Bookmarks bar hidden? Press Ctrl Shift B on Windows or Cmd Shift B on Mac. The whole inspector lives inside the bookmark, so it works even on sites that block outside scripts.
Run the inspector on this page against a made-up shop with a typical mix of good setup and common mistakes, so you can see what the report looks like.
Show the code
The inspector reads what the page has already loaded (the dataLayer, tag globals, cookies and the browser's own record of network requests) and draws a report on top. No data leaves your device, there is no tracking of you, and nothing is changed on the site. Close the panel and it is gone.
Add it to your browser
- Show the bookmarks bar: Ctrl Shift B (Windows) or Cmd Shift B (Mac).
- Drag the lime Tracking Inspector button up onto the bar and let go.
- Open the website you want to check, let it finish loading, then click Tracking Inspector in the bar.
Drag not working? Right-click the button, choose Copy link address, then right-click the bookmarks bar, Add page, and paste it as the URL.
- Show the favourites bar: Ctrl Shift B (Windows) or Cmd Shift B (Mac).
- Drag the lime button onto the favourites bar.
- Open any website and click Tracking Inspector in the bar.
If Edge won't accept the drag: right-click the button, Copy link, then right-click the favourites bar, Add favourite, name it Tracking Inspector and paste into the URL field.
- Show the Favourites bar: View, Show Favourites Bar, or Cmd Shift B.
- Drag the lime button onto the Favourites bar.
- Open any website and click Tracking Inspector.
If nothing happens when you click it, turn on Settings, Advanced, Show features for web developers, then tick Develop, Allow JavaScript from Smart Search Field.
- Show the bookmarks toolbar: Ctrl Shift B (Windows) or Cmd Shift B (Mac).
- Drag the lime button onto the toolbar.
- Open any website and click Tracking Inspector.
Firefox runs bookmarklets even on sites with a strict Content Security Policy, so it works on most big brands' sites too.
- Click Copy code for the console above.
- On the site you want to check, open developer tools: F12 or Ctrl Shift J on Windows, Cmd Option J on Mac (Safari: Cmd Option C).
- Click into the Console, paste and press Enter. Chrome may ask you to type
allow pastingfirst the first time.
On a phone: bookmark any page, edit that bookmark and replace its URL with the copied code. Then open the site, type Tracking Inspector in the address bar and tap the bookmark.
What each check means
Which GTM containers are actually running (keys in google_tag_manager), not just referenced in the HTML. Whether a dataLayer exists, how big it is, and the last 15 events pushed to it.
Every G- ID from the tag runtime, gtag('config') calls, script URLs and real hits to /g/collect. Flags missing page_view, the same ID configured twice or several page_views (double tagging) and old UA- tags left behind.
AW- IDs, conversion linker cookies (_gcl_au, and _gcl_aw after a gclid click), requests to Google Ads endpoints and any visible hints of enhanced conversions such as user_data.
Default and update commands, all four signals (ad_storage, analytics_storage, ad_user_data, ad_personalization), a denied default for UK and EEA visitors, wait_for_update, and whether tags could fire before the default.
Google stamps each hit with consent state. gcs=G100 means ads and analytics denied, G110 ads only, G101 analytics only, G111 both granted. gcd also shows how each signal got there, for example denied by default then granted on update. Pings sent while denied mean advanced mode.
Spots Cookiebot, OneTrust, CookieYes, Complianz, Usercentrics, Didomi, Iubenda, Termly, Osano and Quantcast Choice by their globals or scripts, plus any IAB TCF banner.
fbq, the pixel IDs (from fbq.getState() or hits to facebook.com/tr), events sent, and the _fbp and _fbc cookies. Conversions API deduplication needs a matching event_id on browser and server events, which only Events Manager can confirm.
TikTok Pixel, LinkedIn Insight Tag, Microsoft UET, Hotjar and Clarity. Also hints at server-side GTM when GA4 hits go to a first-party subdomain instead of google-analytics.com.
Lists marketing cookies such as _ga, _gcl_*, _fbp and _ttp, and fails if they are set while the matching consent is denied. Test in a fresh private window before clicking the banner for an honest result.
What it can and can't prove
- Which tags loaded and initialised on this page
- What is in the dataLayer and in what order
- Requests the browser sent to GA4, Google Ads, Meta and others, with their consent stamps
- Cookies readable by the page
- Anything server-side: sGTM processing, Meta Conversions API, offline conversions
- POST request bodies, where GA4 batches some events
- HttpOnly cookies, such as server-set FPID
- Hits that dropped out of the browser's timing buffer on very busy pages
For a final answer, confirm in GTM Preview, GA4 DebugView, Google Ads Diagnostics and Meta Events Manager. Each run is a snapshot, so press Re-run after you accept or reject cookies.
Want Claude to fix it for you?
Press Copy report in the inspector and paste it into Claude with the Tracking & Attribution skill. It explains every fail in plain English and writes the GTM, gtag and Consent Mode changes to fix them.