Google Tag Manager: 7 Setup Mistakes, Causes, and a Checklist

Google Tag Manager (GTM) is a highly convenient tool for marketers, allowing you to deploy tracking code quickly without a developer's help. However, that flexibility is also a double-edged sword.

Source: Google

On many websites, increasingly complex configurations and a proliferation of tags have created an unmanageable state of chaos that no one fully understands. When helping teams manage GTM containers, we often discover configuration errors.

This article explains seven particularly critical GTM setup mistakes and specific ways to address them. Each mistake includes a "Before" example of a common failure and an "After" example of the correct setup, so compare them with your own GTM container as you read.

Mistake 1: treating GTM as just a tool for installing tags

At its core, GTM is a framework for moving data with proper governance. Treating it as a simple tag installation tool allows tags to accumulate haphazardly in your container until it becomes unmanageable.

A common misconception

The most common misconception when adopting GTM is that it is simply a convenient tool for pasting in tags. If you start using it with that understanding, tags will accumulate haphazardly in your container. Within a few months, you may no longer know what is firing where.

To understand GTM correctly, you need to understand the relationship between tags, triggers, and variables.

How tags, triggers, and variables relate

Only when these three elements work together correctly does meaningful data reach the right destination at the right time.

Before / after

Before (common mistake):

Every tag is tied to the "All Pages" trigger, causing large numbers of tags to fire even on pages where they are not needed. Variables are barely used, so the data lacks the detail needed for meaningful analysis.

After (correct setup):

Each tag has an appropriate trigger and fires only on the pages where it is needed. Variables are defined for their intended purposes, making it clear what data is being sent.

2026 update: improved GTM diagnostics

GTM includes improved diagnostics that let you check the health of the tags in your container. In Preview mode within the GTM interface, it is now easier to find issues such as unused tags, duplicate triggers, and tags that affect performance.

Run diagnostics in Preview mode once a quarter to keep your container healthy.

1. Open your GTM container and list every tag and its associated triggers.

2. Identify tags using the "All Pages" trigger and check whether they really need to fire on every page.

3. Document what data each tag sends, when it sends it, and where it goes.

4. Pause unnecessary tags rather than deleting them immediately, then monitor them for two weeks before deleting them.

Mistake 2: overlooking the data layer that underpins measurement

The data layer (dataLayer) is a structured intermediary layer that passes data between your website and GTM. It is the foundation that determines the accuracy of all your measurement.

Why the data layer matters

Despite this, many implementations put off designing the data layer because "it is working for now." This leads to inaccurate data and duplicate tracking.

The most dangerous mistake: overwriting dataLayer

The most serious GTM setup mistake involving the data layer is overwriting the array with dataLayer = [].

Before (common mistake):

dataLayer = [] completely overwrites the existing data layer initialized by the GTM snippet. As a result, all the data GTM has received up to that point is lost, and the connection to GTM is broken.

After (correct setup):

window.dataLayer = window.dataLayer || [] means "use the existing dataLayer if there is one; otherwise, create a new empty array." This keeps the connection to GTM intact.

Duplicate tracking when integrating GA4

When integrating GA4 with GTM, pay particular attention to duplicate tracking of key events, formerly called conversions.

Common patterns of duplicate tracking:

• Sending events through both GTM and GA4: A GA4 event tag is configured in GTM, but code that sends the same event through gtag.js remains in the website's code. The same event is counted twice.

• Duplicate GA4 configuration tags: Multiple GA4 configuration tags use the same measurement ID and fire on the same trigger. Page views are counted twice.

• Split sessions caused by incomplete cross-domain settings: Cross-domain settings between your domain and the payment domain are missing. A single purchase flow is counted as two sessions, splitting the conversion path.

Data layer naming conventions

Inconsistent data layer variable names create increasing confusion over time.

Before:

Multiple naming patterns are used for data representing the same concept, making variable configuration in GTM more complex.

After:

Standardize on snake_case to match GA4's recommended event parameters, and align the ecommerce object schema with GA4's specifications.

Action steps:

1. Search the source code across your site for dataLayer = [ to check for code that overwrites the data layer.

2. Check whether any directly embedded gtag.js code remains on your pages, and consolidate it in GTM.

3. Document your data layer naming conventions and share them with the development team.

4. Audit GA4 enhanced measurement and GTM event tags for overlap.

Mistake 3: managing containers without a plan

Without operating rules, a GTM container allows anyone to add tags haphazardly and can become unmanageable within six months.

What happens to a GTM container without operating rules

One of GTM's advantages is that anyone can easily add tags. The other side of that convenience is that anyone can add tags without any structure. Within six months, a GTM container without operating rules can end up in the following state.

• Tag names are inconsistent, such as "Tag 1," "Test," and "New_20260301."

• No one knows who added a tag or why.

• Tags for campaigns that are no longer needed remain in place.

• Published versions have no notes, so the history of changes cannot be traced.

• External ad agencies and former employees still have account permissions.

Before / after: naming conventions

Before (common state):

• Tag_New

• GA4Test

• Conversion_20260215

After (correct state):

• GA4_Settings_Main

• GoogleAds_Conversion_Purchase

• Facebook_Pixel_ViewContent

Recommended naming convention:

Platform_Type_Purpose

Consistent version management

GTM version management provides a change history for your website's measurement setup.

Permission management best practices

GTM permission levels:

Quarterly permission audit checklist:

• Are there any accounts belonging to employees who have left or changed roles?

• Are there any accounts belonging to ad agencies whose contracts have ended?

• Are permission levels appropriate, without unnecessarily high access?

• Is two-step verification enabled for every account?

1. Rename every tag in the container using the naming convention above.

2. Review the publication history for the last 10 versions. For any missing notes, contact the person responsible at the time and add them.

3. Export a list of account permissions and delete unnecessary accounts.

4. Summarize GTM operating rules in a one-page document and share it with the team.

Mistake 4: using Preview mode only to check whether tags fired

Use GTM's Preview mode (Tag Assistant) as a comprehensive tool for validating data accuracy and performance, as well as checking whether tags fire.

What Preview mode can really do

Many practitioners use GTM's Preview mode (Tag Assistant) only to check whether a tag fired. This uses just a fraction of its capabilities.

Validating your GTM setup properly requires the following two steps.

Step 1: check the GTM side in Preview mode

In Preview mode, you need to check more than whether a tag fired.

Before (common checking approach):
Only check that the tag is green and has fired.

After (correct checking approach):
Also verify the firing timing, the contents of the data sent, and whether the trigger conditions are appropriate.

Step 2: check the data in the receiving tool

Even if a tag fires correctly in GTM, validation is not complete until you confirm that the destination tool has received the data correctly.

For GA4:

1. Open "Reports" > "Realtime" in GA4.

2. Trigger an event in Preview mode.

3. Confirm that the event appears in the Realtime report.

4. Confirm that the event parameter values are correct.

5. Open "Admin" > "DebugView" to inspect more detailed event data.

For Google Ads:

1. Open "Tools and settings" > "Conversions" in Google Ads.

2. Confirm that the conversion action's "Status" changes from "No recent conversions" to "Recording conversions."

3. Confirm that the conversion ID and label are correct in the "Google Ads" section of Tag Assistant.

Using GA4 DebugView

GA4's DebugView is most useful when combined with GTM's Preview mode.

How to enable DebugView:

1. In GTM's GA4 configuration tag, add the debug_mode parameter (value: true).

2. Open "Admin" > "DebugView" in GA4.

3. Interact with your site in GTM's Preview mode.

4. Events appear in DebugView in real time.

Note: debug_mode is a parameter for validation. Be sure to remove it before publishing to production, or use a GTM lookup table variable to set it to true only in Preview mode.

1. Follow the two-step checking process above the next time you publish a tag.

2. Enable GA4 DebugView and make a habit of inspecting event data in detail.

3. Turn the validation process into a checklist and make it a required step before publishing.

4. Save screenshots of the validation results and share them with the team.

Mistake 5: using custom HTML tags without considering security risks

Custom HTML tags offer the greatest flexibility, but also carry security risks such as XSS attacks and data leaks. Prioritize GTM's template gallery and keep custom HTML use to a minimum.

The risks of custom HTML tags

Custom HTML tags are GTM's most flexible tag type, and also its most dangerous. Because they can execute arbitrary JavaScript, they carry the following risks.

• They can provide an entry point for cross-site scripting (XSS) attacks.

• Third-party scripts can leak data.

• They can slow down page loading.

• Code quality is difficult to manage (code review in the GTM interface is effectively impossible).

Before / after

Before (common state):

A custom HTML tag that loads an external script directly

This implementation has the following problems.

• You cannot control the contents of the external script, which the vendor may change.

• document.write or other global variables may be corrupted.

• It bypasses the Content Security Policy (CSP).

• It may fall outside GTM's control over tag firing order.

After (correct setup):

Use GTM's custom templates from the Community Template Gallery.

2026 update: expansion of the GTM Template Gallery

The number of templates in GTM's Community Template Gallery has increased substantially from 2025 to 2026. Many tools that previously required custom HTML tags can now be installed more safely through templates.

Common tools for which you should consider using templates:

• Chat tools (Intercom, Zendesk, HubSpot Chat)

• Heatmap tools (Hotjar, Microsoft Clarity)

• A/B testing tools (Optimizely, VWO, successors to Google Optimize)

• Customer data platforms (Segment, mParticle)

Rules for cases where custom HTML tags are unavoidable

If you must use a custom HTML tag, such as for a tool without a template, apply the following rules.

• Require code review: Before publishing a new or modified custom HTML tag, always have another person review the code.

• Minimize external script loading: Use self-contained inline code wherever possible.

• Never use document.write: It blocks page rendering and, in the worst case, can leave the page completely blank.

• Do not use innerHTML in GTM custom HTML tags: It increases the risk of XSS.

• Audit regularly: Review the list of custom HTML tags quarterly and delete those you no longer need.

1. List the custom HTML tags in your container, identify each tag's purpose, and check whether a template alternative exists.

2. Create a migration plan for tags that can be replaced with templates.

3. For each custom HTML tag you keep, record its purpose, who added it, and the date it was added in the tag's notes.

4. Establish a review process for adding or changing custom HTML tags.

Mistake 6: ignoring the impact on site performance

Each GTM tag consumes browser resources. Adding too many directly worsens Core Web Vitals (CWV) scores and business results.

Free tags do not mean you can add unlimited tags

GTM tags are free to add, but each one consumes browser resources such as CPU, memory, and network bandwidth when it runs. Loading too many tags directly slows pages down, especially on mobile devices, and worsens Core Web Vitals (CWV) scores. Optimizing your GTM setup directly affects business results as well as measurement accuracy.

Main factors that affect performance

Before / after: optimizing firing timing

Before (common mistake):
All tags fire at the earliest "Initialization" stage, interfering with the page's initial display.

After (correct setup):
Adjust firing timing according to each tag's priority.

Priority order for GTM tag firing timing:

1. Essential measurement (GA4, Google Ads conversions): Page View

2. User behavior analysis: DOM Ready

3. Marketing tools: Window Loaded

4. Support tools such as chat: Delayed or scroll triggers

Putting regular audits into practice

Quarterly audit checklist:

1. Export a list of all tags (review the "Tags" screen in GTM with no filters applied).

2. Check the following for each tag:

   • Is this tag still needed? Has it been left behind after a campaign ended?

   • Is the destination account still active?

   • Is there someone who can explain the tag's purpose?

3. Pause unnecessary tags, then delete them.

4. Measure the impact on performance.

• Compare PageSpeed Insights scores before and after publishing in GTM.

• Check tag execution times in the "Performance" tab of Chrome DevTools.

1. Measure your site's score in PageSpeed Insights now and record a baseline.

2. Check the number of tags in your GTM container. If there are many, prioritize an audit.

3. Review each tag's firing timing and adjust it according to the priorities above.

4. Add quarterly audits to your calendar.

Mistake 7: failing to adapt to the privacy era

In the privacy environment of 2026, the elimination of third-party cookies and stronger privacy regulations expose traditional GTM configurations to both legal risks and data loss.

The privacy environment in 2026

As of 2026, the web privacy environment has changed significantly.

• The phaseout of third-party cookies is underway.

• Privacy regulations are becoming stricter across countries (GDPR, Japan's amended Telecommunications Business Act, and state privacy laws).

• Users are more privacy-conscious, and ad blocker use is increasing.

• Google Consent Mode v2 has become mandatory (implementation is essential for sites targeting Europe).

GTM configurations that do not adapt to these changes face three problems: missing data, legal risks, and declining user trust.

Implementing Google Consent Mode v2

Google Consent Mode v2 automatically adjusts how Google tags behave based on a user's consent status. Since March 2024, implementation has been mandatory to receive data from users in the European Economic Area (EEA). Japanese sites also need to implement it if they operate globally.

Server-side GTM: becoming standard in 2026

Server-side GTM moves tag execution from the client side, in the browser, to a server you manage. Across the industry, adoption of server-side GTM is accelerating among medium-sized and larger sites.

Client-side vs. server-side comparison:

Cases where server-side GTM is particularly effective:

• High ad spend: It can substantially reduce missed conversion tracking caused by ad blockers.

• Ecommerce sites: Accurate purchase tracking directly supports ROAS optimization.

• Global sites: Integration with Consent Mode allows centralized privacy compliance management.

• Sites where page speed directly affects business: Moving tags to the server improves CWV scores.

Latest server-side GTM developments in 2026

Updates to watch:

• Enhanced first-party mode: Running server-side GTM on a subdomain of your own domain (e.g., sgtm.example.com) processes all requests in a first-party context.

• Simpler conversion API integration: Templates make it easy to integrate with conversion APIs from major ad platforms, such as Meta Conversions API and TikTok Events API.

• Improved Cloud Run autoscaling: More efficient scaling during traffic spikes makes cost optimization easier.

• More accurate event matching: Matching has improved between user identifiers assigned on the server and data held by ad platforms.

Before / after: privacy compliance

Before (common mistake):
A traditional setup that ignores privacy regulations

After (correct setup):
Consent Mode v2 implemented, migration to server-side completed, and an appropriate consent management platform (CMP) in place

Related reading

Online customer acquisition success stories and cost-effective tactics: Ecommerce and B2B practices

This article explains practical approaches to designing an overall online customer acquisition strategy, including ad operations.

1. Check whether your site serves European users. If it does, make implementing Consent Mode v2 your top priority.

2. Investigate the impact of missed conversion tracking caused by ad blockers by checking discrepancies between GA4 figures and those in your ad management interface.

3. Consider implementing server-side GTM if your monthly ad spend is high.

4. Select a CMP and develop an implementation plan.

When automating or improving the efficiency of ad operations, tools such as Cascade that help bring ad operations in-house can help you build more effective operating strategies based on the data collected through GTM.

Summary: checklist for seven critical GTM setup mistakes

Use the checklist below to assess your own setup against the seven GTM mistakes covered in this article.

Regularly checking these points and maintaining a healthy GTM setup enables accurate measurement and effective marketing. For companies working to improve the efficiency of their ad operations, proper GTM configuration is an important foundation for better results.

Alongside checking your tag settings, review how to exclude internal IP addresses in GA4 to keep internal traffic out of your measurements. For Shopify-specific implementation steps, also review considerations when implementing GTM on Shopify.

For steps to set up enhanced conversions in Google Tag Manager, see What are enhanced conversions? Setup steps and considerations for Google Ads and Microsoft Ads.

FAQ

How often should I review GTM permissions?

We recommend reviewing them quarterly, or once every three months. In particular, delete accounts belonging to employees who have left or changed roles, check the status of ad agency contracts, and verify that access follows the principle of granting only the minimum necessary permissions.

How much does server-side GTM cost to implement?

Google Cloud Run uses usage-based pricing, so costs vary with traffic volume and the number of tags you use. Costs are relatively modest for many small and medium-sized sites, but we recommend using the Google Cloud pricing calculator for an accurate estimate.

What are the minimum security measures if I cannot remove all custom HTML tags?

1. Require code review. 2. Minimize external script loading. 3. Prohibit document.write. 4. Avoid innerHTML. 5. Audit usage regularly. It is also important to record why each tag was added and who is responsible for it in the tag's notes.

What should I check if events do not appear in GA4 DebugView?

Check the following in order: 1. Is GTM's Preview mode enabled? 2. Has the debug_mode:true parameter been added to the GA4 configuration tag? 3. Have you selected the correct property in GA4 DebugView? 4. Is a browser ad blocker active?

Should data layer naming conventions also account for platforms other than GA4, such as Meta and TikTok?

We recommend using GA4's recommended parameters as a base and transforming variables for other platforms within GTM. For efficient management, standardize the data layer itself on GA4 and use GTM's variable features to map it to the appropriate format for each platform.