GTM and sGTM audit: we check whether your conversions really reach Google and Meta

Google Tag Manager rarely breaks in a visible way. Conversions keep coming in, just fewer than they should; tags fire twice; and some events never leave the browser because they are blocked by consent, an ad blocker, or a tag routed to a server that does not handle it. Google Ads and Meta campaigns then optimize on incomplete data, and you pay for clicks whose value nobody measured.

After a few years and a few vendors, a container accumulates dead Universal Analytics tags, test IDs, unused variables and conversion scripts hard-coded in the page template that bypass both GTM and Consent Mode. A GTM audit cleans this up in a single pass.

What we check in the web container

• Inventory of tags, triggers and variables — what fires on which pages, what is dead, what is duplicated, which tags load third-party scripts outside your control.
• Consent Mode v2 — whether the default consent state is set before tags load, whether the update after the user's choice reaches Google, whether the banner blocks all of GTM (then Google receives no "denied" signals and cannot model conversions), and whether pixels fire before consent.
• Google Ads and GA4 conversions — IDs and labels, event value and currency, purchase deduplication, mapping of GA4 events to Google Ads goals, enhanced conversions.
• Personal data in events — whether email, phone or address are sent as plain parameters to Google Analytics (a violation of Google's policies), and at the same time whether they are passed in the proper hashed field for conversion matching.
• Scripts outside GTM — legacy conversion.js, pixels pasted into the template, shop plugins sending the same events a second time.
• Naming and hygiene — a consistent "platform – event" scheme, marking of disabled elements, removal of UA and test IDs.

What we check in the server container (sGTM)

• Clients and IDs — whether the GA4 client on the server handles every ID that web tags route to it (Google Ads, Floodlight, GA4). A missing entry means an empty server response and silent conversion loss.
• Server-side conversions — whether purchase and lead go to Google Ads, Floodlight and Meta Conversions API from the server or still from the browser; whether the event value is read from the right data field.
• Meta Conversions API — match quality (user data in user_data, not custom_data), deduplication with the pixel, debug mode switched off in production.
• Duplicated events — Meta-named events (ViewContent, InitiateCheckout) forwarded to GA4 alongside the standard view_item and begin_checkout.
• Consent on the server — which tags require which consents and whether they block events Google could otherwise model.
• Endpoints and domain — first-party tagging domain, loader, correct responses for every ID, cookie lifetime.

What you get after the audit

A report with issues split into critical (conversions not reaching the platform), important (incomplete or non-compliant data) and housekeeping. For every item we note what to change and what the effect will be. In parallel, we apply the fixes in a separate workspace inside your web and server containers. Nothing is published without your approval.

Publishing follows an agreed order: server container first, then web. The reverse order opens a window in which web tags route traffic to a server that does not yet handle the new IDs, and conversions from that window are lost. After publishing we verify the server responses for every ID and the first conversions in Google Ads.

Typical issues we find

• A Google Ads web tag routes traffic to the server, but the GA4 client on the server lacks that ID: the conversion script returns an empty response and conversions are not counted.
• The cookie banner blocks the entire GTM script instead of managing consent: Google receives no denial signals and cannot model missing conversions, while the Meta pixel loads without consent anyway.
• Raw email and phone sent as event parameters to GA4, while at the same time there is no matching data for Meta CAPI.
• An old conversion.js script pasted on every page of the shop: double-counted purchases and measurement outside consent.
• Floodlight with a sales tag only, no counter tag, so CM360 and DV360 do not see site traffic.
• A GA4 purchase requiring full advertising and analytics consent at once, so with partial consent not even a modelling ping goes out.

When needed, we combine the GTM and sGTM audit with a server-side tagging implementation, a GA4 implementation and a Google Ads account audit, so measurement and campaigns are checked as one system.