container audit

GTM-KJFRF6Q

9 tags, 1 custom scripts, 4 third-party hosts — an ordinary container, near the middle of what we measure (median: 39 tags, 4 custom scripts).

1 custom HTML tag carrying 0 KB of JavaScript. This runs on every page the container loads on.
4 third-party hosts reachable from its tags.

Tags9

Custom scripts1

Third parties4

Delivered422 KB

Versions10

What we observed

A real browser loaded klar.mx a month ago and recorded every request it made. This is what happened, as distinct from what the container is configured to do. It is one page load — anything that fires only deeper in the site did not fire here.

Container loaded from googletagmanager.com — Google

Measurement sent to www.klar.mx — not Google, at /g0lnomhfn3mgNjJmMjhkODZkZjA0Mzg1NzA2ZWUyM2Q3/ag/g/c

Measurement is first-party; the container still loads from Google. These are separate decisions, and this is the more common of the two.

Forwarded to GA4 ×10 — read from the measurement id, not the hostname

Consent a consent platform is present, but our browser could not complete the accept step — so the before-and-after comparison did not run here.

Third parties contacted 25 hosts — cdn.prod.website-files.com, cdn.jsdelivr.net, www.google.com, cdnjs.cloudflare.com, unpkg.com, d3e54v103j8qbb.cloudfront.net, www.gstatic.com, code.jquery.com, and 17 more

dataLayer events seen gtm.js, gtm.dom, gtm.load

Where the data goes

Confirmed — a browser watched this site send measurement data to www.klar.mx, not to Google. observed on klar.mx More info »

Findings

Ordered by consequence. review has a concrete cost when it bites; info is real but depends on your setup. Seen is how common it is across the containers we have measured — reported separately on purpose, because common and harmless are different claims.

reviewNo consent signal in the container (1)

Nothing in this container sets, reads, or gates on a consent state.

WhyThe container itself neither sets a Consent Mode default, holds any tag back for consent, nor references a known consent platform. Either enforcement lives entirely outside GTM — where it cannot be audited from here — or tags fire regardless of what a visitor chose.

CheckIf a consent platform blocks scripts before GTM loads, this is fine — confirm that is actually the case. If not, tags are firing on a choice nobody recorded.

Seenseen in 52.1% of 46,522 containers measured

Third parties it can reach

Each host is a party that can execute code or receive data in a visitor's browser. Follow one to see who else loads it. More info »

www.googleadservices.com ×6 googleads.g.doubleclick.net ×1 insight.adsrvr.org ×1 js.adsrvr.org ×1

What the custom templates can do

Custom templates are third-party code shipped inside the container. Injecting scripts and running page globals is ordinary for them — most tag templates need it to work — so this is an inventory, not a warning. It lists the capability each template declares so you can match it against templates you meant to install.

__cvt_32595066_19 private injects code from p.teads.tv · runs page-level globals

Detected on

Sites observed loading this container. A container used across many hosts is a shared template; one on a single host is a bespoke build. Follow a site to see every container it loads.

klar.mx

What this audit describes

Containers change. These findings describe one specific artifact, and you can re-fetch it to check this reading.

Container	`GTM-KJFRF6Q`
Published version	`10` — the identity of this configuration. It changes only when someone publishes.
Read at	2026-08-13 10:23:37 UTC (a month ago)
Source	`https://www.googletagmanager.com/gtm.js?id=GTM-KJFRF6Q`
Body checksum	`9d42cf6a98311d1b9ac5f145ca00c6e02c2ad5d7c2151ecf0eae95e947a199a1` Evidence of the exact bytes we read, not an identity: Google varies the response per request, so re-fetching an unchanged container yields a different checksum. Compare the published version instead.

Re-audit

This reading is from a month ago. A container can be republished at any time, and nothing here updates on its own — a fresh read is the only way to know whether it still says this. Running it again replaces this page in place, so the link keeps working.

Re-audit GTM-KJFRF6Q

Check another container

Put this container under version control. Tagora exports it to a repository you own, so every change arrives as a pull request. How it works »