Skip to content

Tag curation

Keep a register of the tags approved for your website, and get a drift alert whenever a check finds a tag, a destination or a consent behaviour your register doesn't allow.

Tag curation keeps your website's tags in line with what you approved. You build a register of approved tags, each with an owner, a purpose and the consent it needs. After every Hive Check, including the check that runs when a new Google Tag Manager version goes live, Hive compares what the site really sent with the register and your policy, and raises drift for anything that doesn't match.

Tag curation is included in the Growth and Enterprise plans. On Essentials, the tab shows Not included in your plan. See What each plan includes.

Open Tag curation

  1. Open the site under Tools → Hive.
  2. Select the Tag curation tab. The tab shows the number of open drift items next to its name.

The tab has four sections: Drift, Approved tags, Policy and History. At the top, the counts show how many tags are Approved, waiting for Review, marked Remove or Blocked, plus Open drift and Reviews due.

A check report also has a Curation box with the drift from that check and Open Tag curation.

Start the register

There are two ways to fill the register. You can use both.

From your first check

After the site's first Hive Check, select Approve all current tags. Every tag the check found is added as Approved, as it is on the site today. Advertising tags get Marketing consent as their Consent required only if you switch on Advertising tags only after marketing consent in the policy. Then give each tag an owner and a purpose.

From a Google Tag Manager export

  1. In Google Tag Manager, open Admin → Export Container, choose the version and download the .json file.
  2. On the Tag curation tab, select Import Tag Manager export.
  3. Drop the file in the box, or click to choose it. The file can be up to 5 MB. With Hive Setup connected, you can select Read the live container instead.
  4. Check the preview. For each tag it shows the Vendor, the Triggers, the Consent the container asks for, the Hive assessment and On the site: - Seen firing on the site: the latest Hive Check saw the tag. - In container but never seen: the tag is in the container, but no check has seen it fire. - No check yet: run Hive Check to compare.
  5. Select Add to the register.

Each container tag becomes one register row with the status Review, or Remove when Hive assesses it as retired technology. Nothing is approved until you approve it.

Importing a later version of the same container updates the rows from the container and keeps your decisions, owners and purposes. The preview shows Changes since version with the tags added, removed and changed, and Unused in the container lists triggers and variables that nothing uses.

Hive reads the export as data only. It never runs anything from the file, and custom HTML is only shown as text.

The Hive assessment

AssessmentMeaning
RemoveRetired technology, such as Universal Analytics, which stopped processing data in July 2023.
Consent gapAn advertising tag with no consent requirement in the container. Google tags can rely on their built-in consent checks, so confirm Google Consent Mode is set up.
ReviewThe tag is paused in the container. Remove it if nobody needs it.
DuplicateAnother tag in the container has the same type, settings and triggers.
UnusedThe tag has no firing trigger, so it never runs on its own.
No concernsNothing to flag.

Approved tags

The Approved tags table lists every row with its Category, Status, Consent required, Seen on site, Owner, Hive assessment and Next review.

To add a tag by hand, select Add tag. To change a row, select Edit. A row has:

  • Vendor key and Tag ID: how Hive recognises the tag, for example ga4 and G-XXXXXXX.
  • Tag name, Category (Analytics, Advertising, Functional, Support or Other) and Purpose.
  • Business owner and Technical owner.
  • Consent required: None, Analytics consent, Marketing consent or Functional consent. Hive Check tests it by loading pages before any choice in the cookie banner and after a reject.
  • Status: Approved, Review, Remove or Blocked.
  • Allowed destination domains: the hosts the tag may send data to, such as google-analytics.com. Leave it empty to allow any host.
  • Review every (days) and Notes.

Select Mark reviewed to record a review today. Next review turns red when a review is overdue. To take a tag out, select Remove from the register.

Drift

Drift lists what the latest checks found that the register and policy don't allow. Use Open, Ignored, Resolved or All to filter it.

DriftWhat Hive saw
New unapproved tagA tag that isn't in the register, or is marked for removal and still runs. Tags waiting for review show as Review in the register instead.
Tag fires before consentA tag that needs consent sent data before any choice in the banner, after a reject, or on a site with no banner.
Personal data sentA tag request carried an email address, phone number, card number or name.
New destination domainAn approved tag sent data to a host outside its allowed destination domains.
Approved tag missingAn approved tag that an earlier check saw is gone.
Blocked tag still presentA tag you blocked still loads on the site.

Each problem is one drift item across checks. When a later check no longer sees it, it resolves on its own. If it comes back, it opens again.

What you can do with drift

  • Approve adds the tag to the register as approved. For a new destination, Approve domain adds the host to the tag's allowed destination domains.
  • Block marks the tag as blocked in the register. When Hive Setup manages the site's web container, you can also tick Pause this tag in Tag Manager.
  • Pause this tag in Tag Manager plans the change with Hive Setup. You see the tags it pauses before anything is written. Apply plan creates a draft version for you to publish, unless your container is set to publish automatically. Applying needs project admin access, and you can roll the plan back from Hive Setup.
  • Fix the consent trigger opens Hive Setup with the consent fix from the same check.
  • Mark resolved when you fixed it. Ignore hides it, with a reason that stays in the history.
  • Open again brings back an ignored or resolved item.

Policy

Every rule starts on except Advertising tags only after marketing consent, which is your choice. Hive never assumes a consent policy. Switch rules on or off as you need:

  • Compare every check with the register
  • Alert on tags that are not approved
  • Advertising tags only after marketing consent
  • Tags wait for the consent the register asks for
  • No personal data in tag requests
  • Only approved destination domains
  • Alert when an approved tag disappears
  • Alert when a blocked tag is still present

Changing the policy compares the latest check with the register again.

Alerts

Open critical and high drift shows in Health → Website & tags, for example Tag curation: 2 tags not approved, and goes to the health alerts you set up. See Schedule and alerts.

People who turn on Hive Check new problems in their notification settings also get new drift in the same email, in its own Tag curation section with Review tag changes.

To check compliance on every publish, turn on Re-check when a new Google Tag Manager version is published on the site's Schedule tab.

History

History lists every register change and drift decision with When, Who, What and the Change. Changes Hive made after a check show Hive as who. Choose the dates to look at a period.

Downloads

  • Download tag register (.xlsx): a workbook with the Register, Findings, Removal list and Read me sheets. Status and owners have dropdowns, and overdue reviews are highlighted. Findings combines open drift and the latest check's problems, with a priority from P1 to P3.
  • Download compliance report: a PDF with the register, the current status, open drift and the history for the dates chosen under History (the last 90 days when none are chosen).

Can't find what you need? Contact support