Google Tag Manager Governance: Ghost Tags Inflating Your CPA

Open your Google Tag Manager container and look for a tag named after an agency you stopped paying two years ago. It is still there. It still fires on every page load. Shopify sunset the additional scripts box on the Thank you and Order status pages on 28 August 2025. Plenty of those old snippets moved into the container rather than into the bin.

A tag is a piece of code that Google Tag Manager drops into your store. A container is the box that holds them all. A ghost tag is one whose owner has left, whose job nobody can state, and which nobody will delete. CPA, your cost per acquisition, is what you pay in ads for one new customer.

A container full of dead tags costs you budget, and it costs your week. Autonomous Technologies builds and runs the systems behind Shopify stores, for founders and operators who own the store after launch. Container cleanup is part of our analytics work because it is a spend decision, not a housekeeping task. You act on what the dashboard says. If the dashboard counts one sale twice, you spend twice.

Nobody is ever paid to delete a tag, so the container only grows

Every new vendor arrives with a request: add this snippet. Nobody leaves with one. No agency sends a final email asking you to remove their tracking. So the container fills up.

That leaves names like Criteo_2021_DO_NOT_TOUCH sitting in a live container. The operations lead will not touch it, in case a revenue stream depends on it. The fear is fair. Leaving it alone is not safe either.

Google is plain about this. There is no hard limit on how many tags you can deploy. What Google does publish is a size indicator, a percentage showing how full the container is. Google’s guidance says: “If the Size indicator value is above 70%, you should take steps to optimize your container configuration.” An unused tag “is taking up space in your container unnecessarily”.

The old version of this article told you to worry past 50 tags. It also told you to watch for a warning at 98%. Neither number is in Google’s documentation. The published number is 70%, checked on 21 September 2026, and it measures size, not tag count.

Two purchase tags turn one sale into two, and you scale on the gap

This is where the money leaves. An old Purchase tag from one agency and a new one from the next both fire on the same order confirmation. The ad platform receives two conversions for one sale.

Google Ads counting settings decide what happens next. On “Every conversion”, Google Ads “counts every conversion (per tracked conversion action) that happens after an ad interaction”. Both copies count. Return on ad spend is the revenue a platform credits to each dollar you spend. Two copies of one sale make it look roughly double.

Meta handles this differently, and only if you set it up. A pixel’s eventID has to match the Conversions API event_id. Meta then drops the copy, but only if it arrives “within 48 hours of when we receive the first event”. Miss the shared identifier and the duplicate stands.

The reverse failure is quieter and just as costly. That is the subject of signal loss in Facebook ads. Inflated data makes you spend more. Missing data makes you stop spending on something that works.

A tag you forgot still collects your customers’ data

Site speed is the boring reason to clean a container. The reason that should hold your attention is simpler. You are responsible for every script that runs on your domain.

Consent mode is how Google tells its tags what a visitor agreed to. It defines four settings: ad_storage, analytics_storage, ad_user_data and ad_personalization. Google’s own page notes that consent mode “was updated in November, 2023 and now contains two additional parameters”. It also warns that “consent mode doesn’t save consent choices”. Something else in your stack has to store the answer.

Shopify’s Customer Privacy API applies consent choices to Shopify surfaces, pixels included. It covers four purposes: preferences, analytics, marketing, and sale of data. A tag added outside that path does not inherit those choices.

Shopify is also direct about who carries the risk. Its custom pixels page says that “adding and using custom pixels is unsupported by Shopify”. It adds that “compliance with applicable laws, consents, code security, troubleshooting, and updates are your responsibility”. A dead vendor’s tag on your checkout is your exposure, not theirs.

Three checks that take five minutes inside Tag Manager

You do not need a developer for the first pass. You need twenty minutes and the will to write names down.

Check the size indicator, not the tag count. Google’s threshold is 70%. Above that you are carrying weight you cannot justify. The fix starts with anything unused.

Read the tag names out loud. Names like “Facebook Pixel Copy” or “Update 2” tell you nobody documented a change. A workable rule is vendor, job, owner, date, on every tag from today.

Open the Overview page and look at unpublished changes. A workspace is a draft copy of the container. Edits sitting there for months are abandoned work. They are the first thing to surprise the next person who publishes.

Two checks in Admin that are security, not housekeeping

The Admin section is where governance exists or does not. Tag Manager permissions come in levels: Read, Edit, Approve and Publish on a container, plus User and Administrator on the account. Publish is the level that changes what runs on your store.

Check who still holds Publish. Former staff and former agencies turn up here constantly. Google’s page describes removing someone from the Container permissions list with Remove. Do that today for anyone off the project.

Check who is Administrator. Administrator can create containers and change permissions. That seat can restore the access you just removed. It belongs to you, or to someone whose employment you control.

Tag Manager also has a consent overview. It sorts tags into “Consent Not Configured” and “Consent Configured”. Read that list before you touch anything. It is the fastest map of which tags nobody ever thought about.

The old way is speed. The way that survives is ownership

Cleaning tags to shave load time is worth doing. It is not the argument that gets the work approved. The argument is that unowned code reports numbers you spend against, and collects data you answer for.

Change control is the dull version of this, and it holds. A pull request is a proposed change that somebody has to approve before it goes live. Thirty-seven pull requests reached Sene’s order systems between 14 July and 8 September 2026, and a named person accepted every one. We wrote that up in the human gate on agent authored features. The same rule works on a tag container.

What breaks when you start deleting, and who owns it

The fear of the delete button is not irrational. Deleting the wrong tag can stop a live conversion feed. You find out in a weekly report, not an alert. Here is how to take that risk off the table.

Work in a new workspace, not the live container. Publish once, with a version name that says what you removed. Take one week of figures before and after: orders in Shopify, conversions in Google Ads, purchases in Events Manager. If the store number holds and a platform number moves, you removed something that was reporting.

Clean data is also what makes any outside team useful, which is the point of marketing data hygiene and client retention. Nobody can improve a campaign against a feed they cannot trust.

Vendor documents checked on 21 September 2026. Google: container size and efficiency, Tag Manager permissions, consent settings in Tag Manager, consent mode parameters and Google Ads conversion counting. Shopify: custom pixels, the Customer Privacy API and checkout.liquid deprecation. Meta: deduplicating pixel and server events.