container audit

GTM-TSPN35RL

This container is published but empty — no tags, so nothing fires.

Tags0

Custom scripts0

Third parties0

Delivered315 KB

Versions1

What we observed

A real browser loaded hackney.gov.uk a month ago and recorded every request it made. This is what happened, as distinct from what the container is configured to do. It is one page load — anything that fires only deeper in the site did not fire here.

Container loaded from www.hackney.gov.uk — the site's own host, at /modules/contrib/google_tag/js/gtm.js rather than the default path, and googletagmanager.com

Measurement sent to google-analytics.com — Google

The container is self-hosted; the measurement still goes to Google. The first-party path that a tagging server provides is not being used for the data itself.

Consent Cookiebot answered its own API. 1 measurement hit left the page before it was granted, carrying a client id (whether that is permitted depends on jurisdiction, and this was not a European visit). no new hosts appeared after granting — either the tags are ungated, or they fire regardless and record the decision. Google recorded gcs=G111 (all granted).

Third parties contacted 17 hosts — consent.cookiebot.com, fonts.googleapis.com, cdn.jsdelivr.net, consentcdn.cookiebot.com, www.googletagmanager.com, cdn.gtranslate.net, static.hotjar.com, www.clarity.ms, and 9 more

dataLayer events seen gtm.js, gtm.dom, gtm.load, cookie_consent_preferences, cookie_consent_statistics, cookie_consent_marketing

Where the data goes

Not observed — on the page we loaded, measurement went to Google and nowhere else. observed on hackney.gov.uk More info »

Findings

Ordered by consequence. review has a concrete cost when it bites; info is real but depends on your setup. Seen is how common it is across the containers we have measured — reported separately on purpose, because common and harmless are different claims.

No findings were raised for this container.

Third parties it can reach

Each host is a party that can execute code or receive data in a visitor's browser. Follow one to see who else loads it. More info »

No third-party hosts were found in this container's tags.

Detected on

Sites observed loading this container. A container used across many hosts is a shared template; one on a single host is a bespoke build. Follow a site to see every container it loads.

hackney.gov.uk

What this audit describes

Containers change. These findings describe one specific artifact, and you can re-fetch it to check this reading.

Container	`GTM-TSPN35RL`
Published version	`1` — the identity of this configuration. It changes only when someone publishes.
Read at	2026-08-23 18:13:01 UTC (a month ago)
Source	`https://www.googletagmanager.com/gtm.js?id=GTM-TSPN35RL`
Body checksum	`27d7cec9d30fc8bd705313deff1e22256a8a473ce330ab6b8cf2a21cc9fcb20a` Evidence of the exact bytes we read, not an identity: Google varies the response per request, so re-fetching an unchanged container yields a different checksum. Compare the published version instead.

Re-audit

This reading is from a month ago. A container can be republished at any time, and nothing here updates on its own — a fresh read is the only way to know whether it still says this. Running it again replaces this page in place, so the link keeps working.

Re-audit GTM-TSPN35RL

Check another container

Put this container under version control. Tagora exports it to a repository you own, so every change arrives as a pull request. How it works »