Overview
This check inventories every tag account observed on the property and flags any secondary ad-network pixel or sub-vendor script loaded by an already-approved tag, rather than deployed directly through your own tag-management container.
Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific CIPA compliance obligations.
Why it is important
An approved vendor silently loading a secondary tracking script functions as an unauthorized interceptor in exactly the same way an unapproved tag would. The fact that the parent tag was properly reviewed and authorized does not extend that authorization to whatever else the vendor's own script chooses to load.
This is a distinct risk from a standard "unapproved tag" finding because the piggybacked script never goes through your governance process at all; it arrives bundled inside a tag you already trust.
Implementation
Create a consent category called something like "Approved Vendors - CIPA Register," and add every tag and tag account you've actually authorized to it, down to the specific account, not just the vendor name, since a piggybacked script runs under its own account ID and won't be covered just because its parent vendor is approved. Attach the category to the Audit covering the site.
Use this pre-built ObservePoint report template to check for pages with unapproved tags, besides the ones in your approved list.
After saving the report, create a scheduled export to automatically deliver the list of unapproved tags to you inbox on a cadence. Effectively alerting users and including the context surrounding the unapproved tags.
Remediation
For remediation, follow the next steps:
For each unmapped tag account the alert surfaces, first confirm with the parent vendor whether the secondary account is a legitimate part of their own service (a CDN or infrastructure sub-account, for example) or an actual third-party partner-sharing integration bundled into their script.
Where it's a genuine secondary interceptor, work with the vendor to disable the specific sub-integration or partner-sharing feature within their platform. Removing the parent tag isn't an option if it's legitimately authorized and needed.
Once a sub-account is confirmed legitimate, add it to the approved consent category, rather than noting it in a separate document. The category itself is the register going forward, so this is the step that actually clears the alert rather than just explaining it away. Re-run the audit to confirm the alert no longer fires for that account.
Conclusion
Because a piggybacked script hides behind a tag you already trust, this check is only meaningful if it's run on a recurring cadence against a maintained account-level Vendor Register. A one-time review only catches what's piggybacking today, not what a vendor might add in a future script update.