Why audit at runtime instead of reviewing the tag manager?
Because the tag manager is a statement of intent, and the browser is the ground truth. Tags load other tags; vendors update their scripts remotely; templates inherit containers nobody remembers; plugins ship their own beacons. The only place all of it becomes visible is the network layer of a real page load. An audit that starts from the container answers "what did we configure"; an audit that starts from the browser answers "what actually happens" - and the difference between those answers is usually where the risk lives.
What does the audit actually examine?
| Layer | Question answered | Method |
|---|---|---|
| Tag inventory | Which scripts, pixels, and beacons execute on each template | Instrumented browser loads of every page template |
| Data flows | Which third parties receive requests, and what identifiers and context ride along | Request-level capture: hosts, parameters, payloads |
| Consent behavior | What changes between no interaction, reject, and accept | The same loads repeated per consent state, diffed |
| Sensitive-path exposure | Whether high-risk pages transmit context that identifies interest or intent | Page classification joined to the flow map |
| Cookies and storage | What persists on the visitor's device, set by whom, for how long | Storage snapshot per consent state |
What does an audit typically find?
Across engagements the same five findings recur: tags that fire before any consent interaction on pages where they should wait; third parties the team could not name from memory; identifiers - IPs, client IDs, occasionally form values - traveling in URLs and payloads; consent banners that visually toggle but change nothing on the wire; and orphan tags from ended campaigns and departed vendors, still transmitting to endpoints nobody monitors. None of these appear in a configuration review, because configuration is what everyone intended.
What "evidence-grade" means here: every finding is reproducible from the capture - dated, method-stated, and specific enough that an engineer can locate the tag and a lawyer can assess the exposure without interpreting screenshots of a dashboard.
What is the deliverable?
Three documents that share one dataset. A flow map: every page template, every outbound request, every recipient, per consent state. A findings register: each issue with its evidence, its risk class, and its remediation. And an executive summary written for the meeting where marketing, legal, and privacy are in the same room - because the audit's real product is that meeting getting shorter.
How is a pixel audit different?
A pixel audit is the same discipline scoped to advertising pixels specifically - what each ad platform's tag receives, on which pages, under which consent state. It is the right scope when the concern is a specific platform; the full tracking audit is the right scope when the honest answer to "what is on the site" is a guess.