dataLayer hygiene without guessing.
Audit the dataLayer pushes firing on your site, catch PII leakage, identify custom-event naming drift, and surface the variables GTM is already consuming.
The dataLayer is the substrate every tag reads from, and it's usually the least-documented part of an analytics stack. Two years in, nobody remembers which pushes are still used, which variables feed which tags, or whether the e-commerce object still matches the ecommerce schema GA4 expects. Worse: developers regularly push PII into the dataLayer — email addresses in a `user_email` field, hashed-but-not-really user IDs, phone numbers in query parameters — and GTM dutifully ships it into GA4, creating a compliance problem nobody flagged.
- Inventories every variable the GTM container reads from dataLayer — including custom Data Layer Variables and built-in variables with dataLayer dependencies.
- Flags the PII-risk pattern: variables that read fields matching email/phone/full-name patterns, or URL parameters commonly used for auth redirects.
- Cross-checks your e-commerce dataLayer structure against the GA4 enhanced e-commerce schema. Identifies schema drift (camelCase vs snake_case, array-of-products vs single-object) that silently breaks purchase tracking.
- Lists every custom event name pushed to dataLayer and flags naming inconsistencies (mix of snake_case and camelCase events is the #1 source of drift).
- Identifies orphan dataLayer pushes — events no GTM trigger listens for — so you can clean up dead instrumentation.
Data Layer Variable `user_email` reads an email address into GTM scope
Personal data (email) is being made available to every tag in the container via a standard Data Layer Variable. Any tag — including third-party marketing pixels you may not have reviewed — can read and exfiltrate this. This is a GDPR Art. 6 violation waiting to be found by an auditor. Severity: critical regardless of which tags currently use it.
Two fixes. (1) Stop pushing raw email to dataLayer at the source — hash it in JavaScript before push, using SHA-256. (2) Rename the variable to make intent clear (`user_email_hash`) and add a check constant to reject non-hashed values. The audit surfaces every tag currently reading this variable so you know the blast radius.
Hire a web analyst. Or install one.
dataLayer hygiene is one of 10 high-stakes chores the agent covers end-to-end. Your first audit is free — and the agent keeps watching every night, so the next time datalayer hygiene drifts, you hear it from us before it costs you.