No. A data layer is a structured object your page fills with the values tags may use, which helps you control what data is shared. OWASP states plainly that a data layer is not a sandbox, because remotely managed event handlers remain part of the page's trust boundary.
Definitions
Data layer: a JavaScript object on your page, defined by you, holding values such as page type or product category that tags read.
Sandbox: a boundary that stops code inside from reaching what is outside, such as the page content and cookies.
Trust boundary: the line around code you rely on. Anything inside it can affect your page.
What a data layer is good for
OWASP recommends a host defined data layer that limits what data is collected. The value is in minimisation. Instead of letting every tag scrape the page, you publish a short list of approved fields. Tags read from that list. If a field is not in the data layer, a well behaved tag has no reason to have it.
That helps with privacy reviews, with analytics quality, and with answering the question what do our vendors get.
What it cannot do
A tag running on your page is still JavaScript in your page. Remote event handlers managed from a vendor console can fire code on clicks and form events. A script that wants more than the data layer offers can read the document, cookies not marked HttpOnly, and form fields. The data layer politely offers the right data and cannot prevent the wrong data being taken.
Related: Google Tag Manager's built in click and form variables, such as Click Text and Form Text, read from the page. See what built-in tag variables can capture.
What does isolate scripts
| Control | What it does |
|---|---|
| Cross domain iframe | OWASP says vendor code will not have direct access to the page DOM and cookies |
| Iframe sandbox attribute | Restricts what the framed content may do |
| Subresource Integrity | Runs only the code that was reviewed, with a hash |
| Content Security Policy | Limits where scripts load from and send data to |
| Server side collection | Moves eligible tags out of the browser |
OWASP names these, and notes that for high risk applications CSP is worth adding on top of iframe sandboxing. For the iframe attribute detail, see which iframe sandbox tokens to allow.
A practical design
- Write down the fields tags need, and name each field's purpose.
- Push only those fields into the data layer.
- Keep identifiers, emails and free text out of it.
- Put high risk vendors in a cross domain iframe where the vendor supports it.
- Review the data layer spec whenever a new tag is added.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how change is surfaced after the fact, since a data layer spec only helps if drift is noticed.
Quick check
Does a data layer hide cookies from tags?
No. It controls what you publish to tags, and does not block a script from reading the page.
Is it still worth having?
Yes. It reduces what you share on purpose and gives reviewers one list to check.
Sources
Last reviewed: 19 October 2026.
