← Back to the homepageDeutschEnglish

Sample report

What a GTM Monitor report looks like

This is the real report of an instant check — run against our demo shop in the test lab: seven channels from GA4 to ChatGPT Ads, with real vendor pixels, made-up account IDs and deliberately built-in errors. No customer data, nothing edited afterwards.

50

Health score

https://monitor.track-in.de/testlabor/demo-shop.html

Instant check (website) · Checked on 11 October 2026

● 2 critical● 1 warnings7 channels active

Marketing channels

Which channels send data from the page — and whether they do it correctly.

ChannelPresentTransportConsentSubpagesResponsesPass rate
Google Analytics 4AI-corrected YesBrowser Correct Correct 1 OK100 %
Google Ads YesBrowser Correct Correct 1 OK100 %
Meta YesBrowser Correct Missing 1 OK75 %
TikTok YesBrowser Fires before Correct 2 OK75 %
ChatGPT Ads YesBrowser Correct Correct 2 failed75 %
LinkedIn YesBrowser Correct Correct 2 OK100 %
Microsoft Ads YesBrowser Fires before Correct 1 OK75 %
PinterestNot found—————
X AdsNot found—————
HubSpotNot found—————

Tracking architecture

How the data leaves the page.

Visitor's browser
Google Tag ManagerGTM-TESTLABOR

Directly from the browser

Consent in detail

What each channel sends in which situation — the test browser accepted, declined and partially agreed to the banner in separate sessions.

ChannelBefore the decisionAfter acceptingAfter declining
Google Analytics 4Consent ping · gcs=G100SendsConsent ping · gcs=G100
Google AdsNot sendingSendsNot sending
Microsoft AdsSends anywaySendsSends anyway
MetaNot sendingSendsNot sending
TikTokSends anywaySendsSends anyway
ChatGPT AdsNot sendingSendsNot sending

Only channels with their own consent signal. The table above rates all other channels.

What was checked

The technical foundations every channel relies on.

CheckResultStatus
Page reachableYesOK
Google Tag ManagerGTM-TESTLABOROK
dataLayerPresentOK
Consent banner (CMP)Not clearly identifiedInfo
Consent given during the testYes — banner accepted automaticallyOK
Consent Mode: defaultsSetOK
Defaults before GTM startsClassified as a false alarm by the AIFalse alarm
GA4 pageview after consentSentOK
GA4 before consentCookieless pings onlyOK
Server-side taggingNot in useInfo

Findings & fixes

What to do — sorted by urgency.

UrgencyFindingFix
CriticalTikTok sends before consentFire the TikTok tag only after consent: in GTM set the tag's consent settings to "Require additional consent" (ad_storage) or move its trigger to the banner's consent event. If the tag sends a consent parameter, it must say "denied" before consent.
CriticalMicrosoft Ads sends before consentFire the Microsoft Ads tag only after consent: in GTM set the tag's consent settings to "Require additional consent" (ad_storage) or move its trigger to the banner's consent event. If the tag sends a consent parameter, it must say "denied" before consent.
WarningMeta does not send on subpagesCheck the Meta tag's trigger: it must fire on every pageview (All Pages or the consent event on every page), not only on the landing page.
NoteChatGPT Ads: 2 requests rejected by the vendor (HTTP error)Check the account or pixel ID in the tag. 401/403 means the ID is invalid or the account is not enabled, 404 means the target address is wrong.
Note2 dataLayer-Push(es) erst mehr als 5 Sekunden nach dem Seitenaufruf.See AI analysis
AI analysis

The AI cross-checks the raw scan data and explains every finding in plain words.

Overall assessment

The site is not production-ready from a DSGVO standpoint: TikTok and Microsoft Bing Ads fire before the consent decision without a valid denial signal, which is a genuine compliance violation. GA4 and Google Ads are correctly consent-gated (GA4 even sends a compliant denied-state ping pre-consent), so those are false alarms despite being flagged critical. On top of the consent issues, Meta loses subpage pageviews and the OpenAI/ChatGPT Ads pixel technically fails server-side (404/401), undermining data completeness even where consent is respected.

Findings

ProblemImpactHow to fix it
CriticalTikTok Pixel fires pre-consent without denial signal
  • analytics.tiktok.com/api/v2/pixel request captured in before_accept phase with Signalzustand 'kein_signal' (no GCS/ASC equivalent at all)
  • Same pattern repeats in after_decline phase — TikTok ignores the user's decision entirely
Personal data is sent to TikTok before any consent exists, a direct DSGVO/ePrivacy violation.
  • In GTM, add Consent Settings to the TikTok Pixel tag requiring ad_storage=granted (or TikTok's own consent flag if using Additional Consent Checks)
  • Move the TikTok trigger off the Initialization/All Pages trigger onto a trigger that only fires after consent_update grants ad consent
  • Verify the TikTok pixel is not loaded via a hardcoded script tag outside of GTM's consent-aware tag firing
CriticalMicrosoft Bing Ads (UET) fires pre-consent claiming granted consent
  • bat.bing.com/action/0 in before_accept phase shows ASC=G (granted) — Microsoft's own Consent Mode is asserting consent that was never given
  • Per the GA4 pattern, a pre-consent hit is only safe if it asserts denial (asc=D); here it asserts grant, which is a genuine violation
UET tag transmits tracking data under a false consent claim before the user has interacted with the banner, a DSGVO risk.
  • Check the Bing Ads UET tag's consent configuration in GTM — it must default to asc=D until ad_storage is granted
  • Ensure the UET tag template reads the live consent state rather than a hardcoded 'granted' default
  • Re-test with a fresh incognito session to confirm the first bat.bing.com hit now reports asc=D before acceptance
WarningMeta Pixel does not refire on SPA subpage navigation
  • www.facebook.com/tr fires once on initial load but produced no second PageView when navigating to demo-shop-produkt.html
Subpage pageviews and downstream Meta campaign optimization data are systematically undercounted.
  • Add a History Change / Virtual Pageview trigger to the Meta Pixel tag so it refires fbq('track','PageView') on route changes
  • Confirm the SPA framework pushes a gtm.historyChange or equivalent dataLayer event on navigation that GTM can listen to
WarningChatGPT (OpenAI) Ads pixel loads but backend calls fail
  • bzrcdn.openai.com/pixel-config/v1/TESTLABOR0000.json returns 404 (config not found)
  • bzr.openai.com/v1/sdk/events returns 401 (unauthorized) despite the SDK correctly firing only after consent
Even though consent handling is correct, no usable conversion data actually reaches OpenAI due to the config/auth failures.
  • Verify the OpenAI Pixel ID (TESTLABOR0000) is valid and active in the OpenAI Ads account
  • Check for a missing or expired auth token causing the 401 on the events endpoint
  • Confirm this is not a sandbox/test environment artifact before escalating to OpenAI support
NoteGTM container snippet not detectable in page HTML
  • GTM is confirmed installed via dataLayer (gtm.js, gtm.start) but 'Kein GTM-Snippet im HTML gefunden' in the captured markup
Non-standard or dynamically injected GTM loading complicates future audits and third-party tag verification tools.
  • Confirm whether GTM is injected via a custom loader/CMS plugin rather than the standard snippet
  • Document the loading mechanism for future audits and ensure it still respects consent gating order

📊 Tracking architecture

  • Pure client-side tracking architecture; 'Kein generischer Server-Side-Tagging-Container erkannt' — no SST endpoint detected.
  • GA4 and Google Ads traffic goes directly to google-analytics.com / googleads.g.doubleclick.net, both Google-owned, non-SST, client-side hosts.
  • GTM-TESTLABOR container is active (gtm.js/gtm.start present in dataLayer) despite the snippet not being visible in the captured HTML excerpt.
  • OpenAI/ChatGPT Ads pixel (oaiq, bzrcdn.openai.com/bzr.openai.com) is present but its backend calls currently fail independently of the consent/tagging architecture.

🛡️ Consent Mode v2

  • Consent Mode v2 signals are present: GA4 pre-consent ping correctly shows gcs=G100 (denied) and post-consent gcs=G111 (granted) — fully compliant.
  • TikTok carries no consent signal at all before acceptance, and Microsoft Bing Ads asserts asc=G (granted) before acceptance — both are real violations, not modeled pings.
  • dataLayer timestamps show consent_default pushed at 241ms, before gtm.js at 310ms — contradicts the computed 'consent_default after GTM' warning; treat as a false alarm.
  • CMP system could not be identified and no container-level access was available, so tag-level consent gating inside GTM itself (Consent Settings per tag) remains unverified — recommend a full audit with GTM API access.

Next steps

  1. 1Gate the TikTok Pixel tag in GTM behind ad_storage=granted before it is allowed to fire.
  2. 2Fix the Microsoft Bing Ads UET tag so it reports asc=D instead of asc=G prior to consent.
  3. 3Add a History Change trigger to the Meta Pixel tag to recapture subpage PageViews in the SPA.
  4. 4Investigate and resolve the OpenAI pixel-config 404 and events 401 errors with the OpenAI Ads account team.
  5. 5Run a full GTM container audit (with API access) to validate per-tag consent settings, since page-level signals alone cannot confirm compliance.

🧪 Data validation

dataLayer order (consent_default at 241ms before gtm.js at 310ms) contradicts the computed 'consent_default after GTM' finding, and the GA4 pre-consent hit carries gcs=G100 (denied), meaning the GA4 'fires before consent' critical flag is actually compliant behavior and a false positive.

And how does your website look?

The instant check takes under two minutes. Nothing to install, no login.

Run a free instant check