Most GTM containers start clean and drift. A new tag is added for a campaign, an old one is never removed, an agency adds its own, and a year later no one can say with confidence what is firing or why. The result is messy data, slower pages and conversions you cannot trust.
This checklist covers the mistakes we look for most often when reviewing a container. You can run through it yourself in an afternoon, and the findings usually point straight to what needs fixing first.
How to start the audit
Open the container and look at the overview, then the list of tags, triggers and variables. Make notes as you go. Next, open Preview mode and walk through your site as a visitor would: land on the home page, browse, submit a form, click a phone number and, for stores, add to cart and check out.
Compare what you see with what you expect. Every tag should have a business purpose you can state in one sentence. If you cannot explain a tag, it is a candidate for investigation, not for immediate deletion.
Duplicate GA4 tags and double installation
The most damaging problem is the same thing being measured twice. Two Google tag configurations for the same GA4 property send duplicate page views, which inflates traffic and distorts engagement metrics.
- More than one Google tag or GA4 configuration pointing to the same measurement ID.
- GA4 or the Google Ads tag hard-coded on the site and also added in GTM.
- The GTM container snippet itself installed twice, often by a theme and a plugin together.
- Several conversion tags counting the same action on different triggers.
Check the page source for repeated container snippets and use Preview mode to see whether any tag fires twice on one page. On a Shopify or WordPress site, also check apps and plugins that inject their own tracking.
Missing consent handling
If you have visitors from regions with strict privacy rules, or you simply want to respect user choices, tags need to follow consent. Look for whether a consent management platform is installed, whether it sets consent signals before tags load, and whether each tag has consent settings that match its purpose.
Marketing tags such as ad pixels should wait for advertising consent. Analytics tags should respect analytics consent. A common mistake is a banner that looks right but does not actually control tags, so test by declining consent in Preview mode and confirming the relevant tags do not fire. Laws vary by state and country, so have your legal adviser confirm your requirements.
Also check the default consent state. If tags are allowed to run before the visitor makes a choice, you may be collecting data you did not intend to. Consent settings are a part of your web design and privacy notice conversation, not only a technical one.
Tags firing on all pages
The All Pages trigger is convenient and overused. A conversion tag that fires on every page records a conversion for every visit, which can hide real performance and confuse ad platform bidding.
Review each tag and ask whether its trigger is as narrow as the purpose requires. Page view tags can fire everywhere. A purchase or lead conversion should fire only on the confirmed action. Remarketing and pixel tags should be limited to what you actually use. Fewer unnecessary tags also helps site speed, which supports your web development goals.
Naming, notes and housekeeping
A container without a naming convention becomes unreadable. Tags called Tag 1 or New Trigger copy tell you nothing. Pick a pattern and apply it everywhere, for example platform, type and detail, so a tag reads like GA4 Event Phone Click or Google Ads Conversion Lead Form.
- Tags, triggers and variables follow one naming pattern.
- Related items are grouped into folders.
- Paused or unused tags are removed after confirming nobody needs them.
- Every published version has a version name and a description explaining what changed and why.
Version notes are easy to skip and painful to miss. When something breaks, a clear history of changes lets you find the cause in minutes instead of days. A good note says what changed, who asked for it and how it was tested, in one or two lines.
Finish the audit by writing a short list of fixes in priority order: duplicates and consent first, then overly broad triggers, then naming and access clean-up. Fixing in that order protects your data quality before it improves tidiness.
Too many publishers and unclear access
Open the user management screen at both the account and container level. Look for former employees, past agencies and shared logins. Anyone with publish permission can change what runs on your site, so keep that group small and give people only the level they need, such as read or edit without publish.
Decide who approves and publishes changes, and write it down. If you want an outside review, our Tag Manager team can run a full audit and clean-up, and our analytics work can check that the resulting data is dependable.
Key takeaways
- Start with Preview mode and ask what each tag is for.
- Look first for duplicate GA4 tags and a container installed twice.
- Test consent by declining it and confirming the right tags stay quiet.
- Use clear names, folders, version notes and a short list of publishers.