On this page
Google Tag Manager is a tag management system that deploys tags, such as Google Analytics, Google Ads or a third-party pixel, without editing site code, while Google Analytics collects and reports on visits and events. On a healthcare site the risk sits with the tags Tag Manager loads, so removing Tag Manager alone doesn't change what those tags send. Curve Compliance, which replaces browser ad pixels with one script and sends conversions server-side under a BAA it signs on every plan, checked Google's own help pages for this guide on November 2, 2026.
Book a call. Want ad conversions without a pile of browser tags on patient pages? Curve Compliance replaces browser ad pixels with one script, sends conversions server-side to Google Ads, Meta, TikTok, Microsoft Advertising and LinkedIn, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
Tag Manager vs Analytics in one table
Here are the two products side by side, in Google's own words where it gives them:
| Question | Google Tag Manager | Google Analytics |
|---|---|---|
| What is it? | “a tag management system that allows you to set up and manage tags on your site without changing your website's code” (Google) | “a measurement solution that can be used to obtain business insights about traffic on your websites and apps” (Google) |
| What does it handle? | Tags, triggers and variables, grouped in a container | Events, such as page loads, link clicks and purchases, and the reports built on them (Google) |
| Does it report on visitors? | No. It loads the tags that do | Yes, in its reports |
| Where does the data go? | To each tag's own vendor, such as Google Ads, Google Analytics or a third-party pixel | To Google Analytics |
| Does Google sign a BAA for it? | No public statement (Directory entry) | Google says it “does not offer Business Associate Agreements” (Google) |
| Rule on personal data | You agree not “to upload any data to Google Tag Manager that personally identifies an individual” (Google) | The terms bar passing information “that Google could use or recognize as personally identifiable information” (Google) |
How they work together
Tag Manager is the delivery system, and Google Analytics is one of the things it can deliver. Google says “To use Tag Manager, you add 2 snippets of code to each page of your website,” and that “A Tag Manager container can replace all other manually-coded tags on a site or app, including tags from Google Ads, Google Analytics, Floodlight, and 3rd party tags” (Google).
You can also install Google Analytics without Tag Manager, using the Google tag. Google says “The Google tag (gtag.js) is a single tag you can add to your website that allows you to use a variety of Google products and services,” and “If you only need the default metrics, such as page views, clicks and scrolls, you can set up the Google tag once and you're all set” (Google). The line between the two is blurring: Google says “Google tags (gtag.js) are being upgraded to include the capabilities of Google Tag Manager” (Google).
So the usual setups are the Google tag alone, Tag Manager loading the Google tag plus other tags, or Tag Manager loading other vendors' tags with no Google Analytics at all. Each one still sends data from the visitor's browser to every vendor whose tag fires.
Events and triggers
In Google Analytics, “An event allows you to measure a specific interaction or occurrence on your website or app” (Google). In Tag Manager, “a trigger listens to your web page or mobile app for certain types of events like form submissions, button clicks, or page views,” and “The trigger tells the tag to fire when the specified event is detected” (Google). A Tag Manager trigger decides when a tag runs, the tag decides what is sent, and Google Analytics records what arrives as an event.
On a health site that split matters. Google says “New triggers default to fire on all events for the associated event type,” so a page view trigger fires on condition pages and booking pages too unless you add a filter (Google). Filters can keep a tag off the pages you choose. For naming the events themselves, see event tracking on a healthcare website.
HIPAA: where each sits
Google's position on Analytics is direct: “Google makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service.” Google tells HIPAA-regulated customers that “Authenticated pages are likely to be HIPAA-covered and customers should not set Google Analytics tags on those pages,” and that unauthenticated pages related to the provision of health care “are more likely to be HIPAA-covered” (Google).
Tag Manager is different. It is the loader, so its risk is whatever the loaded tags send. The BAA Directory found no public BAA statement from Google for it (Directory entry), and its Use Policy bars uploading data that “personally identifies an individual (such as a name, email address or billing information)” (Google). HHS defines what you are managing: a tracking technology is “a script or code on a website or mobile app used to gather information about users or their actions as they interact with a website or mobile app,” and regulated entities “must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI” (HHS).
The same HHS page notes that a federal court vacated part of the bulletin on June 20, 2024: the part about connecting an IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers (HHS). Which of your pages are HIPAA-covered depends on your setup, so talk to your counsel. If you want help sorting the tags on yours, book a call with Curve's team.
Options on a health site
- Keep Google Analytics off HIPAA-covered pages. That is Google's own instruction for HIPAA-regulated customers (Google); see is Google Analytics 4 HIPAA compliant.
- Audit the container. Open preview mode and list every tag and trigger; see Google Tag Assistant on a healthcare website.
- Take ad pixels out of the browser. Send conversions server-side with a fixed list of fields, so no ad tag sits on booking or form pages.
- Use analytics that sign a BAA where you need one. See analytics alternatives to GA4 and the BAA Directory.
- Know what server-side Tag Manager changes. It moves where tags run, not what they may send; see server-side Tag Manager for healthcare.
- Plan the switch. See the Tag Manager to server-side migration checklist.
How Curve Compliance helps
Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Google Ads, Meta, TikTok, Microsoft Advertising and LinkedIn, so your ad conversions no longer depend on ad tags firing in the patient's browser. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.
Event Logs show what Curve sent to each platform and what the platform accepted. Curve keeps ad attribution when a patient leaves to book in IntakeQ, Calendly, Acuity, Jane App and other schedulers, and Campaign Reporting puts Meta and Google Ads spend next to Curve-tracked conversions for each campaign. Curve's free website scan lists the pixels and trackers on a page today. Curve is SOC 2 Type II, signs a BAA on every plan and does the setup, typically live in about a week.
Sources, checked November 2, 2026: Tag Manager Help, Introduction to Tag Manager; Tag Manager Help, About triggers; Tag Manager Help, About the Google tag; Tag Manager Help, Preview and debug containers; Tag Assistant Help, Troubleshoot with Tag Assistant; Google Analytics Help, About events; Google Analytics Help, HIPAA and Google Analytics; Google Analytics Terms of Service; Google Tag Manager Use Policy; HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
What is the difference between Google Analytics and Google Tag Manager?
Google Tag Manager deploys and manages tags on your site without code changes, while Google Analytics collects and reports on visits and events (Google). Tag Manager can load Google Analytics, but it does not produce reports itself.
Do I need Google Tag Manager if I have Google Analytics?
No. Google says that if you only need default metrics such as page views, clicks and scrolls, you can set up the Google tag once (Google). Tag Manager helps when you manage many tags and triggers.
Is Google Analytics HIPAA compliant?
Google says it “does not offer Business Associate Agreements” for Google Analytics and that HIPAA-regulated customers may only use it on pages that are not HIPAA-covered (Google; Directory entry). See the GA4 verdict and alternatives.
Is Google Tag Manager HIPAA compliant?
The BAA Directory found no public BAA statement from Google for Tag Manager (Directory entry), and its Use Policy bars uploading data that personally identifies an individual (Google). The risk sits with the tags it loads; see the Google Tag Manager verdict.
What is Tag Manager preview mode?
Preview mode lets you browse your site “as if the current container draft was deployed,” connected to Tag Assistant “so that you can inspect which tags fired and in which order” (Google). Regular visitors don't see it.
Does removing Google Tag Manager make a site HIPAA compliant?
No. Tag Manager only loads tags, so what matters is what each tag sends and to whom, wherever it is installed. HHS expects every tracking technology vendor that receives PHI to have signed a BAA (HHS).
What is the Google tag (gtag.js)?
Google says “The Google tag (gtag.js) is a single tag you can add to your website that allows you to use a variety of Google products and services” (Google). It can install Google Analytics and Google Ads measurement without Tag Manager.
Talk to Curve Compliance
Book a call. Want ad conversions that don't depend on browser tags on patient pages? Curve Compliance sends conversions server-side with a fixed list of fields, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.