Loading.
Loading.
Audit the dataLayer pushes firing on your site, catch PII leakage, identify custom-event naming drift, and surface the variables GTM is already consuming.
The dataLayer is the substrate every tag reads from, and it's usually the least-documented part of an analytics stack. Two years in, nobody remembers which pushes are still used, which variables feed which tags, or whether the e-commerce object still matches the ecommerce schema GA4 expects. Worse: developers regularly push PII into the dataLayer — email addresses in a `user_email` field, hashed-but-not-really user IDs, phone numbers in query parameters — and GTM dutifully ships it into GA4, creating a compliance problem nobody flagged.
GTM-VAR-01Data Layer Variable inventoryGTM-VAR-03PII-risk variable patternsGA4-PRV-01PII in URL parameters scanGA4-MSR-09Custom event naming consistencyGA4-ECM-02Enhanced ecommerce schema conformancePersonal data (email) is being made available to every tag in the container via a standard Data Layer Variable. Any tag — including third-party marketing pixels you may not have reviewed — can read and exfiltrate this. This is a GDPR Art. 6 violation waiting to be found by an auditor. Severity: critical regardless of which tags currently use it.
Two fixes. (1) Stop pushing raw email to dataLayer at the source — hash it in JavaScript before push, using SHA-256. (2) Rename the variable to make intent clear (`user_email_hash`) and add a check constant to reject non-hashed values. The audit surfaces every tag currently reading this variable so you know the blast radius.
dataLayer hygiene is one of 6 high-stakes chores the audit covers end-to-end. Your first audit is free, takes 60 seconds, and catches what your setup has been quietly getting wrong.