Who has access to your Google Tag Manager and Google tag, and what can they change?
Anyone who can publish your Tag Manager container can change what loads on your site. Here's what each permission allows and how to review the list.
The short answer
Tag Manager access is set at the account level and for each container, and anyone with publish permission can change what runs on your live site. The Google tag and GA4 have their own user lists. These lists are easy to forget once a site launches. Open each one and ask who every person is and whether they still need that level.
On this page
What each permission allows
Google sets Tag Manager access at two levels.
| Level | Permission | What it allows |
|---|---|---|
| Account | User | View basic account information |
| Account | Administrator | Create containers and change permissions for the account and its containers |
| Container | Read | See the container's tags, triggers and variables, with no changes |
| Container | Edit | Create workspaces and make changes, but not create versions or publish |
| Container | Approve | Create versions and make changes, but not publish |
| Container | Publish | Everything above, plus publish |
Publishing is what reaches your visitors. A published version becomes active on the site, so anyone with publish permission can add, change or remove what loads there. Approval steps that hold a change until someone signs off are only in Tag Manager 360.
The Google tag has its own users and roles. Its Publish permission lets a person update the tag's settings, which is separate from container access. GA4 has five roles, from Viewer to Administrator, set for the account or the property.
How to review it
The lists live in three places. In Tag Manager, open Admin and then User Management for the account and for each container. The Google tag's users are under its Admin tab. In GA4, open Admin and account or property access management.
For each name, I ask three questions.
- Who is this?
- Do they still work with us?
- Do they need this level, or would Read or Edit do?
Tag Manager also keeps a publish history showing who published each version and when, and GA4's change history shows who changed account and property settings. Both help when you find a name you don't recognize.
Where access hides
- Former agencies and freelancers. People who set up tracking years ago keep their access until someone removes it.
- Containers someone else owns. A checkout, booking or chat vendor may run its own container on your pages.
- More than one container on a page. Each has its own user list.
One finding from audits shows how far this goes. A third-party checkout ran three Tag Manager containers owned by three different parties, and one held changes nobody had published.
What a tag you didn't add can do
A tag added by someone outside your team may not wait for your cookie banner, or may send data your privacy policy doesn't mention. Whether tracking follows the choice covers how to test that, and the audit checklist lists what I check in the container.
Questions about Tag Manager access
Who can publish changes to my Tag Manager container?
Anyone with Publish permission on that container. Account administrators can also change who has which permission.
Can I see who published a change?
Yes. Tag Manager keeps a publish history that shows when each version went live and who published it.
Should our agency have publish access?
That's your call. If they make changes for you, they need it. When the work ends, lower their access to Read or remove it.
