Skip to main content

Google Tag Manager

Record Web loads the client-owned Google Tag Manager (GTM) web container during the anonymous pre-profile and Adult flows. The pre-profile flow grants only product analytics storage and denies advertising storage, ad user data and ad personalization. A Kids profile fails closed and does not keep GTM or the data layer active. Maintenance and startup-error documents do not install GTM.

Configuration​

The public GitHub environment variable GTM_CONTAINER_ID must contain GTM-TC2WMJC in dev, uat and prod. The deployment workflow maps it to the NEXT_PUBLIC_GTM_ID Docker build argument and fails before building when the value is missing.

The application accepts only the standard GTM-* web container format. A valid value makes the container available to the profile-aware measurement gate; it does not bypass that gate.

The integration intentionally omits GTM's noscript fallback. A static iframe would run before JavaScript can resolve the active profile and therefore cannot honour the Kids measurement boundary.

Profile transitions​

The application updates consent and creates a clean document boundary whenever measurement access changes:

  1. The anonymous pre-profile flow keeps identity, plan data and commercial providers disabled while allowing product analytics events.
  2. Resolving an Adult profile upgrades consent and applies the authenticated identity without reinstalling GTM.
  3. Adult to unresolved downgrades consent, clears identity and plan state, and stops commercial providers.
  4. Any transition to or from Kids reloads the document so a restricted document is not reused across the Kids boundary.

Application-owned GA4 and marketing emitters also check the same policy and do not emit events while the audience is Kids.

Ownership and validation​

The application owns loading the configured container and emitting the Web v09 dataLayer contract. Record owns the container's tags, triggers, variables, consent configuration, environments and publication lifecycle.

Before release, use GTM Preview against the target Record Web build and verify:

  1. A fresh unresolved session loads GTM-TC2WMJC with analytics storage granted and all advertising consent types denied.
  2. Login and sign-up interactions remain anonymous until an Adult profile is active; a Kids session makes no request to GTM or its tag destinations.
  3. Every Web v09 event selects the expected trigger exactly once.
  4. The mapped GA4/i-cherry tag receives the documented parameters.
  5. The same timestamp, test user and build can be found in GA4 DebugView/Realtime and in the i-cherry validation view.
  6. Adult to Kids and Kids to Adult transitions create a hard reload and do not leak queued or persisted commercial state across the boundary.

Tag-specific destinations may require additional CSP hosts. Validate the final published container in Preview and add only the hosts required by approved tags.