We Looked Inside Google’s GTM Container. Here’s What We Found. | SerpCtrl
2026-07-22·7min
We Looked Inside Google’s GTM Container. Here’s What We Found.
Google Tag ManagerGTM ContainerData LayerWeb Analytics
What it actually does
Point it at a container and you get a full reconstruction:
Tags: every GA4, Universal Analytics, Floodlight, Custom HTML, and third-party pixel that fires, with its config laid out.
Triggers: what makes each tag fire, including the trigger exceptions people forget they wrote.
Variables: data layer variables, lookup tables, regex tables, constants. The plumbing.
Gallery templates: the community templates a container pulls in, which is where a lot of the interesting (and occasionally nasty) stuff lives.
That's the pitch. Now the fun part.
So we pointed it at Google
Not a client. Not a competitor. Google's own container, the one running on blog.google. If anyone's tracking setup should be immaculate, it's the company that sells the tracking setup, right?
Here's what fell out.
73 tags. 14 of them are dead.
The container ships 73 tags. 57 are GA4, modern, clean, exactly what you'd want to see. Then, sitting right next to them: 14 Universal Analytics tags. All paused.
UA was switched off in July 2023. Google migrated to GA4 like the rest of us and then just... never deleted the old tags. They're still in there in 2026, paused, adding weight to the container for no reason.
There's a phrase in this game: do as Google says, not as Google does. If even Google can't be bothered to clean up dead tags, that messy container you've been putting off is not the end of the world. But it's not free either. Legacy and unused tags still add load to every page.
A genuine fossil
Buried in the variables is a constant holding UA-18008-2.
Universal Analytics handed out account numbers in order, starting back in 2005. A five-digit account number means this thing is roughly as old as Google Analytics itself. It's been sitting in Google's container, doing nothing, for the better part of two decades. And it's still there.
The no-consent cookie trick
Here's one worth flagging if you're in the EU. Because it's Google's own tags on Google's own property, they can set _ga cookies via GA4 without granting consent first, the thing the rest of us have to build a whole Consent Mode setup around. First-party home advantage.
The one genuinely sharp thing
It's not all neglect. There's a pattern in here that's a personal favorite.
Google's live tag doesn't hardcode its measurement ID. Instead it pulls the ID from a lookup table keyed on the environment. The tag only ever sends to the property you intend, per environment. No staging setup quietly leaking data into prod.
And you can watch it decide. Regex table variables sniff the page hostname and sort it into buckets: staging, corp, qa, and dogfood (Google's in-house term for employees test-driving a pre-release build, "eating your own dog food"). Anything that looks internal gets routed to a separate GA4 property, so dogfood and staging hits never land in the public numbers.
That's the right way to do it: an explicit, readable table that controls exactly where a tag is allowed to fire, instead of a tangle of trigger exceptions. Steal this pattern.
The biggest surprise: no server-side. At all.
Google sells server-side tagging as a product. blog.google runs 100% client-side. Not a single server-side container in sight.
Make of that what you will.
It's not just Google
We've pointed this at a lot of containers now, and the wild stuff is out there in the open:
Hardcoded discount codes sitting in Custom HTML tags, readable by anyone.
Custom HTML tags loading malicious third-party JavaScript, someone else's script, running on a site that has no idea.
A Konami Code easter egg (Simo Ahava's, originally) running as a Custom HTML snippet on sites in the wild.
The point isn't that these are rare. The point is that your GTM container is not the private black box you think it is. Everything in it is one public ID away from being read back.
Why this matters for you
Two ways to use this.
1.On yourself
Run gtmonion on your own container and actually see it. The dead tags. The pixel a former agency left behind. The Custom HTML nobody remembers writing. It's the fastest tracking audit you'll do this week.
2.In the competition
The businesses beating you on conversions are running tracking you can read. What events they fire, what they retarget on, which vendors they trust with their data, it's all sitting in a container ID in their page source. If you've ever wondered why a competitor converts while you're staring at half-filled submit forms, the answer is often in how they measure.
Go try it
gtmonion.io
Free, no login, paste an ID or URL.
Run it on your own container first. Then run it on someone you're curious about. Feedback very much welcome, tell us what you find.
/// NEWSLETTER
Get practical ideas
for digital growth
Join our newsletter for concise, useful insights on web development, SEO, and digital performance.