Short answer: a GTM audit covers five blocks: access and versions, tags and triggers, consent, the data layer and the platform connections. With the checklist below it takes about half an hour. Don’t change anything during the audit, note what you find and fix it afterwards in a separate workspace.
By the TrackLead team. Technically reviewed by Pieter. Updated: November 2026.
Before you start
Ask for user access with at least Read on the container, and preferably read access to GA4 and Google Ads too. Don’t change anything during the audit: first you want to know where things stand. Open the container, the live version under Versions and the site in Preview.
The checklist in five blocks
Access and versions
Who has Publish? Remove former staff and previous agencies.
Does the account belong to the client, not to a previous agency?
Which version is live and when was it published?
Are there unpublished changes in workspaces?
Tags, triggers and variables
Are there paused tags or tags without a trigger?
Is the Google tag or GA4 there twice, or is there still a separate gtag snippet on the site next to GTM?
Are there old Universal Analytics tags? They haven’t measured anything since July 2023.
Which Custom HTML tags are there, and does anyone still know what they are for?
Are there unused triggers and variables?
Consent
Does the consent platform fire on Consent Initialization?
Are ad_user_data and ad_personalization (Consent Mode v2) set?
Does every tag have the right consent in the consent overview?
Do tags really not fire after a decline, or only cookieless? Check it in Tag Assistant.
Data layer and ecommerce
Does the site send events through the dataLayer, or does GTM read text off the page?
Does purchase have a transaction_id, value, currency and items?
Does purchase arrive only once, also after refreshing the thank-you page?
Do the event names match GA4’s recommended events?
Platforms
Is the Conversion Linker on all pages?
Do the Google Ads conversion ID and label match the account?
Is enhanced conversions set up where possible?
Do the Meta Pixel and the Conversions API use the same event_id?
How to go about it
Go through the blocks in order and note for each point: fine, fix or investigate.
Click through the main route once in Preview: landing page, product or form, thank-you page. Check which tags fire at each step.
Then decline in the cookie banner and click through the same route again.
Put the findings in a short overview for the client: what works, what is duplicated or outdated, and what you fix first.
Fix things in a separate workspace and publish with a clear version name.
Starting from scratch with a client? Follow how to set up Google Tag Manager. Fix consent issues with Consent Mode v2 in GTM. No conversions in Google Ads? See the seven causes.
After the audit: the move to server-side
A tidy web container is the starting point for server-side tracking. What to sort out for that is in what to sort out before you start with server-side tracking.
With TrackLead you set up the implementation in your client’s own GTM, on the host you already use, with monitoring included. Take a look at tracklead.eu.
Frequently asked questions
How long does a GTM audit take?
With this checklist about half an hour for an average container. If you find problems, fixing them takes extra time.
How often should I audit a container?
With every new client, before you change anything, and then at least once a year or after a major site change.
Can I delete unused tags right away?
Pause them first and publish. If nobody misses anything after a few weeks, delete them. Every version is kept, so you can always roll back.
Should I audit before moving to server-side?
Yes. A server container forwards what the web container collects. Mistakes in the web container go along to the server.