Tag Manager exists so marketing can ship measurement without a developer release. Left ungoverned it becomes a second codebase with no review, no tests and a direct line into every page.
The data layer is the contract
The application pushes well-defined events with typed parameters. Tags read that. Nothing important is scraped from the DOM, because a class name changing during a redesign should not silently end conversion tracking — which is exactly how most tracking dies.
Governance we actually apply
- A naming convention for tags, triggers and variables, written down
- Workspaces per change, with a description of what and why
- A preview and a checklist before publish, and a note in the version history
- A quarterly clean-up that removes tags for campaigns that ended a year ago
Performance is part of the brief
Every tag is JavaScript loading on your site. We audit what each one costs, remove duplicates — three analytics tools measuring the same click is common — and load what remains after the page is usable rather than before it.
Consent
Tags are grouped by purpose and gated on consent state, with the banner as the source of truth. That grouping is what makes a regulator’s question answerable in an afternoon rather than a fortnight.
Where it should stop
When a tag needs a secret, when it must run reliably regardless of the browser, or when it is heavy enough to hurt the page, it moves out of the browser to server-side tracking. Everything else stays here.
Feeds GA4, the ad platforms behind performance advertising, and HubSpot.