Purchase events that carry no revenue. A GA4 purchase tag set up without e-commerce data and without explicit value and currency parameters still counts purchases — they just arrive worth nothing. Revenue reports and ROAS read zero while the event count looks perfectly healthy, which is why this one survives for months.
Duplicate event tags. Two live tags firing the same event name is the classic double-count: one added by a developer, one by a marketer, neither aware of the other. It inflates conversions and teaches ad platforms to bid on traffic that never converted.
Ad pixels with no consent gate. Google’s own tag templates get built-in Consent Mode handling whether or not the container configures it. A pixel hand-rolled into a Custom HTML tag gets none of that — it fires exactly when its trigger says, including for visitors who refused tracking.
The full list of checks, and what they can’t see, is in the scoring methodology.
A published GTM container is public by design. googletagmanager.com serves it to every visitor of every site that uses it, and the container ID appears in page source. This tool reads exactly what a browser reads — it does not use the GTM API, needs no authorisation, and cannot see draft or unpublished workspaces.
It appears at the top right of the Google Tag Manager interface in the form GTM-XXXXXXX, and in the snippet installed on the site. On any live site you can view the page source and search for "GTM-".
Google returns a valid-looking script for unknown container IDs, so an empty result means one of three things: the ID does not exist, the container has never been published, or it genuinely has no tags. A workspace with unpublished changes reads as empty until you publish a version.
It reads the published container only. It cannot see unpublished workspaces, cannot tell you whether a tag actually fired on a real page load, and cannot evaluate triggers that depend on runtime dataLayer values. For whether tracking works on a live page, audit the URL instead.
This reads configuration. To see whether tracking actually works on a live page — consent signals, PII leaks, duplicate pixels, and whether tags survive past the homepage — audit the URL.
