GTM Custom Templates and the Community Template Gallery

Custom templates are Tag Manager's safer alternative to Custom HTML tags. This guide covers adding templates from the Community Template Gallery, reviewing their permissions, keeping them updated, building your own, and the page policies that can limit what they do.

This guide is built from Google's own pages, checked on 10 November 2026: Tag Manager Help on custom templates and the Community Template Gallery, and the developer pages on the custom templates quick start, sandboxed JavaScript, template permissions, template policies, submitting to the gallery and restricting tag deployment.

What a custom template is
Adding a template from the gallery
Template updates
Building your own template
Sandboxed JavaScript
Permissions
Policies and allowlists on the page
Sharing and publishing a template
How we use templates
Frequently asked questions

What a custom template is

Every tag and variable in Tag Manager is built from a template. Google supplies many, such as the Google Analytics and Google Ads tags. Custom templates let you add your own. In Google's words, they "allow you to write your own tag and variable definitions so that others within your organization can use them alongside the built-in tag and variable templates."

The point is safety. Google says: "The permission-centric, sandboxed nature of custom templates makes it possible to write custom tags and variables in a safer, more efficient manner than when using custom HTML tags and custom JavaScript variables." A Custom HTML tag can run any code. A template can only do what its permissions allow, and those permissions are visible to anyone who adds it.

There are two kinds:

	Tag template	Variable template
What it does	Runs when its trigger fires, for example sends data to a vendor	Returns a value that tags and triggers use
How it finishes	Calls `data.gtmOnSuccess` or `data.gtmOnFailure`	Returns a value directly
Where you use it	Tags > New, in the Custom section	Variables > New

Templates live under Templates in the left navigation, with separate Tag Templates and Variable Templates sections. Google notes that custom and community templates "are only available for web and server-side properties at this time", not mobile app containers. If you are new to tags, triggers and variables, start with our Google Tag Manager basics and GTM variables guides.

Adding a template from the gallery

Most templates you will use come from the Community Template Gallery, which Google describes as a place to "discover community-created tag and variable templates and add them to your containers." Vendors publish tags for their own tools there. Google's note is worth reading twice: "The content in the gallery is provided by third party developers, not by Google. Google makes no promises or commitments about the performance, quality, or content of the templates provided by third parties."

You can browse it at tagmanager.google.com/gallery, where each template page shows "the template, the author, and any required permissions" and links to its GitHub repository. To add a tag template from inside Tag Manager, Google's steps are:

Click Templates.
In the Tag Templates section, click Search Gallery.
Search, for example for the vendor's name, and click a template to see its details.
Click Add to workspace.
Review the required permissions. "If you trust the template, click Add."

Variable templates work the same way from the Variable Templates section. Once added, the template shows up as an option when you create a new tag or variable. It is added to your current workspace, so it goes live with the next version you publish; our GTM workspaces guide covers that.

Template updates

When a publisher updates a gallery template you use, Tag Manager shows a notification bar at the top of the container. Click View, choose the template, and Tag Manager shows a comparison of the current and new versions. Click Accept update to install it or Skip update to ignore that version. Google says "Field values and configurations will be retained between versions", and that you may need to "test and republish your container for the updates to take effect."

You can edit an imported template in the template editor, but Google warns: "Use this ability with great caution." It adds: "If a template is modified, it will no longer be updated when the template publisher provides an update." To get back on the update path, discard your changes and re-import the template.

Building your own template

If no template exists for a tool, or you want a tidy version of code you run often, you can build one. On the Templates screen, click New under Tag Templates or Variable Templates. The Template Editor has four areas, as Google lists them:

Info: the name, a description of 200 characters or less, and an icon (square PNG, JPEG or GIF, at least 64 by 64 pixels, no larger than 50 kB).
Fields: the form the user fills in, such as a text field for an account ID. Fields can use container variables.
Code: sandboxed JavaScript that defines what the tag or variable does.
Permissions: what the code is allowed to do.

A Template Preview panel shows how the form will look; click Refresh after changes. Run Code tests the code, and errors appear in the Console window. In a tag template, the code should finish by calling data.gtmOnSuccess or data.gtmOnFailure. Google says these "tell Google Tag Manager when the tag has completed or failed its task" and are used for features "such as tag sequencing or preview mode". How a sequence reacts to a failure is in our GTM tag sequencing guide.

Sandboxed JavaScript

Template code is not ordinary browser JavaScript. Google calls sandboxed JavaScript "a simplified subset of the JavaScript language" that is "based on ECMAScript 5.1", with some newer features such as arrow functions and const/let. The differences that matter in practice:

There is no window object, so no document, location or setTimeout directly. Instead, "a global require function is available" that provides these functions, for example require('sendPixel').
Page values can be read with the copyFromWindow API, which makes a deep copy; Google notes this "can be an expensive operation".
There is no new keyword and no this, and constructors such as String() and Number() are not available.
The code is the body of a function with one parameter, data, which holds the values entered in the template's fields.

The full list of available APIs, from sendPixel and injectScript to the consent APIs, is on Google's custom template APIs page. The consent APIs are covered in our GTM consent guide.

Permissions

Permissions are what make templates safer to review than Custom HTML. Google says each permission is checked by the APIs that need it, and lists two more properties: "Automatically detected in sandboxed JavaScript, based on what APIs are used" and "Editable in the custom template editor, to make the permission more specific." When you save a template, Tag Manager loads the permissions it detected into the Permissions tab.

Some of the web permissions Google lists:

Permission ID	Shown as	What to check when you review it
send_pixel	Sends pixels	Which domains data is sent to
inject_script	Injects scripts	Which script URLs it may load
inject_hidden_iframe	Injects hidden iframes	Which iframe URLs it may load
get_cookies / set_cookies	Reads cookie value(s) / Sets a cookie	Which cookie names
access_globals	Accesses global variables	Which window keys, and read, write or execute
read_data_layer / write_data_layer	Reads data layer / Writes data layer	Which data layer keys
get_url	Reads URL	Which parts of the page URL
access_local_storage	Accesses local storage	Which keys (no wildcards)

The last column is our reading guide, not Google's text. Where a template sends data, Google says "you must specify an Allowed URL Match Pattern" and that if the URL in the code doesn't match, the call fails. A pattern "must use HTTPS and specify both host and path patterns", and a pattern with nothing after the slash, such as https://example.com/, "is treated as ending in a wildcard". A gallery tag that may send pixels or load scripts from a whole family of domains deserves a closer look than one locked to a single vendor endpoint.

Policies and allowlists on the page

Permissions are set inside the container. A site owner can also add rules in the page code that every container must pass. Google's policies page explains that these are set with gtag('policy', ...), for a single permission such as inject_script or for 'all', and that "A policy function rejects a permission request when it returns false or throws an exception." Errors thrown this way show in the debug pane in preview mode.

Google adds a warning for strict setups: with a "deny-all" policy, "your Google tag and Tag Manager containers won't send measurement pings" unless read_event_data, read_container_data and configure_google_tags are allowed. Policies can differ from page to page, so check pages behind a login too.

The older method is gtm.allowlist and gtm.blocklist in the data layer. Google now says installations "should upgrade to custom templates and implement template policies instead". One detail catches people out: template code "is implicitly blocked on any page that blocklists any class of tag or variable", unless sandboxedScripts is added to the allowlist. If gallery tags stop working on a site with a blocklist, check that first.

Sharing and publishing a template

To reuse a template in another container, open it in the Template Editor, use the More Actions menu and choose Export. In the other container, create a new template and choose Import to load the .tpl file.

Vendors who want a template in the public gallery follow Google's submission steps. The template must be built and "thoroughly tested", the author must accept the gallery's Terms of Service in the Info tab, and the GitHub repository needs template.tpl, metadata.yaml and a LICENSE file (Apache 2.0) at its root, with one template per repository on the main branch. The template is then submitted through the gallery's Submit Template option. Updates are released by adding a commit SHA and change notes to metadata.yaml; Google says the update appears "typically within 2 to 3 days". Each gallery entry links to the repository's Issues section, which is where users report bugs.

How we use templates

This is our own practice, not Google guidance:

We look for a vendor's gallery template before writing a Custom HTML tag, and we prefer templates published by the vendor itself.
Before clicking Add, we read the permissions and the GitHub repository's recent issues, and note the template's source in the tag's notes.
We don't edit gallery templates, so updates keep arriving. If a change is needed, we export a copy under a new name and treat it as our own code.
Template updates are tested in preview and published as their own version with a clear description.

Frequently asked questions

What is the difference between a custom template and a Custom HTML tag?

A Custom HTML tag runs any code pasted into it. A custom template runs sandboxed JavaScript that can only use Google's template APIs, and every action it takes needs a permission that is shown in the template and can be limited, for example to certain domains.

Are Community Template Gallery templates made by Google?

No. Google says the content in the gallery is provided by third-party developers and makes no promises about the performance, quality or content of those templates. Review the permissions and the publisher before you add one.

How do I update a gallery template in GTM?

When an update is available, a notification bar appears in the container. Click View, pick the template, compare the versions and click Accept update. Field values are kept. Then test and publish the container so the update goes live.

Can I edit a template I added from the gallery?

Yes, in the template editor, but Google advises great caution. A modified template no longer receives updates from its publisher. You can discard your changes and re-import it to get updates again.

Why are custom templates not running on my site?

One common cause is a gtm.blocklist on the page: template code is blocked on any page that blocklists any class of tag or variable unless sandboxedScripts is allowlisted. A gtag policy that rejects a permission also stops the template, and the error shows in preview mode.

For more on tagging, see our guides to GTM triggers, the GTM data layer, GTM environments and server-side tagging.