How the audit works.

gtmspy walks your store in a real browser, from ad click to checkout, and shows what GA4, Google Ads, Meta and TikTok received, what broke, and what it's costing. Free. Just a URL.

No login, no access to your accounts. About 3 minutes. Results from a UK connection.

110 checks
4 visits per scan
Consent tested after Reject
Independent: no tracking product to sell

Broken tracking doesn't throw errors.

A theme update drops add_to_cart. A pixel app sends purchase twice. The cookie banner says Reject, but Meta loads anyway. Nothing on your site looks wrong, and your ad platforms quietly learn from bad data: weaker bidding, smaller audiences, and reports nobody trusts.

Missing events

Platforms that never hear view_item, add_to_cart or checkout can't optimise for them.

Wrong data

Doubled purchases, wrong values, lost click IDs: the platform learns the wrong lesson.

Consent that doesn't hold

Tags that fire before a choice or after Reject are a UK compliance risk, and Consent Mode set up wrong switches off Google's modelling.

A real visit, four times over.

1
You enter a URL.
Nothing to install, no logins to share.
2
We shop your store.
Real Chrome lands from a test ad click, views products, adds to cart and reaches checkout: once with no choice made, once after Reject, once after Accept, once with an ad blocker, plus a phone-sized run.
3
We decode every hit.
Each request to GA4, Google Ads, Meta, TikTok, Pinterest, Microsoft and 90+ other tools, and every cookie with who set it.
4
You get a scored report.
Four pillars, issues worst first, each with the points its fix is worth.

110 checks in four areas.

Signal coverage

Does every platform receive every step: product views, add to cart, checkout, purchase setup, site search, remarketing? On every page type, on desktop and mobile?

Signal quality

Right values and currency, matching product IDs, no duplicates, event IDs for browser and server, click IDs that survive to checkout, enhanced conversions and advanced matching switched on.

Privacy & consent

What fires before a choice, after Reject and on later pages. Consent Mode v2 defaults and updates. Reject as easy as Accept. No personal data in tracking.

Infrastructure

Server-side tracking: who runs it and where it forwards. First-party tagging, cookies Safari keeps, tracking that survives ad blockers, tags that load without errors.

And your GTM container. 66 rules across the published container (paused tags, duplicate triggers, consent settings, hard-coded values) with a fix for each.

A report you can act on, and argue with.

+8 points if fixed
Every issue shows what fixing it is worth.
Meta: 3 hits after Reject
The evidence, not just the verdict.
Server-side: confirmed, Stape → GA4, Meta
Who runs it, and where it sends.
Not measured: checkout (bot protection)
We tell you what we couldn't check.

Most free tracking checkers are selling you the fix.

That's fine, if you know it. gtmspy doesn't sell server-side hosting, a pixel app or a cookie banner, so the audit has no product to steer you towards.

	Typical free checker	gtmspy
How it looks	Reads your page or one page load	Shops your store to checkout, 4 visits
Loss figures	Industry averages or traffic models	Measured on your site
Consent	Is there a banner?	What fired before a choice and after Reject
Server-side	Do you use one?	Who runs it, and where it forwards
Limits	Not mentioned	A “Not measured” section in every report
Scoring	Unpublished	Published method

Know before your client does.

For agencies: audit a prospect's store from its URL, with no access to their accounts, and open the conversation with evidence. Watch your clients' stores and get an alert when a theme update, a new app or a banner change breaks tracking.

Talk to us about agency use

Built by people who fix tracking for a living.

gtmspy is made by the team at trackable.digital, 8 years of setting up and repairing GA4, GTM, server-side and consent for online stores. We built the audit we wished we had: one that shows its evidence. If you want help fixing what it finds, we can do that too. The report is yours either way.

How we scan, in plain words.

We visit your store as a normal Chrome browser, from a UK connection. No faked identity, no bypassing bot protection.
Our visits behave like real visits, so they do appear in your analytics and ad accounts, tagged utm_source=gtm-audit.
If your store blocks us, we say so, name the tool that blocked us and how to let us in. We never guess a result.
We don't place orders on stores we don't run.

Questions

Do I need to give you access to GA4, GTM or Shopify?

No. Everything comes from your public website, as a visitor sees it.

Can I scan a store that isn't mine?

Yes: competitors, prospects, clients. Detailed findings are shown only to the account that ran the scan; we never publish a store's results.

Will the scan show up in my analytics?

Yes. It's a real visit, tagged utm_source=gtm-audit so you can filter it out.

Why do some checks say “Not measured”?

Because we only report what we saw. If bot protection stopped the checkout, or the banner didn't appear, we say so instead of guessing.

Is this a legal compliance check?

No. We test how your tags and banner behave against UK consent rules; we don't give legal advice.

Do you check server-side tracking?

Yes, as far as it's visible from outside: whether it's there, who runs it and which platforms it feeds. Server-to-server calls we can't see are marked “no evidence”, never “missing”.

How is the score worked out?

Four pillars of 25 points, weighted by severity. Unmeasured checks are left out, not counted against you.

Find out what your ads platforms are really learning.

Free · About 3 minutes · No access needed