A quarterly tag audit should confirm four things: what is live, who owns each tag, who can publish changes, and whether consent and data rules still hold. Remove any tag with no owner. One focused hour per container is usually enough once the first audit is done.
Why quarterly
Tags pile up. Campaigns end, agencies change, and pixels stay. Every leftover is code from a third party running on your pages. A regular review keeps the list honest and gives you something dated to show a customer, an auditor or your own leadership.
The checklist
| Area | Check | Evidence |
|---|---|---|
| Inventory | Compare the live page load to the container list | Dated export |
| Ownership | Each tag has a named owner and purpose | Owner column filled |
| Access | Review users and permission levels | User list with levels |
| Custom code | Re-read Custom HTML tags | Notes per tag |
| Data | Check built-in variables and URLs for personal data | Review notes |
| Consent | Run the three state test | Results saved |
| Headers | Check CSP reports and policy | Report summary |
| Vendors | Contracts and evidence on file | Vendor file |
| Cleanup | Remove or pause unclaimed tags | Change record |
Run it in five steps
- Export. Export the container list and take a network capture of the main pages. Use the inventory method.
- Reconcile. Anything loading that is not in the container is a surprise. Find its source.
- Ask owners. Send each owner a one line question: still needed, yes or no. No reply within a week means pause the tag.
- Review access. Use the publish access guide to prune users.
- Test and record. Run the consent test and save results with the date.
What to do with findings
Rank by risk. A script with no owner on a page with a form comes first. A duplicate analytics tag on a blog page comes later. Fix the first group within the week and schedule the second.
Make it routine
Put the audit on the calendar as a recurring event with named people. Keep the template in a shared place. After two cycles, the work shrinks because new tags arrive with an owner and purpose attached, which is the point of the release review.
Try it yourself
Click through it at your own pace, or open it full screen. An audit is a snapshot, so look at how monitoring fills the gaps between snapshots.
Quick check
Is quarterly often enough?
It is a floor. Also review after each major release and after any vendor incident.
What if nobody owns a tag?
Pause it, wait a short period for objections, and then remove it.
Where Safeguard fits
Safeguard's compliance and evidence automation can help keep dated review records, and its dependency scanning and SBOM cover bundled packages. A free scan takes a few minutes.
Sources
Last reviewed: 19 October 2026.
