The free GTM audit tool

Containers accumulate. A tag gets added for a two-week campaign and never removed. A trigger is duplicated because nobody could find the original. A contractor leaves behind a Custom HTML tag that nobody wants to touch. Three years later the container has 87 tags, roughly 60 of which matter, and no one can say which 27 are safe to delete.

A GTM audit is the systematic pass that answers that question. It is also the fastest way to find the two categories of problem that actually cost money: consent wiring that does not do what you think, and tags that fire twice.

The five areas the audit covers

Configuration hygiene

Duplicate tags firing on the same trigger, orphaned triggers attached to nothing, variables no tag references, paused tags still sitting in the published version, and naming conventions that have drifted apart. This is the bulk of the findings in most containers and the easiest to act on.

Consent Mode v2

Whether a consent initialization trigger exists, whether tags that need consent are gated on it, whether default consent states are set before any measurement tag fires, and whether ad_user_data and ad_personalization are handled. Getting this wrong means either lost data or a compliance exposure — and the container looks identical either way.

Ecommerce tracking

Whether the ecommerce dataLayer variables exist, whether the funnel events are all wired, and whether the items array is being passed through rather than reconstructed. Half-implemented ecommerce is very common: purchase works, begin_checkout was never finished.

Security

Custom HTML tags with unrestricted script access, tags injecting third-party scripts from domains nobody recognises, and variables that read from URL parameters straight into the DOM. A GTM container is a script-injection surface with publish rights spread across a marketing team — it deserves the same scrutiny as production code.

MarTech stack inventory

Every vendor the container talks to, derived from the tag templates in use. This is often the single most useful output for a new client: a list of what is actually deployed, which regularly includes two analytics platforms nobody mentioned and a heatmap tool that was cancelled last year.

Server-side containers are audited too

Server-side GTM has its own failure modes, and most audit checklists ignore it entirely. Tagfire audits server containers as a first-class case, covering clients (what claims incoming requests), transformations (what mutates event data before tags see it), and the tags that forward data onward. The common findings are a client that claims more request paths than intended, and transformations applied globally when they were meant to be scoped.

If you run a hybrid setup — web container feeding a server container — audit both. Data loss in hybrid setups almost always happens at the handoff, not inside either container.

The findings that matter most

1. 01

   A second GA4 configuration tag on All Pages

   Two config tags means two page_view events, doubled session counts, and a bounce rate that looks suspiciously good. It usually happens when someone migrates from a hard-coded gtag snippet to GTM without removing the snippet, so the audit checks both the container and what the page itself loads.

2. 02

   Consent gating that is not actually gating

   A tag set to "require additional consent" for a consent type that no CMP ever sets will simply never fire. The inverse — a measurement tag with no consent requirement in a market that needs one — fires when it should not. Both look correct in the interface.

3. 03

   Custom HTML with unrestricted access

   GTM lets you restrict which tag types can run. A container with no restrictions and several Custom HTML tags means anyone with publish rights can execute arbitrary JavaScript on every page of the site. Most teams have never opened that settings screen.

4. 04

   Triggers that reference stale dataLayer events

   A trigger listens for checkout_step, but the site now pushes begin_checkout. The tag never fires, the trigger looks fine, and nothing in GTM warns you. The audit cross-references trigger conditions against the events your tags actually reference.

5. 05

   Dead weight in the published version

   Paused tags, orphaned triggers, and unused variables do not break anything, but they make the container unreadable — and an unreadable container is why the previous four problems went unnoticed. Clearing them is the cheapest reliability improvement available.

Audit, visualize, then verify

An audit gives you a list. A dependency graph gives you the shape. The free GTM visualizer turns a container export into an interactive map of what triggers what, which is how you find the tag chain nobody could explain in a meeting. Use them together: the audit tells you which 9 things are wrong, the graph tells you what breaks if you delete them.

Neither one proves a tag actually fires in a real browser, though. Configuration can be perfect while a consent banner blocks everything downstream. That final confirmation is a runtime question — see the GA4 tag debugger for watching hits fire live, and the payload decoder for reading what a single request actually carried.