A tag is a snippet of code or a request that sends data to a vendor. A pixel is a tag that works by requesting a tiny image. A container holds your tags. A data layer holds the values tags may read. A CMP collects consent. Each term has a security angle, listed below.
Definitions in one table
| Term | Plain meaning | Security angle |
|---|---|---|
| Third party script | JavaScript served by a vendor and run on your page | Same access as your own code |
| Tag | A snippet or request that sends data to a vendor | Each tag is a data path to a third party |
| Pixel | A tag that requests a tiny image, with data in the URL | Data travels in the query string |
| Tag manager | A tool for adding and changing tags without a code release | Changes ship outside your normal release process |
| Container | The bundle of tags, triggers and variables you publish | Whoever publishes controls what runs |
| Trigger | The condition that fires a tag | Broad triggers widen exposure |
| Variable | A value a tag can use, such as Page URL | Can carry personal data |
| Data layer | An object on your page with approved values for tags | Limits sharing but is not a sandbox |
| CMP | Consent management platform, the banner tool | Must be wired to tags to matter |
| Consent mode | Google's way to pass consent state to Google tags | Does not save choices or block all tags |
| CSP | Content Security Policy, a header limiting sources | Limits load and send locations |
| SRI | Subresource Integrity, a hash check on a file | Only works on a fixed file |
| Custom HTML tag | A tag containing arbitrary code | Highest risk tag type |
How the pieces fit
Your page loads a container. The container fires tags when triggers match. Tags read variables, often from the data layer, and send data to vendors. A CMP decides which tags may run, if it is wired up. A CSP tells the browser which hosts the page may load from and send to.
Google describes a Custom Image tag as the way to deploy a pixel, and a Custom HTML tag as the way to deploy a tag that is not natively supported. Google's help recommends the built in templates as the best way to avoid performance and malware issues.
Three misunderstandings
A tag manager is a security tool. It is a delivery tool. OWASP notes containers can execute custom JavaScript and HTML tags in the browser and recommends restricting publish access.
A pixel is harmless because it is an image. The image request carries whatever the URL contains, and the vendor sees it.
Consent mode blocks tracking. Google's guide describes Google tags adjusting behavior. It does not save choices and does not govern other vendors' tags.
Where to go next
For access, read who should have publish access. For listing what runs, use the script inventory method. For policy, see what CSP and SRI each stop.
Quick check
What is the difference between a tag and a pixel?
A pixel is a kind of tag that works by requesting a tiny image. Tags can also be full scripts.
Is a container the same as a data layer?
No. The container holds tags and rules. The data layer is an object on your page that holds values tags may read.
Does a CMP stop trackers by itself?
Only if tags are wired to respect its choices. Test it with the network panel.
Where Safeguard fits
Safeguard offers dependency scanning, SBOM, policies and gates for the code you ship. Try the free scan.
Sources
- Google Tag Manager Help: custom tags
- Google tag platform: consent mode
- OWASP Third Party JavaScript Management Cheat Sheet
Last reviewed: 19 October 2026.
