GTM Audit Checklist: 30 Things Every Container Should Get Right

Why GTM Containers Need Regular Auditing

GTM containers accumulate technical debt faster than most codebases. Tags get added by multiple team members, triggers proliferate without documentation, variables go unused after a campaign ends, and security risks appear when Custom HTML tags are added without review. A proper Google Tag Manager audit is essential for any live container.

Container Structure (1–6)

1. Naming conventions consistent: all tags, triggers, and variables follow a clear naming pattern (e.g. [Type] - [Platform] - [Description]). No "New Tag 1" or "test copy".
2. Tags have descriptions: every tag has a notes field explaining what it does, when it was added, and why.
3. No orphaned or paused tags: remove or delete tags that have been paused for over 90 days without a documented reason for keeping them.
4. No duplicate tags: search for tags with identical Conversion IDs/Pixel IDs or overlapping triggers that fire the same tracking code twice.
5. Folders used for organisation: tags are organised into folders by category (GA4, Google Ads, Meta, etc.) for navigability.
6. Version history clean and described: every published version has a description explaining what changed. Versions published without descriptions make rollback and debugging harder.

Tags (7–13)

7. Google tag (gtag) present and correctly configured: a single Google tag handles the global site tag function. Multiple conflicting Google tags are a common source of duplicate conversions.
8. All active conversion tags have correct IDs and Labels: cross-reference each Google Ads conversion tag against the Google Ads conversion actions list to confirm IDs match.
9. Dynamic values populated correctly: conversion value, transaction ID, and currency variables are mapped to data layer variables — not hardcoded.
10. Tag sequencing used where needed: where one tag must fire before another (e.g. GA4 config before GA4 event), tag sequencing is configured.
11. No Custom HTML tags running unknown code: each Custom HTML tag is documented, its source is known, and it has been reviewed for security risks.
12. Tag firing priority set where appropriate: tags that must fire in a specific order use priority settings.
13. Consent Mode integration in tags: tags that require consent (ad tags, analytics tags) have consent checks configured so they only fire when appropriate consent is granted.

Triggers (14–19)

14. No "All Pages" trigger on conversion tags: conversion tags should never use "All Pages" as a trigger. Each should use a specific page URL, click, or custom event trigger.
15. Page URL triggers are specific: triggers using page URL conditions use "contains" or "equals" appropriately — "contains /thank" could accidentally match /thanksgiving or /thanks-for-nothing.
16. Custom event triggers match data layer events exactly: event names in triggers are case-sensitive and must match the dataLayer.push event name character-for-character.
17. No trigger fires on page load for form submission events: form submission should trigger on form submit event, not on page load of the form page.
18. Trigger exceptions configured where needed: internal traffic or test pages excluded from conversion triggers using appropriate exceptions.
19. Click triggers use specific selectors: click triggers target specific elements (by ID, class, or CSS selector) rather than "All Clicks".

Variables (20–24)

20. No unused variables: variables not referenced by any active tag or trigger should be removed to reduce container clutter.
21. Data Layer Variables correctly named: DLV names match exactly (case-sensitive) the keys pushed in the data layer by the website.
22. Built-in variables enabled only as needed: only enable built-in variables actually used by tags or triggers. Unnecessary enabled variables add container weight.
23. Lookup Tables and Regex Tables tested: if lookup or regex table variables are used, verify they return expected values for representative inputs.
24. Cookie variables work across domains if applicable: if cross-domain tracking is in use, cookie variables correctly read first-party cookies on all domains.

Data Layer (25–27)

25. Data layer present before GTM container loads: the window.dataLayer = window.dataLayer || []; initialisation exists before the GTM snippet in the page head. If GTM loads before the data layer initialisation, data layer pushes on page load may be missed.
26. Ecommerce data layer pushes match GTM variable mapping: data layer keys (e.g. ecommerce.transaction_id, ecommerce.value) match exactly the Data Layer Variable names configured in GTM.
27. SPA virtual pageviews handled: if the site is a single-page application (React, Vue, Angular), GTM has a History Change trigger or custom event trigger for virtual page navigation.

Security and Compliance (28–30)

28. User access levels appropriate: in GTM container user management, check that only authorised users have Publish access. Contributors should have Edit or Read access only.
29. No sensitive data in the data layer: confirm no unhashed PII (raw email addresses, phone numbers, passwords, payment card data) is being pushed to the data layer where it could be read by any Custom HTML tag.
30. Consent Mode v2 implemented: the container has a Consent Mode v2 configuration that signals consent status to Google tags before they fire, in compliance with EU requirements.

Summary

Run through this 30-point checklist for any container you inherit or manage. Most containers have 5-10 items that need attention. The issues that cause the most damage are always the silent ones: duplicate tags, unused but primary-set conversion actions, and data layer mismatches.

For a professional GTM audit, see our Google Tag Manager Setup and Audit service.

Need a GTM audit? Contact Adslytics.