A few years ago I was doing a security audit on a site and found this very problem. The marketing department had access to the Google Tag Manager account and added several (!) almost identical user tracking plug-ins. They were capturing all form fields, including credit card numbers, passwords, etc...

The documentation talked about how to block this capture but that involved a developer getting involved and the developers didn't even know about the plug-in.

Basically, don't add a third party service to any app or website without doing a secuity review, especially if marketing, product or UX have suggested it!