Overview
This check compares the full tag inventory observed on every crawled page against your approved tag/vendor list and flags any tag not on that list, commonly introduced by a marketing team member through the tag manager, a vendor pixel embedded directly in page code, or a piggyback request from another already-approved tag.
Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific CCPA/CPRA compliance obligations.
Why it is important
A rogue or unapproved tag hasn't been reviewed for its data-sharing implications and, by definition, cannot be covered by your existing privacy disclosures, vendor contracts, or opt-out enforcement rules. It is one of the most common sources of unintentional CCPA violations precisely because it bypasses every governance control built for approved tags.
Implementation
Maintain your approved tag/vendor list as a labeled set in ObservePoint and run a scheduled Tag Inventory audit.
Check the pre-built ObservePoint report for No Unapproved Tags Firing on Any Page.
For any tag in the report above, use
find_first_observedto trace it back to the deployment or publish that introduced it.
Remediation
For remediation, follow the next steps:
For each unapproved tag, first determine whether it was introduced directly (someone added it to the tag manager without governance review) or via piggybacking (an already-approved tag loading a secondary, unapproved script). The remediation path differs significantly between the two.
Direct additions should be removed or routed through your "No Vendor, No Tag" approval process (see Documentation & Processes) before being re-added; piggybacked tags require working with the parent vendor to disable the secondary load, since removing the parent tag isn't an option if it's legitimately approved.
Once remediated, add the tag to either your approved list (if it passes review) or a blocklist Rule to prevent recurrence, and re-run the Tag Inventory audit to confirm it no longer appears.
Conclusion
Because unapproved tags fall completely outside every other control in this framework (they aren't in your CCPA sale/share inventory, aren't covered by disclosures, and aren't subject to opt-out enforcement rules) closing this gap first makes every other Tag Behavior check meaningfully more trustworthy.