Google Tag Manager Access: Who Should Own Your Account and How Is GTM Used?
Quick answer: Google Tag Manager (GTM) is a free Google tool for adding and managing tracking tags, such as Google Analytics 4, Google Ads, the Meta Pixel, and Microsoft Clarity, from one web interface instead of editing your website code for every change. Your business should own the GTM account. Agencies and developers should be added as users with only the access they need.
Most businesses we talk to have Google Tag Manager installed. Far fewer know who controls it. Understanding Google Tag Manager access and Google Tag Manager ownership is essential when multiple agencies, developers, or employees manage your website’s tracking infrastructure.
That second part matters more than people expect. GTM decides what data reaches your analytics and ad platforms, and anyone with Publish access can add code to your live website. If the account belongs to a former agency or an employee who left two years ago, you have a measurement problem and a security problem.
Below we cover what GTM does, four ways we use it with clients at KnewChoice, who should own the account, and a checklist you can use to audit your own access this week.
What Is Google Tag Manager Used For?
GTM is a tag management system. You install one small snippet of code, called the container, on every page of your website. After that, you add, change, and remove tracking tags inside GTM rather than in your site code.
Tags commonly managed through GTM include:
- Google Analytics 4
- Google Ads conversion tracking and remarketing
- Meta Pixel
- LinkedIn Insight Tag
- Microsoft Advertising UET tag
- Microsoft Clarity
- Call tracking and chat tools
Tags, Triggers, and Variables
Every GTM setup is built from three pieces:
- Tags are the code that sends information somewhere. Example: a GA4 event tag that sends a “generate_lead” event to Google Analytics.
- Triggers are the rules that decide when a tag fires. Example: when a HubSpot form reports a successful submission.
- Variables are the values tags and triggers use. Example: the form ID, the page URL, or the text of the button someone clicked.
Many setups also use a data layer, which is how your website or form tool passes information to GTM, such as “a form was just submitted, and this is its ID.” Data layer events are usually more reliable than guessing from button clicks or page URLs.
Preview Mode, Versions, and Workspaces
Preview mode lets you test changes on your live site before any visitor is affected. Every published change is saved as a version, so you can roll back a bad change in a few clicks. Workspaces let multiple people work on changes at the same time without overwriting each other.
Google Tag Manager and Google Analytics 4: What’s the Difference?
| Google Tag Manager | Google Analytics 4 | |
| Main job | Decides what data is collected and where it is sent | Stores, organizes, and reports on that data |
| Reports | None | Yes |
| Conversions | Fires the events | Marks the important events as key events |
You can install GA4 without GTM. GTM earns its place once you run more than one platform, need custom events, or want tracking changes without waiting on a developer to write custom code on your website.
Google Tag Manager vs. the Google Tag
The Google tag (gtag.js) is a single snippet that loads Google products like GA4 and Google Ads. It works for basic installs. Google’s own developer guidance calls Tag Manager the first choice for deploying analytics and marketing tags when your site allows it, because it gives you the most control over how and when tags fire.
How We Use Google Tag Manager at KnewChoice
Definitions are easy to find. Here is what GTM looks like in the accounts we actually manage. Effective Google Tag Manager conversion tracking helps businesses measure meaningful actions across their marketing channels. At KnewChoice, we use GTM to connect website interactions with GA4, Google Ads, Meta, and other measurement platforms so campaign performance can be evaluated using more reliable conversion data.
1. Accurate HubSpot Form Tracking
HubSpot forms embedded on a website are one of the most common sources of bad conversion data. Thank-you page tracking breaks when a form shows an inline message instead of redirecting. Click triggers count attempts, not successful submissions. And when a site has several HubSpot forms, they often get lumped into one generic conversion, so a demo request and a newsletter signup look the same in reporting.
Our approach uses GTM to listen for HubSpot’s successful submission event, capture which form was submitted, and send a separate GA4 event for each form that matters. Those events become GA4 key events, and the same triggers feed Google Ads and Meta. We walk through the full setup in How to Track Multiple HubSpot Forms Using Google Tag Manager and GA4.
2. Event Experiments for Conversion Rate Optimization
Most landing pages have elements nobody has confirmed are being used: FAQ accordions, pricing toggles, comparison tables, sticky call buttons, embedded videos, and chat widgets.
We create GTM events around these elements to see how visitors actually interact with them. A typical first round tracks:
- Clicks on each FAQ question
- Pricing or plan toggle clicks
- Scrolls that reach the form
- Video plays and completions
- Phone number clicks compared with form button clicks
We then compare visitors who converted with those who did not. If people who open the FAQ convert at a much higher rate, that content probably belongs higher on the page. If almost nobody touches the comparison table, it may be adding content length to a page without adding value.
3. Connecting Microsoft Clarity to See How People Engage with Your Site
Event counts tell you what happened. Microsoft Clarity, a free session recording and heatmap tool, helps show why things happened. It is one of the free online marketing tools: 10 Free Online Marketing Tools post we recommend most.
We install Clarity through GTM and send our GTM events into Clarity as custom events. Inside Clarity, they appear as Smart Events, so we can filter session recordings and heatmaps to a specific group, such as visitors who used the pricing toggle but never submitted the form. Watching a couple dozen of those sessions often explains more than a week of reports.
Those findings shape the landing pages we build for Google Ads, Meta, and LinkedIn campaigns. When a landing page converts better, every paid channel sending traffic to it benefits.
4. Matching Meta Lead Conversions to GA4 Key Events
Meta conversion tracking often drifts away from what the business actually counts as a lead. A pixel may fire a Lead event on every page that has a form, or a custom conversion may be based on a URL that several forms share.
We set up the Meta Pixel through GTM and fire Meta conversion events from the same triggers that send GA4 key events. Then we build Meta custom conversions that match each GA4 key event one-to-one. A “Consultation Request” in GA4 is the same action as the “Consultation Request” conversion in Meta.
That gives you two things. You can see which Meta campaigns and ad sets produce the specific conversion you care about, and Meta optimizes delivery toward that action instead of a looser signal. When Meta and GA4 numbers disagree, you also have a clean starting point for finding out why.
Why This Matters More in Healthcare, Senior Care, and Other Restricted Categories
Meta now places some advertisers in restricted data categories, with health and wellness affected the most. Depending on the level of restriction, Meta may strip URL paths and custom parameters from events, block certain mid- and lower-funnel standard events, and hold custom events until you review and confirm them in Events Manager. Custom conversions whose names or rules suggest a health condition can also be flagged.
This affects healthcare practices, senior care providers, wellness brands, and others. Two practical consequences:
- Conversions based on a thank-you page URL can stop working because the part of the URL that identified the page is removed due to these restrictions. That means if your page has a thank-you redirect like yourwebsite.com/assessment-inquiry/, your Meta conversion would only show the form submission took place on yourwebsite.com, not the full URL.
- Lead and purchase events that used to drive optimization may no longer be shared or usable. Since most campaigns are likely optimized toward conversion volume or conversion value, you will notice your campaign is now stuck in the “Learning Limited” or “Learning” phase, resulting in fewer conversions and higher CPAs.
A well-built GTM setup will not bring back data Meta has restricted, and it should not try to. Renaming a restricted event to slip it through is a Meta advertising policy problem, not a fix. What the alternative does give you:
- Conversions that fire when a form actually submits, with neutral event names that contain no health information.
- GA4 as a reliable record of every lead by campaign, even when Meta reporting is limited.
- A clear view of which events Meta still accepts, so you can choose the best allowed optimization event and use it at the ad set level as the primary conversion you’re optimizing toward.
Healthcare organizations should also review their tracking with their compliance team. Tags should never send protected health information, such as form field contents or condition-specific page paths, to any ad platform.
Who Should Own Your Google Tag Manager Account?
Google Tag Manager ownership should remain with the business whose website and marketing activities are being measured.Google’s guidance is direct: the organization whose tags are being managed should create the Tag Manager account, and agencies should be added as users. We follow the same rule with every client. You own your GTM account, GA4 property, Google Ads account, and Meta assets. We work inside them, and if you ever leave, everything stays with you.
What Goes Wrong When Someone Else Owns It
- You cannot simply move a container. If your container lives in an agency account, getting it back usually means exporting it, importing it into a new account you own, and updating your website to load the new container.
- Single-admin accounts are fragile. If the only admin’s Google account is deleted, for example when an employee leaves and IT removes their email, the GTM account can be left with no admin. Google automatically deletes accounts and containers with no admin, and remaining users get 30 days to export before tracking has to be rebuilt.
- Nobody knows what is running. Tags from past vendors keep firing and sending visitor data to platforms you no longer use.
Google Tag Manager Access and Permissions Explained
GTM has two layers of permissions: account level and container level.
| Level | Permission | What it allows |
| Account | Admin | Manage users, create containers, and change account settings |
| Account | User | View basic account information; container access is set separately |
| Container | Read | View tags, triggers, and variables without making changes |
| Container | Edit | Create workspaces and make changes, but not create versions or publish |
| Container | Approve | Everything in Edit, plus create versions, but not publish |
| Container | Publish | Full rights, including publishing changes to the live site |
What an agency usually needs: account-level User and container-level Publish on the containers it manages. Your business should keep at least two Admins, each signing in with their own company Google account rather than a shared login.
Publish Access Is Access to Your Website
This is the part most businesses miss. GTM can run Custom HTML tags, which means anyone with Publish access can add JavaScript to every page of your site. That is what makes GTM flexible. It is also why Publish access deserves the same care as admin access to your website.
A former agency, freelancer, or employee who still has Publish rights can change what loads on your site, on purpose or by accident. Review GTM users whenever you review access to your website and ad accounts.
Google Tag Manager Access Audit Checklist
Reviewing Google Tag Manager access regularly helps businesses maintain control over their tracking setup and prevent former employees or agencies from retaining unnecessary permissions. Use this checklist to review account ownership, user access, and conversion tracking accuracy.
- Confirm which GTM container loads on your site. The container ID starts with “GTM-” and can be found with Google Tag Assistant or in your page source.
- Confirm your business owns that account and that at least two internal people are Admins.
- List every user and remove anyone who no longer works for or with your company.
- Lower the permission level for anyone who does not need to publish.
- Review your tags and pause or delete any for platforms you no longer use.
- In Preview mode, check that each key conversion fires once per action.
- Confirm your GA4 key events match the conversions used in Google Ads and Meta. Use GTM Preview mode with GA4 DebugView, and Meta’s Test Events tool in Events Manager.
- In health, finance, or other sensitive categories, confirm no tag sends form contents or sensitive page paths to ad platforms.
Consent, Privacy, and Server-Side Tagging
GTM also controls how tags respond to visitor consent. Google Consent Mode lets Google tags adjust what they collect based on a visitor’s cookie choices, and it is required for Google Ads measurement and personalization features when you advertise to visitors in the European Economic Area, the UK, and Switzerland. Most cookie banner tools, like Cookiebot, connect directly to GTM, making it easier to honor visitors’ choices, including the opt-out requirements of US state privacy laws.
For businesses with stricter privacy needs, server-side tagging adds a second GTM container that runs on a server you control. Data passes through that server first, so you can remove sensitive fields before anything reaches Google, Meta, or other vendors. It costs more to run and maintain, but it gives you far more control over what leaves your site.
Since Apple’s iOS 14.5 privacy changes in 2021 reduced what the Meta Pixel can see, businesses running Meta ads should consider sending conversions server-side through Meta’s Conversions API, which can be set up with server-side GTM. This matters most for e-commerce sales attribution, but it improves lead tracking too. Server-side tracking does not get around Meta’s restricted categories, though. Conversions API data follows the same rules as the pixel.
Frequently Asked Questions
Is Google Tag Manager free?
Yes. Google Tag Manager is free. Server-side tagging is the exception: the server container needs hosting, either on Google Cloud (billed on usage) or through a provider like Stape. Free tiers cover testing, but most businesses with real traffic should expect a monthly hosting cost. Google also sells Tag Manager 360, an enterprise version, through Google Marketing Platform, but most businesses never need it.
Do I need Google Tag Manager if I already have GA4?
Not always. If you only use GA4 for basic traffic reporting, the Google tag may be enough. In practice, every business we have worked with needs to know which channels convert, which ads drive sales, and how people use their website. That takes ad platform tags, form tracking, and custom events, which is where GTM pays off. For businesses managing multiple advertising platforms, Google Tag Manager conversion tracking also makes it easier to coordinate how important website actions are measured across GA4, Google Ads, and Meta.
Does Google Tag Manager slow down my website?
GTM itself is lightweight. Speed problems usually come from the tracking tags inside it, especially old or duplicate tags tracking the same info. Removing unused tags helps. So does firing tags only on the pages that need them, and using GTM’s built-in tag templates instead of Custom HTML where possible.
Can I transfer a GTM container to a different account?
Not directly. You can export the container, then import it into an account you own. You will then need to update your website and some of your tracking with the new container ID, since it will be different from the one the previous owner used.
How do I give an agency access to Google Tag Manager?
In GTM, open Admin, then User Management in the Account column. Add the agency’s email, set account permission to User, and give Publish access on the container they will manage.
How do I remove an old agency’s access?
Open Admin, then User Management, select the user, and remove them. Then check the Versions tab to see the most recent changes they published.
Not Sure if Your Conversion Tracking is Set Up Correctly?
If you’re not sure whether GA4, Google Ads, Meta, and TikTok are counting the same conversions, we can help. KnewChoice audits GTM setups, cleans up access, and rebuilds conversion tracking inside accounts you own. Request a free digital marketing strategy.
