# Failure modes seen in production

Each entry gives the mechanism, the detection signature, the checks it fails and the tempting wrong fix. Signatures name har-audit, crm-attribution-coverage or a platform read where one finds it.

## Inventory and loading

1. Hard-coded pixel plus a GTM pixel
   - Mechanism: a theme or app snippet and a GTM tag both initialise the same pixel or Google tag.
   - Detect: two base page events for one ID on one page load, or the same Google tag ID loaded twice; the loaders differ (page source against GTM). Checks INV-03, INV-04.
   - Wrong fix: pausing the GTM copy, which leaves the ungated theme copy in charge.

2. Unknown vendor left after a trial
   - Mechanism: a pixel added for a trial keeps receiving data with no owner, or a collector the vendor table does not know (visitor identification, affiliate, chat, replay or a new ad pixel) was added outside the plan.
   - Detect: an ID not in stack.md receiving event requests (har-audit INV-01), or a host in har-audit's unclassified third-party list that receives parameters or a body (INV-06 in journey and accept runs, CON-02 or CON-03 WARN in consent runs). Checks INV-01, INV-06.
   - Wrong fix: leaving it because the CMP gates it; it may not be disclosed in the CMP at all, which makes it S1.

3. Container loaded with a product ID
   - Mechanism: since 9 July 2026 a container loaded through `/gtag/js` or `/gtag/destination` with a G- or AW- ID runs only Google-provided tags and variables.
   - Detect: no gtm.js request, a `/gtag/destination` load instead, and non-Google tags that never fire. Check INV-07.
   - Wrong fix: copying the non-Google tags into page code.

4. Wildcard triggers catching gtag.config
   - Mechanism: since 8 October 2026 `gtag('config')` commands surface as `gtag.config` events, which wildcard custom event triggers can catch.
   - Detect: conversions or forwarded events firing on `gtag.config` in Preview; extra events in the capture. Checks INV-08, CNV-02.
   - Wrong fix: deleting the gtag config snippet on some pages only.

## Consent

5. Vendor snippet outside the CMP
   - Mechanism: a snippet added in the theme or a CMS plugin never passes through the consent gate.
   - Detect: vendor event requests in the no-choice capture with a page-source loader (har-audit CON-02 plus INV-04). Checks CON-02, CON-03, INV-04.
   - Wrong fix: adding a consent condition in GTM, which does not touch the theme copy.

6. Pixel that collects by default
   - Mechanism: some pixels start with consent granted. The OpenAI Ads pixel initialises consent to true unless `oaiq("consent", false)` runs before init or it finds a stored denial (OpenAI measurement pixel docs, checked 2026-11-02). Microsoft UET without a consent default can send granted beacons before a choice; consent-debugging's UET notes give the regional defaults.
   - Detect: `bzr.openai.com` requests, or UET beacons with `asc=G` or no `asc`, in the no-choice or reject capture (har-audit CON-02 and CON-03; pass `--uet-mode advanced` only where UET is meant to fire denied before a choice). Checks CON-02, CON-03.
   - Wrong fix: gating only the conversion tags, or calling consent false after init; the base code has already sent its page events, and blocked OpenAI events are not replayed after a later grant.

7. Server route ignoring consent
   - Mechanism: the server container forwards to vendors without checking the consent state it received.
   - Detect: the reject capture shows the browser hit reaching the server container, and server Preview or logs show outgoing vendor requests for it. Check CON-07.
   - Wrong fix: blocking the browser hit, which also removes the cookieless data advanced mode allows.

## Conversions and values

8. Empty transaction_id
   - Mechanism: the purchase sends `transaction_id` as an empty string, so GA4 deduplicates every such purchase together (web streams only). With no parameter at all, GA4 cannot deduplicate the purchase or join it to an order.
   - Detect: the parameter present and empty, or absent, on purchase requests (har-audit CNV-03); GA4 transactions far below orders; the BigQuery no-ID query. Check CNV-03.
   - Wrong fix: generating a random ID in the browser, which breaks reload deduplication and order joins. In SPAs, the same mistake appears as a fresh ID each time the confirmation component mounts.

9. Two primary actions for one outcome
   - Mechanism: a website purchase tag and an imported GA4 purchase both count in Conversions and in bidding.
   - Detect: GAQL lists `WEBPAGE` and `GOOGLE_ANALYTICS_4_PURCHASE` actions in category `PURCHASE`, both with `primary_for_goal` true. Check CNV-06.
   - Wrong fix: deleting an action with history instead of making one secondary.

10. Tax, shipping or a static value in revenue
    - Mechanism: the value includes tax and shipping against the documented rule, or the action always uses its default value.
    - Detect: the test order's net value differs from the payload value (har-audit CNV-04 with `--order-value`); `always_use_default_value` true. Checks CNV-04, CNV-08.
    - Wrong fix: adjusting value rules in the platform to hide a site payload defect.

11. No-code conversion rules
    - Mechanism: Meta event setup tool rules or codeless Google Ads actions fire on clicks or URLs alongside coded conversions.
    - Detect: `ads_pixel_event_read` lists click-based Purchase or Lead rules; `WEBPAGE_CODELESS` actions are primary. Checks CNV-12, CNV-01.
    - Wrong fix: removing the coded conversion because the rule-based one shows higher volume.

12. Shopify order status scripts stopped
    - Mechanism: script tags on the order status page stopped running (Plus stores 28 August 2025, other stores 26 August 2026), so legacy purchase snippets went silent.
    - Detect: no purchase from the order status page in the journey capture; GA4 purchases drop from the cutover date; a CNV-10 gap. Checks CNV-10, EVT-01.
    - Wrong fix: re-adding the snippet to the theme; use a web pixel or the platform's supported events.

13. Embedded scheduler or form in a third-party iframe
    - Mechanism: a demo booking or form embed completes inside the vendor's frame. The parent page sees nothing, or fires its conversion on the click that opens the embed, and the markers never reach the embed.
    - Detect: an embedded frame from the vendor host in the journey capture (har-audit lists embedded frames, and CID-04 WARNs when the frame URL carries no marker), with no conversion on the parent page or one on the opening click. Checks CNV-01, CID-04.
    - Wrong fix: firing the conversion on the click that opens the embed. Take the outcome from the vendor's documented success message to the parent page (for example a postMessage event) and pass the markers into the embed URL or its hidden fields.

## Cross-domain and SPA

14. Payment return as referral
    - Mechanism: the visitor returns from an untaggable payment host and GA4 starts a session with that host as source.
    - Detect: the return page view carries the payment host as referrer with a session start or a new session ID (har-audit XDS-03, which also catches a hosted checkout on an owned subdomain that cannot be tagged); the processor appears as a session source in GA4. Check XDS-03.
    - Wrong fix: adding the processor to the cross-domain list, which cannot tag its pages.

15. Two SPA page view owners
    - Mechanism: enhanced measurement history page views stay on while GTM or the app also sends page views.
    - Detect: the route fixture count above expected; one location twice within 2 seconds (har-audit XDS-05). Checks XDS-05, CFG-04.
    - Wrong fix: dividing reported page views by two.

## Server-side routes

16. Browser pixel without the server's event ID
    - Mechanism: the Conversions API copy has `event_id` but the browser copy has no `eventID`, so Meta keeps both. TikTok and OpenAI Ads fail the same way without a shared `event_id`.
    - Detect: Meta conversion requests without `eid` while a server copy runs (har-audit SST-02; SST-03 for TikTok and OpenAI); Test Events pair not marked deduplicated; dataset stats by source near twice the orders. Checks SST-02, SST-03.
    - Wrong fix: turning off the server copy, which loses blocked and late events.

17. Mixed GA4 routes
    - Mechanism: some Google tags send directly and others through a server container or tag gateway, so one event can go both ways.
    - Detect: one measurement ID receiving the same event on two route classes within seconds (har-audit SST-04). A Google signals copy to `stats.g.doubleclick.net` is not a second route, and since 1 May 2026 server-side setups can add parallel browser signals; confirm extra Google requests in Tag Assistant before rating SST-04. Check SST-04.
    - Wrong fix: adding Measurement Protocol to fill gaps without a distinct event name.

## Click IDs, UTMs and CRM

18. Redirect drops the query string
    - Mechanism: trailing-slash, locale, http to https or consent reload redirects rebuild the URL without parameters.
    - Detect: the marker on the first request and absent on the final landing document after a 3xx (har-audit CID-01 names the hop). Checks CID-01, XDS-04.
    - Wrong fix: storing UTMs from the referrer or guessing the channel.

19. Hidden-field script lowercases or truncates click IDs
    - Mechanism: a capture script normalises values, or a CRM field is shorter than the ID.
    - Detect: the marker's case changed in the form POST (har-audit CID-04); CRM gclids with no upper-case letter from a release date, or lengths equal to the field maximum (crm-attribution-coverage). In HubSpot, compare the hidden-field custom property with HubSpot's own Google ad click ID, which HubSpot fills itself: when only the custom property is lowercased, the script is the cause. Checks CID-04, CID-05, CID-06.
    - Wrong fix: uploading the lowercased values; Google treats the GCLID as case sensitive and rejects or misses them.

20. Returning-visitor prepopulation overwrites hidden fields
    - Mechanism: a form setting refills fields for known contacts and replaces the captured value.
    - Detect: a second submission as an existing contact stores the old value. Check CID-05.
    - Wrong fix: writing click IDs on every submission without a first or latest touch policy.

21. Offline uploads stopped by the Data Manager API move
    - Mechanism: since 15 June 2026 offline conversion import and enhanced conversions for leads uploads go through the Data Manager API and are blocked in the Google Ads API; developer tokens that sent no request between January and June 2026 are not allowlisted for legacy access (Google Ads help 2998031).
    - Detect: a custom Google Ads API uploader in stack.md; the upload summary's last upload date stuck near mid-June 2026, or alerts; CRM outcomes since then with no matching uploads. Checks CID-08, CNV-09.
    - Wrong fix: replaying the whole backlog once a new route works without checking click dates; conversions uploaded more than 90 days after the click (63 for enhanced conversions for leads) are not imported.

## Personal data and test settings

22. GET forms leaking personal data
    - Mechanism: a validation error or thank-you redirect reflects form fields into the URL, which every tag then sends as the page location.
    - Detect: the test email in the page URL and in GA4 `dl`, Meta `dl`, LinkedIn `url` or HubSpot `pu` (har-audit PII-01, PII-02). It arrives double-encoded (`%2540`), so a raw search for "@" misses it, and it rides on in `dr` on the next page. Checks PII-01, PII-02.
    - Wrong fix: relying on GA4 data redaction alone; every other vendor still receives the URL.

23. Debug or test settings left live
    - Mechanism: `debug_mode`, test event codes or staging IDs ship to production.
    - Detect: debug flags on production GA4 requests outside the auditor's session (har-audit PII-05); test codes in server payloads; the BigQuery debug query. Check PII-05.
    - Wrong fix: setting `debug_mode` to false; remove the field instead, because its presence turns debug mode on.

## Collectors a request search can miss

24. Collector on a first-party host (CNAME or proxy)
    - Mechanism: analytics or a pixel collects on a host the site owns: a CNAME collector such as Adobe on smetrics.<site>, Snowplow on sp.<site>, a proxied PostHog, Segment or Meta path, or a server container data client. The requests look like the site's own traffic.
    - Detect: the scope sheet's first-party collection endpoints passed with `--collector-hosts`, which puts them in the inventory, CON-02, CON-03 and PII-01; own-host collector candidate WARNs on known collector paths; the not-checked line that lists other own-host requests with parameters or a body. Checks INV-06, CON-02, CON-03, PII-01.
    - Wrong fix: treating a first-party host as exempt from consent, or as proof that no vendor receives the data. The CNAME or proxy still forwards it.

25. Session replay or product analytics recording typed or URL personal data
    - Mechanism: masking is turned off or relaxed in the project settings, or an element is unmasked, so typed or displayed values are recorded; or the page URL travels inside an encoded payload (a base64 `data=` field, `$current_url` in an event), so a plain search of the request finds nothing.
    - Detect: har-audit's decoded search (PII-01 FAIL on a test value inside base64), its unreadable-body WARN for compressed or binary bodies, and a playback of the test session in the vendor's tool. Check PII-01.
    - Wrong fix: trusting default masking without reading the project setting.

## Platform calendar

Dated changes that silently break or change tracking. Recheck the Tag Manager release notes (answer 4620708) and the vendors' changelogs for anything newer.

- 28 August 2024: the Google tag's "Set consent mode override" setting can set a denied default for chosen regions from tag settings. When CON-01 finds two default owners, check it.
- 28 August 2025: Shopify order status page script tags stop for Plus stores.
- September 2025: Safari 26 limits known fingerprinting scripts' access to URL query parameters, the referrer and long-lived script-written storage. Safari Private Browsing already removed click-level tracking parameters before the request. Report both as limits; never rename parameters to get around them.
- 4 February 2026: Google Ads collects a broader range of website events, so expect more requests to Google domains in captures.
- 1 May 2026: server-side Tag Manager setups with Google Ads-linked GA4 properties gain parallel browser signals when Google signals is on. Expect extra Google requests next to the server route and confirm them in Tag Assistant before rating SST-04.
- 15 June 2026: offline conversion import and enhanced conversions for leads uploads move to the Data Manager API and are blocked in the Google Ads API (CID-08).
- 22 June 2026: Google recovers undercounted server-to-server conversions by joining browser signals such as cookies when a GCLID is present. As with 1 May, extra Google requests can sit next to the server route.
- 9 July 2026: GTM containers loaded with G- or AW- IDs run only Google-provided tags and variables.
- 26 August 2026: Shopify order status page script tags stop for all other stores.
- 1 October 2026: Shopify apps can no longer create or update storefront script tags.
- 8 October 2026: `gtag('config')` commands surface as `gtag.config` events in GTM.
- 12 October 2026: GTM containers can send data directly to Google destinations through destination tags, with centralised settings and user access in the container.
- 1 March 2027: Shopify storefront script tags stop running.