0the depth of the tags\u00a0to\u00a0show\u00a0how removed these tags are from the direct control of the company (chart 6).\u00a0 For\u00a0example\u00a0a 4th<\/sup>\u00a0level tag would be a tag that is piggybacking an indirect tag that itself is piggybacking a tag that is attached to a direct tag.\n\nWe evaluated the types of tags that are not under direct control of companies and found\u00a0tags\u00a0as many\u00a0as\u00a0six\u00a0layers deep.\u00a0 While this occurred to an extent across\u00a0most of\u00a0the tag categories, the highest volume of\u00a0tags at\u00a0three\u00a0or more layers deep related to\u00a0Digital\u00a0Advertising.\n\nIt should also be noted in the chart below (chart 6), that the presence of \u2018direct' tags at layer two, is a demonstration of a tag being deployed\u00a0into a Tag\u00a0Management\u00a0System.\u00a0 As this is in the direct control of the company, we\u00a0define\u00a0these as direct tags.[\/vc_column_text][vc_single_image image=\"889\" img_size=\"large\" add_caption=\"yes\" style=\"vc_box_shadow\"][vc_custom_heading text=\"Chart 6\" font_container=\"tag:p|font_size:14px|text_align:left|line_height:14px\" use_theme_fonts=\"yes\"][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\" css=\".vc_custom_1530666690509{margin-top: 1cm !important;}\"][vc_column width=\"1\/1\"][hcode_divider hcode_row_border_position=\"border-top\" hcode_border_type=\"dotted\" margin_setting=\"1\" desktop_margin=\"margin-one\" hcode_row_border_color=\"#1e73be\"][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"][vc_column width=\"1\/1\"][vc_custom_heading text=\"Conclusion\" font_container=\"tag:h2|text_align:left|color:%231e73be\" use_theme_fonts=\"yes\"][vc_column_text padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"]Our analysis shows us that 79% of the top 1,000 Consumer Goods & Service sites host at least one piggyback tag and that 44% of all the tags on these sites are\u00a0piggybacking.\u00a0 From this, we draw the conclusion that the\u00a0industry is presented with an ongoing risk of data leakage or non-compliance.[\/vc_column_text][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"][vc_column width=\"1\/2\"][vc_column_text padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin\"]While it is necessary to share data via third-party tags to drive success for websites,\u00a0companies need\u00a0to manage the risk of unknown tags that are piggybacking off approved tags.\u00a0 It is important that companies understand all the tags - direct and piggyback - that are on their site and understand how each tag vendor manages and shares data collected from the site.\n\nThe rise of marketing campaign\u00a0data collection and sharing\u00a0is clear.\u00a0 From a marketing perspective, plenty of attention is\u00a0usually\u00a0given to\u00a0data collection, use and permissions for databases,\u00a0however\u00a0marketing teams may be less aware of the risks posed by their website tags.\u00a0\u00a0Marketing is often not the team responsible for\u00a0tag deployment and website data\u00a0security, and campaign marketing staff may not be fully cognizant of company\u00a0protocols\u00a0relating to tag deployments, nor the potential or consequences of data leakage.[\/vc_column_text][\/vc_column][vc_column width=\"1\/2\"][hcode_blockquote desktop_margin=\"margin-one-all\" hcode_blockquote_bg_color=\"#f7f7f7\"]There may tags on sites that companies are not aware of. As companies are responsible for the data associated with all tags on their sites, it is important to understand all of these tags.[\/hcode_blockquote][hcode_blockquote desktop_margin=\"margin-one-all\" hcode_blockquote_bg_color=\"#f7f7f7\"]Marketing teams and their suppliers may not be aware of the risks associated with their website tags.[\/hcode_blockquote][\/vc_column][\/vc_row][vc_row padding_setting=\"1\" desktop_padding=\"no-padding\" margin_setting=\"1\" desktop_margin=\"no-margin-bottom\"][vc_column padding_setting=\"1\" desktop_padding=\"no-padding-bottom\" margin_setting=\"1\" desktop_margin=\"no-margin-bottom\" width=\"1\/1\"][vc_column_text padding_setting=\"1\" mobile_padding=\"xs-padding-one-top\"]Internal corporate structures, specialist skill sets, trust placed in supplier agencies, and fast-paced environments can all transpire to allow leaky tags onto websites.\u00a0\u00a0But\u00a0neither\u00a0ignorance\u00a0nor process\u00a0is\u00a0a\u00a0defence for a breach of privacy, so it is the\u00a0company\u2019s\u00a0responsibility to understand all the tags on their site, including what data they are collecting and sharing, with whom.\n\nThe critical first step that lays the foundations for this is conducting a tag audit and creating a map of the relationships of all the current tags on your site.\u00a0 Once you have this visualized it is easy for you to then isolate and manage any tags that you are not in direct control of.\n\nYou can audit your tags by running a DataTrue<\/a> coverage test. Find out more about DatatTrue, including a no-obligation 30-day free trial.<\/a><\/span>[\/vc_column_text][hcode_divider hcode_row_border_position=\"border-top\" hcode_border_type=\"dotted\" hcode_row_border_color=\"#1e73be\"][vc_column_text]^ Data analysis source data: Alexa top sites for the Consumer Goods and Services category, 7 May 2018 https:\/\/www.alexa.com\/topsites\/category\/Top\/Business\/Consumer_Goods_and_Services[\/vc_column_text][\/vc_column][\/vc_row][vc_row hcode_row_style=\"color\"][vc_column width=\"1\/1\"][hcode_simple_image hcode_mobile_full_image=\"1\" alignment_setting=\"1\" desktop_alignment=\"aligncenter\" hcode_image_srcset=\"medium_large\" hcode_image=\"1031\"][\/vc_column][\/vc_row]\t\t","_et_gb_content_width":"","footnotes":""},"class_list":["post-483","page","type-page","status-publish","hentry"],"yoast_head":"\nSummary of Findings<\/h2>\n
![\"\"](\"https:\/\/datatrue.wpengine.com\/wp-content\/uploads\/2021\/05\/top-1000-CGS-tags-count-04-1.jpg\")
<\/p>\n
\n” back_title=”What is the purpose of the tags? ” _builder_version=”4.17.3″ _module_preset=”default” front_general_settings_text_align=”left” background_enable_color=”off” border_color_all_front_box=”#D4E3E9″ global_colors_info=”{}”]That’s a lot of tags. What are they? And what are they used for?<\/strong><\/p>\n![\"\"](\"https:\/\/datatrue.wpengine.com\/wp-content\/uploads\/2021\/05\/top-1000-CGS-tag-management-systems-09-1024x796.png\")
<\/p>\n
” back_title=”How indirect are the tags?” _builder_version=”4.17.3″ _module_preset=”default” front_general_settings_text_align=”left” background_enable_color=”off” border_color_all_front_box=”#D4E3E9″ global_colors_info=”{}”]<\/p>\n
” back_title=”Direct and Piggyback Tags” _builder_version=”4.17.3″ _module_preset=”default” front_general_settings_text_align=”left” background_enable_color=”off” border_color_all_front_box=”#D4E3E9″ global_colors_info=”{}”]What are Piggyback Tags?<\/strong><\/p>\n![\"\"](\"https:\/\/datatrue.wpengine.com\/wp-content\/uploads\/2021\/05\/v5_Case-Study_DataTrue-06-768x806-1.png\")
<\/p>\n![\"\"](\"https:\/\/datatrue.wpengine.com\/wp-content\/uploads\/2021\/05\/v5_Case-Study_DataTrue-07-768x895-1.png\")
<\/p>\n<\/blockquote>\n
Conclusion<\/h2>\n
\n
\n
You can audit your tags by running a DataTrue<\/a> coverage test. Find out more about DatatTrue, including a no-obligation 30-day free trial.<\/a><\/span><\/strong><\/h4>\n