Is it risky to share the Google Tag Manager ID requested by an agency, and how should access be granted?

The permission steps are very straightforward: Go to the GTM Admin tab and open User Management. Enter the agency contact's email and select only 'Edit' under Container Permissions. Leave the 'Publish' box strictly unchecked.

In line with information security protocols, granting publishing rights to external partners is not recommended. A misconfigured tag could compromise the confidentiality of form data or hurt page speed. An approval-based workflow model should also be defined in the contract.

Agencies always ask for full publish rights to speed up their workflow, that's normal. But don't surrender control. Let them set up the tags, notify you during working hours, and you can just spend two minutes reviewing and publishing them yourself.

the gtm code itself isnt a secret anyway hit f12 in source code and its right there. honestly the risk is panel permissions. dont give publish access let them edit u review and publish, done.

A checklist to follow while an agency works in GTM: 1) Always have your developer review custom JavaScript tags, 2) Make sure password or sensitive input fields in forms aren't being scraped, 3) Prevent heavy tracking libraries from being loaded onto the site unnecessarily.

we just gave the agency our direct password..... do we also need to grant separate permissions in Google Analytics for this preview and approval workflow you mentioned?

This is exactly why container version history exists. Even if someone adds unauthorized code, you can roll back to a clean previous version in GTM with one click. Still, granting edit access while keeping publish rights in-house is the most mature approach.

Edit: asked below, I wrote the answer in the second message.

Same here.

The discussion got scattered, let me summarize. Processes without records never improve, because you don't know what to fix.

If I were you, I'd go this route.

Looking at it as a process the picture changes. Any comment made without a control group is just a guess.

Correct in theory, but it doesn't work that way in practice. Everything goes well for the first three months; problems arise in the fourth.

This is my opinion, I'm not claiming it's absolute truth.

Following.

You're right. Mistakes made on the google tag manager id side are usually reversible but expensive.

Any unwritten clause becomes a point of disagreement later, as both sides remember it differently. If I were you, I'd go this route.

I agree with this. The real issue isn't the number, but what it's based on.

Proven by experience.

Here's how it went for us. Map listings bring more business than blog posts for most local businesses.

That's all, sorry if I went on too long.

My question might sound amateurish sorry about that... like processes without records never improve because you don't know what to fix.

Everything goes well for the first three months; problems arise in the fourth.

Thanks for posting.

three different views emerged, they all complement each other then when you try to change everything at once, nothing settles.