Waftr.com
Two analysts reviewing a Google Tag Manager container during a GTM audit, pointing at a failing remarketing tag
Part of the Tracking Audit

GTM audit: every tag, trigger and consent check traced

A GTM audit traces every tag, trigger and consent check in your Google Tag Manager container on live pages, in all three banner states. Read-only, 7 business days, each fault ranked by its effect on conversions.

Free GA4 audit42 checks · report by email
Or book a 30-minute call

No login and no account access. We email you the report and may follow up about fixing what we find. Privacy policy.

The full GTM audit: 7 business days, read-only, findings in a Google Sheet. Start it here

Container teardown

What does a GTM audit find? Four faults from two real containers

Four faults from two Waftr engagements, a GA4 audit and a consent Build, laid out as one container. Pick a fault to see where it sits, what it cost and the test that exposed it.

Reconstructed from the SaaS GA4 audit and NexTranslate cases. Tag names are illustrative; faults and results are as published.

GTM-XXXXXXXWeb container, reconstructed from two audits
Illustrative
Tags in the reconstructed container, with firing trigger, consent setting and status as found and after the Build
TagFiring triggerConsentStatus
Consent - Cookiebot CMPCookiebot CMP template
Not in the containerConsent Initialization - All Pagesn/aMissingSets every signal to denied
GA4 - Google tagGoogle tag
All PagesInitialization - All PagesNot setBuilt-in checksFires before a choiceWaits for Accept
GA4 - first eventGA4 event
All PagesNot setBuilt-in checksStarts visits without key dataRebuilt in the Build
Google Ads - RemarketingGoogle Ads remarketing
All PagesNot setBuilt-in checksFires before a choiceWaits for Accept
Meta Pixel - PageViewCustom HTML
All PagesCE - consent updateNot setRequires ad_storageFires before a choiceWaits for Accept
GA4 - Event - generate_leadGA4 event
Form - ContactBuilt-in checksNever firesFires on each test submit
Triggers
  • Consent Initialization - All PagesNothing attachedRuns the CMP before anything else
  • All PagesFour tags, none waits for consentGoogle tags read consent; the Pixel moved off
  • CE - consent updateNot in the containerFires the Pixel after Accept
  • Form - ContactSilent on test submitsFires once per real submit
  1. NexTranslate

    GA4 and Google Ads fired before the visitor chose

    What it cost
    Every visit reached Google before a choice existed, including visitors about to click Reject.
    How the audit catches it
    Fresh browser, banner untouched, Tag Assistant connected; both tags fire on Container Loaded with no Consent event before them.
    After the Build
    Cookiebot and Consent Mode v2 set the defaults first, and 100% of tags now wait for consent. Read the NexTranslate case study
  2. NexTranslate

    The Meta Pixel fired before the visitor chose

    What it cost
    Meta received page views and wrote _fbp for visitors who agreed to nothing; Consent Mode v2 does not govern Meta's tag.
    How the audit catches it
    With the banner untouched, filter DevTools Network for facebook.com/tr.
    After the Build
    Tag Manager holds the Pixel until Accept, confirmed by test.
  3. SaaS company

    A broken first event

    What it cost
    GA4 started each visit without the data later reports rely on, one of two causes of the GA4 and CRM gap.
    How the audit catches it
    Read the first GA4 hit in Preview against the measurement plan.
    After the Build
    Tag Manager reworked and GA4 settings cleaned.
  4. SaaS company

    Form tags that never fired

    What it cost
    The CRM received every lead while GA4 saw none, and converters never joined their remarketing audiences.
    How the audit catches it
    Submit a test form in Preview; the form tag sits under Tags Not Fired.
    After the Build
    Form tracking fixed, and remarketing conversions rose 20% on the rebuilt audiences. Read the SaaS GA4 audit case study
GTM audit checklist

What does a GTM audit check?

Six areas, each tested on live pages with the banner untouched, rejected and accepted. Every fault goes into the findings Sheet with evidence, the conversions it distorts and the fix.

  1. Container health

    • The snippet loads on every template, high in the head
    • One container per page, with no hard-coded gtag.js beside it
    • No orphaned containers left by past agencies

    Evidence in the SheetTemplate list with the containers each page loads

  2. Triggers and firing order

    • The first GA4 hit on a landing page carries the fields the plan names
    • Each conversion tag fires once on a real test submit
    • Consent Initialization runs the CMP and nothing else

    Evidence in the SheetFiring timeline per template, early and silent tags flagged

    Caught in the teardown

  3. Duplicate and dead tags

    • Two GA4 configurations, or a purchase sent twice
    • Paused tags and triggers from campaigns that ended

    Evidence in the SheetHits counted per event on a single page load

  4. Consent gating

    • Each tag mapped to the consent types it needs
    • Non-Google tags carry an additional consent check
    • Nothing leaves the browser before a choice
    • Reject still holds after a reload

    Evidence in the SheetRequest log for no choice, Reject and Accept

    Caught in the teardown

  5. Custom HTML and security

    • Scripts that call outside domains, listed with an owner
    • document.write calls and code a gallery template can replace

    Evidence in the SheetScript list with the domain each one calls

  6. Naming and versioning

    • Names that follow one convention
    • Version notes that say what changed and why
    • Publish rights held by the people who should have them

    Evidence in the SheetAccess list and a read of the version history

Firing order

Why does tag firing order matter in Google Tag Manager?

A tag reads consent and the data layer as they stand when it fires. Tag Manager runs built-in triggers in a fixed order, and the audit checks that each tag sits in the slot its inputs need.

  1. Consent Initialization

    gtm.init_consent

    The consent platform's tag, before every other trigger.

    Audit flagA CMP on a later trigger, or other tags sharing this slot.

  2. Initialization

    gtm.init

    The Google tag, ahead of GA4 event tags.

    Audit flagGA4 event tags that fire before the Google tag has loaded.

  3. Container Loaded

    gtm.js

    Page view tags, held where consent is needed.

    Audit flagAd pixels firing here with no consent check.

  4. DOM Ready

    gtm.dom

    Tags that read page elements.

    Audit flagElement variables read earlier than this, returning empty values.

  5. Window Loaded

    gtm.load

    Optional scripts such as chat widgets.

    Audit flagOptional scripts competing with the page on Container Loaded.

  6. Custom event

    generate_lead

    Conversions, on the push that carries their values.

    Audit flagConversion tags on button clicks that also fire when the form fails validation.

Two analysts comparing a Google Tag Manager container with the findings Google Sheet from a GTM audit
Audit ruleRead-only, start to finishNo publish to your container while the audit runs.
Seven business days

How does a GTM audit run in seven business days on read-only access?

  1. Day 1

    Access and scope

    Read access lands. A kickoff call agrees the containers, templates and regions in scope.

  2. Days 1 to 5

    Map and test

    Each container mapped tag by tag, then tested in Preview and Tag Assistant on live templates in all three banner states.

  3. Days 6 and 7

    Rank and walk through

    Faults ranked by their effect on reported conversions and each fix costed, then the day 7 walkthrough.

You keep
  • Findings Google Sheet
  • Google Slides walkthrough
  • Costed fix plan
  • Walkthrough call
When to audit

Which containers need a Google Tag Manager audit?

Container history matters more than industry or size. These four histories drift furthest.

  • Inherited from agencies

    Years of publishes from contractors who have moved on. Nobody owns the naming, and nobody can say why half the tags exist.

    Checked firstNaming and versioning

  • A release moved the numbers

    New templates went live without the snippet, or with triggers that miss their URLs and events.

    Checked firstContainer health

  • A new banner went live

    The banner shows. Nobody has watched what fires in the seconds before a visitor clicks it.

    Checked firstConsent gating

  • Server-side tagging is next

    Audit first, and old misfires stay out of the new server container when you move to server-side tracking.

    Checked firstDuplicate and dead tags
Start the audit

Put your container through the same teardown

The GTM audit runs inside the Tracking Audit, next to GA4, consent and Google Ads checks, quoted after a short call or the free scan. How the Audit fee is credited

Access to grant on day 1
  • Google Tag ManagerRead, on each container in scope
  • GA4Viewer on the property
  • Google AdsRead only
  • Consent platformA viewer login, where it offers one

Want the fixes carried out as well? GTM consulting is the Build that does it, and the Google Analytics audit covers the GA4 side of the same Audit.

Certified in Google Analytics, Google Tag Manager and OneTrust · 13 years in digital analytics

Start my GTM audit

Name the site and the container that worries you.

Add your name so the scope reaches the right person.
The read-access invite needs a valid work address.

What happens next: a reply within one business day with the scope, a written quote and the first open start date.

FAQ

Before your GTM audit starts

Scope, access, timing and the quote, answered for the person who has to approve the access request.

Not ready to grant access?Run the free scan
What is on a GTM audit checklist?
A GTM audit checklist covers six areas: container health, triggers and firing order, duplicate and dead tags, consent gating, custom HTML and security, and naming and versioning. Each is tested on live pages with the banner untouched, rejected and accepted, and every fault is logged with the evidence a developer needs to reproduce it.
How much does a GTM audit cost?
The GTM audit is quoted as part of the Tracking Audit, after a short call or the free scan. The quote depends on the number of containers and GA4 properties, any server-side container and the consent regions in scope. It is fixed in writing, and the fee is credited against a Tracking Build started within 30 days.
How long does a GTM container audit take?
A GTM container audit takes 7 business days from the day read access arrives. Day 1 covers access and scope, days 1 to 5 map the container and test its tags on live templates, and days 6 and 7 rank the faults, cost the fixes and end with a walkthrough call.
Do you need publish access to our GTM container?
No. A GTM audit needs read access to Google Tag Manager, GA4 and Google Ads, plus a viewer login for the consent platform where it offers one. Nothing is published to the container during the audit. Publish rights come up only later, in a workspace your team can watch, if you choose a Tracking Build.
Does a GTM audit check tags that fire before consent?
Yes. Consent gating is one of the six areas of a GTM audit. Each page is loaded with the banner untouched, then after Reject and after Accept, with requests and cookies captured. Tags with no consent check, and tags that fire before the defaults exist, both show up. The fix is a Consent Mode v2 setup that sets defaults first.
Can you audit server-side GTM containers?
Yes. A server container is reviewed alongside the web container that feeds it: clients, the transport URL, first-party domain routing, server tags and the consent signals passed on from the web side. Auditing before a move to server-side tracking also keeps old misfires and duplicates out of the new server container.
Is an automated GTM audit tool enough?
As a first pass, yes. Tools that read a container export catch unused tags and naming drift. They cannot see what fires on real pages, in which order, or before consent, and a form tag that never fires looks valid in an export. A human-led GTM audit tests behavior live and ties each fault to the conversions it bends.
What is the difference between a GTM audit and GTM consulting?
A GTM audit is read-only. It finds the faults in your container in 7 business days, ranks them and costs the fixes, and changes nothing. GTM consulting is the Tracking Build that rebuilds the container from a data layer spec, a naming blueprint and a consent map. Running the audit first turns its findings into the Build scope.