How to Set Up Google Ads Conversion Tracking with GTM

Every guide teaching you how to set up Google Ads conversion tracking with GTM stops at the wrong finish line. They walk you through creating a conversion action, grabbing your Conversion ID and Conversion Label, dropping a tag in GTM, publishing the container, and celebrating a green checkmark in Tag Assistant. The setup works. The tags fire. Data flows into your Google Ads account. And if the data flowing in is garbage, you have now built a machine that optimizes for garbage at machine speed.

This is not a critique of GTM. GTM is a brilliant traffic cop. It directs data where you tell it to go. The problem is what it cannot do: it has no mechanism to ask whether the conversion that just fired was a real human. It forwards bot clicks the same way it forwards your best customers. And when you add server-side tracking to recover the conversions ad blockers were hiding, you recover the bots too.

That is the gap every setup guide ignores. You will not find it in any checklist. You will find it in your ROAS three months after you thought you fixed attribution.

---

What everyone else explains (and what they leave out)

The standard setup has not changed much since iOS 14.5 broke pixel-based attribution in 2021. You create a conversion action in Google Ads under Goals > Conversions, grab your Conversion ID and Conversion Label, add a Google Tag in GTM, configure a Google Ads Conversion Tracking tag pointed at those IDs, set a trigger on your thank-you page or purchase confirmation event, test in Preview mode, publish. That part is real and it works. Every guide covering this is essentially correct on the mechanics.

What they do not cover is the data quality sitting inside the pipe they just built.

The Conversion Linker tag, which every proper setup includes, attaches the gclid (Google Click ID) to the user session. That gclid is how Google knows which ad click produced which conversion. If you add Enhanced Conversions, GTM hashes the user's email address with SHA-256 and sends it alongside the conversion event, allowing Google to match against logged-in Google accounts and recover conversions that cookie-based tracking missed. Match rates above 60% are considered healthy. All of this is correct.

Here is what is also correct: GTM will hash a bot's email address with exactly the same precision it hashes yours. It will attach a gclid to a click-farm session the same way it attaches one to a genuine buyer. Enhanced Conversions was designed to recover signal quality. If the signal going in is contaminated, Enhanced Conversions magnifies the contamination. Google's Smart Bidding then trains on it.

Fraudlogix 2026 data: global invalid traffic runs at 20.64%. Meta's average is 8.20%, with Instagram at 38% and Audience Network at 67%. Google's display network has its own IVT problem. The conversions you are sending to Google Ads via GTM include a percentage of that traffic. The exact share depends on your industry, your ad placements, and whether you have any filtering upstream of your tracking stack.

Finance and legal verticals run 42% bot rates. If you are in those categories and your ROAS has felt stubbornly wrong despite technically correct tracking, you now have a hypothesis.

---

The actual GTM setup (done correctly)

Before touching GTM, you need to know what you are building: a data pipeline. Pipelines do not validate data. They move it. Solve validity first, then build the pipe.

Step 1: Create the conversion action in Google Ads

In Google Ads, navigate to Goals > Conversions > Summary, click the plus button, select Website. Name the conversion something you will still understand in six months. Choose your category (Purchase, Submit lead form, Sign-up), set the counting method correctly: "One" for leads and sign-ups, "Every" for purchases where each transaction has independent value.

Set a realistic conversion window. Google defaults to 30 days. If your sales cycle is longer, extend it. B2B accounts with 90-day sales cycles feeding 30-day attribution windows will under-report and Smart Bidding will pull back on spend that is actually working.

Assign a conversion value if you have one. Fixed values are better than nothing. Order-level values from your dataLayer are better than fixed values. Blank values make tROAS bidding impossible and force Google to optimize for volume over revenue.

Pull the Conversion ID (looks like 123456789) and Conversion Label (looks like AbCdEfGhIjKlMnOp) from the tag setup tab. You need both.

Step 2: Configure the Google tag in GTM

Your GTM workspace needs a Google tag (formerly the Global Site Tag, gtag.js) firing on all pages. If you already have GA4 implemented via GTM, the Google tag is likely already present. Do not duplicate it.

In GTM, go to Tags > New > Tag Configuration > Google tag. Enter your Google Ads Conversion ID as the Tag ID. Set the trigger to All Pages. Publish. This is the foundation that lets the Conversion Linker capture gclid parameters from ad clicks.

One mistake worth naming: some accounts install the global site tag directly in their website's HTML and also add a Google tag in GTM. Now you have two global tags. Attribution works, but you will see inflated session counts in GA4 because the tag fires twice. Use one method, not both.

Step 3: Conversion Linker

Add a Conversion Linker tag in GTM. Tag Configuration > Conversion Linker. Enable linking on all URLs. Trigger: All Pages. This tag reads the gclid parameter from the URL when a user lands from a Google Ad and stores it in a first-party cookie. Without it, you can have a perfect conversion tag that fires and has no ad click to attribute back to.

The Conversion Linker is the tag most often missing from setups built by developers who looked up "Google Ads GTM" and followed a three-step tutorial. Its absence is invisible in Tag Assistant. The symptoms appear weeks later when your attributed conversions are lower than your actual sales and nobody can explain why.

Step 4: Google Ads Conversion Tracking tag

Tags > New > Tag Configuration > Google Ads Conversion Tracking. Enter the Conversion ID and Conversion Label. Set the trigger to the event or page view that represents your conversion: a specific page URL (your /thank-you page), a dataLayer event (purchase, generate_lead), or a form submission event.

If you are tracking purchase revenue, pull the transaction value from your dataLayer:

{{dlv - ecommerce.value}}

Variable type: Data Layer Variable, version 2. Your development team needs to push the ecommerce object to the dataLayer on the confirmation page before GTM loads. This is not a GTM configuration problem. It is a site implementation requirement. Most ecommerce platforms (Shopify, WooCommerce, Magento) have native dataLayer pushes you can enable or plugins that handle this.

Step 5: Enhanced Conversions

In GTM, edit the Google Ads Conversion Tracking tag. Look for the "Include user-provided data from your website" checkbox. Enable it. You have two configuration paths.

The data layer method requires your dev team to push customer data (email, phone, first name, last name, address) into the dataLayer when the conversion fires. This is the reliable method. The hashing happens before the data leaves GTM.

The automatic detection method lets GTM attempt to scrape form fields on the conversion page. This works for simple thank-you pages where customer information is visible in the page HTML. It fails for SPAs, for confirmation pages that do not render the user's data, and for any checkout flow that loads order confirmation data asynchronously.

Email is the most valuable field. If you can send hashed emails consistently, you will see the biggest match rate improvement. A match rate below 60% usually means emails are missing, improperly formatted, or inconsistently captured. Check the Enhanced Conversions implementation guide for the exact data layer schema and variable configuration.

Step 6: Consent Mode v2

If you have any EU, EEA, or UK traffic, Consent Mode v2 is mandatory as of June 15, 2026 for Google Ads. Without it, your Google Ads account loses access to modeled conversions for users who decline consent, and your Google Ads certification status is at risk.

Consent Mode sends two signals to Google: ad_storage (permission to set advertising cookies) and analytics_storage (permission to set analytics cookies). In GTM, this requires a Consent Initialization trigger that fires before any other tags, a Consent Mode configuration that sets default states, and integration with your CMP so that when a user accepts or rejects, the consent signals update.

The problem is your CMP. OneTrust, Cookiebot, and Usercentrics all load from third-party CDNs. uBlock Origin and Brave block those CDNs 30 to 40% of the time. The banner never loads. Consent is never captured. Tracking never fires for those sessions. You lose both the conversion data and the modeled conversion data that Consent Mode would have provided. You also never see it fail in your dashboard because there is no dashboard entry for "CMP failed to load."

A first-party CMP that loads from your own subdomain is not blocked. The banner renders on every session. Consent is captured. The Consent Mode signals fire correctly. This matters more than most tracking discussions acknowledge.

Step 7: Test before publishing

Use GTM Preview mode. Load your conversion confirmation page and verify three things: the Google tag fires on all pages, the Conversion Linker fires on all pages, and the Google Ads Conversion Tracking tag fires only on the conversion confirmation page or event. Check that the Conversion ID and Conversion Label in the tag match what Google Ads shows you.

Use Google Tag Assistant Recordings to simulate a full user journey: ad click simulation (append ?gclid=test to your landing page URL), browse to conversion, verify the gclid appears in the Conversion Linker cookie.

For Enhanced Conversions, check that the hashed data object appears in the tag's data. If you see null values in the user_data object, the dataLayer push is not working and you need to fix the site implementation before going live.

Publish only after tests pass. Publishing a broken container and hoping it self-corrects is how you end up with three weeks of missing conversion data and a Smart Bidding algorithm that optimized on two weeks of good data and one week of nothing.

---

Where the standard setup ends and the real problem begins

You have now built a technically correct GTM setup. Tags fire. Conversions are attributed. Enhanced Conversions sends hashed emails. Consent Mode handles EU traffic. Everything validates green.

The setup is correct. The data going through it may not be.

Google Tag Gateway, launched in January 2026, routes your Google tag traffic through your own domain instead of Google's servers. It recovers signals lost to ad blockers that block Google's CDN. It extends cookie lifespans on Safari. It takes five to ten minutes to configure through Cloudflare or GCP. The average uplift is around 11 to 14% more observed conversions. For Google-only attribution, it is a free, fast win.

It does nothing for Meta, TikTok, or LinkedIn. It has no bot filtering. It recovers the real humans and the bots together.

Server-side GTM hosted on Stape, Tracklution, or your own GCP Cloud Run instance solves a different problem: it moves the tag execution off the browser, reducing ad blocker impact further and giving you a single server-side endpoint that can fan out to multiple platforms. The first-party endpoint your browser sends data to is not on any filter list. You recover more real conversions.

You also recover more bot conversions. Server-side GTM has no event isolation layer. Events arrive in the container already mixed. Humans and bots. The container's job is to forward, not to judge. There is nowhere in the standard sGTM architecture that asks "is this a real person" before the event leaves your infrastructure.

PillarlabAI found this out the hard way. Four weeks, 4,560 signups. Only 730 real. 84% fraudulent. 650 accounts from one laptop. If those events had flowed through a server-side container into Google Ads, Smart Bidding would have learned to find more people like that laptop. The pipe would have been perfect. The signal would have been poison.

This is the Layer 5 problem. You solved the pipe. Nobody solved the water.

---

The architecture question nobody asks during setup

The standard GTM conversion tracking guide is missing one step: where do you filter before the data enters GTM?

GTM does not do this. Google Tag Gateway does not do this. Server-side GTM does not do this. Every one of these tools assumes the traffic arriving at your tags is worth tracking. In 2026, with global IVT at 20.64%, that assumption is wrong for most accounts.

The filtering has to happen upstream. Before GTM fires. Before the dataLayer push. Before any conversion event touches any tag container.

One architecture that handles this: bot-free CAPI with upstream IP validation that classifies each session against a known-entity database before any tracking fires. 361 billion IPs. Datacenter ranges, residential proxies, VPN endpoints, known bot subnets. A session from a flagged IP does not generate a conversion event. It does not reach GTM. It does not reach Enhanced Conversions. It does not reach Smart Bidding.

The difference in outcomes is not theoretical. When you stop feeding Google's algorithm bot conversion patterns, it stops optimizing toward bot traffic. ROAS improves not because you sent more conversions, but because the conversions you sent were real.

---

The Google Ads CAPI landscape in 2026

You have more options for sending conversion data to Google than the standard GTM pixel. The category has changed significantly in the past eighteen months.

Google Tag Gateway (free)

Launched January 2026. Free. One-click deployment via Cloudflare or GCP Load Balancer. Routes Google tag traffic through your domain. Recovers conversions lost to CDN-level ad blocking. Extends Safari cookie lifespans from 24 hours to 7 to 30 days. Adds roughly 11 to 14% more observed conversions on average.

Right for: anyone running Google Ads only, any budget level, as a first step before more complex server-side architecture. The obvious move for any account not already using first-party transport for Google tags.

The limitation is what it does not cover: Meta, TikTok, LinkedIn, and every other platform. It is also a closed system. You cannot transform data, enrich events, or do anything except proxy Google tag traffic. No bot filtering. No custom logic.

Value 7/10. Price: free.

Server-side GTM (Stape)

Stape is the most established managed sGTM hosting platform. $17/month Pro tier, $83/month Business tier, plus Cloud Run compute on GCP running $50 to $300/month depending on traffic. Over 80 tag templates covering Meta CAPI, Google Ads Enhanced Conversions, TikTok Events API, LinkedIn, and more. Strong documentation. Large community.

What works: Stape genuinely solves the browser-blocking problem for every platform in your stack, not just Google. The custom domain setup (your tracking subdomain points to Stape's infrastructure) is not on filter lists. The template library is the deepest in the category. If you have an in-house GTM engineer who already knows the platform, Stape is a natural infrastructure upgrade.

What does not work: Stape requires GTM expertise. You need to understand triggers, variables, clients, and tags to operate it correctly. There is no bot filtering built in. Whatever arrives at the Stape endpoint gets forwarded, including bots and datacenter traffic. You also need to manage the Cloud Run instance or pay for Stape's managed hosting. The total cost is rarely just $17/month once you account for compute.

Right for: agencies and in-house teams with dedicated GTM engineers who want full container control and the most flexible template ecosystem.

Value 7/10. Price: from $67 to $383/month total (Pro + Cloud Run).

Tracklution

EU-based server-side tracking platform with Meta CAPI, Google CAPI, and TikTok Events API. €31/month entry, custom for enterprise. SOC 2 and ISO 27001 certified, which matters for regulated industries and larger enterprises that need audit documentation. Has a built-in consent management option. Straightforward setup relative to raw sGTM.

What works: The compliance certifications are real differentiators for EU-focused operations and any client requiring third-party security audits. The pricing is transparent. The Google Ads setup is clean and well-documented.

What does not work: No bot filtering. Like every other server-side tool in this category, Tracklution forwards the traffic it receives without validating it. Small EU agencies with simple Meta plus Google setups will find this sufficient. Larger accounts with IVT exposure will not.

Right for: EU-focused agencies and advertisers needing certified compliance documentation alongside server-side delivery.

Value 7/10. Price: €31/month Starter.

Elevar

Shopify-native server-side tracking with order-level conversion fidelity. $200/month Essentials (1,000 orders), $950/month Business (50,000 orders). Deep integration with Shopify's checkout flow. Google Ads Enhanced Conversions and GA4 implementation is clean. The platform was built specifically for ecommerce attribution accuracy.

What works: Order-level data accuracy. Elevar captures the actual transaction ID, revenue, and item data in ways that generic GTM setups often miss. If you run a Shopify store doing meaningful revenue, the attribution quality is genuinely better than a standard pixel setup.

What does not work: Shopify-only. No B2B SaaS, no WooCommerce, no custom stacks. Pricing scales steeply. No bot filtering. A high-volume store doing $5M/year with Elevar at $950/month is still feeding Google's algorithm unfiltered traffic.

Right for: Shopify-only brands doing $500K+ GMV/year where order-level attribution accuracy justifies the premium.

Value 6/10. Price: $200 to $950/month.

Aimerce

Server-side tracking with Shopify focus. $299/month base, usage-based above 1,000 orders. Positions itself as a simpler alternative to Elevar with comparable Shopify integration depth. Has Google Ads and Meta CAPI.

What works: Cleaner onboarding than building raw sGTM. The Shopify connector is solid. For teams that want managed server-side without the GTM complexity, Aimerce reduces setup friction.

What does not work: Same bot filtering gap as every other tool in this section. Pricing at $299/month base is harder to justify against Elevar's $200/month with more established Shopify credibility. No LinkedIn. No TikTok on base plan.

Right for: Shopify brands that want simpler sGTM onboarding and do not need the full Elevar feature set.

Value 5/10. Price: $299/month base.

Littledata

Google Analytics 4 and Google Ads tracking for Shopify and headless commerce. $89/month entry, scales by order volume. Strongest at bridging Shopify's native data model into GA4's event schema accurately. Server-side component handles conversion recovery.

What works: If your primary tracking problem is Shopify-to-GA4 data accuracy (missing sessions, broken attribution from Shopify's checkout redirect, server-side purchase events), Littledata solves it well. The Google Ads conversion data quality improves as a downstream effect of cleaner GA4 data.

What does not work: Limited to Shopify and a few headless platforms. No bot filtering. Less capable than Elevar for multi-platform CAPI. The pricing model is order-volume based, which gets expensive fast for high-volume stores.

Right for: Shopify stores whose primary pain is GA4 data quality rather than CAPI coverage breadth.

Value 6/10. Price: $89/month+.

TrackBee

European server-side tracking platform. €79/month entry. Meta CAPI and Google Ads Enhanced Conversions. Targets mid-market ecommerce brands.

What works: Decent setup documentation. EU data residency option. Reasonable pricing for the functionality delivered.

What does not work: Newer platform. Smaller template library than Stape. No bot filtering. Limited platform coverage: no LinkedIn, no TikTok on entry plans.

Right for: European ecommerce brands wanting a mid-market managed server-side solution without the complexity of raw sGTM.

Value 5/10. Price: €79/month.

Addingwell (now Didomi)

Addingwell was acquired by Didomi in April 2025 for $83M. The combined platform offers server-side tagging alongside Didomi's TCF 2.2 consent management. Free tier to 100K requests/month, paid tiers Euro-based. The acquisition is the clearest signal that the market recognizes the bundling of CMP and server-side tracking as the correct architecture.

What works: The CMP plus server-side combination is the right answer for EU-focused operations. Didomi has legitimate enterprise consent management credibility. The free tier is accessible.

What does not work: Still two products being integrated post-acquisition. The combined platform does not yet have the cohesion of tools built as unified stacks. No bot filtering. Pricing above the free tier requires scoping.

Right for: EU enterprise operations that need a certified CMP alongside server-side tagging and want a single vendor relationship.

Value 7/10. Price: free to 100K requests, Euro-based above that.

Datahash

Enterprise server-side data clean room and CAPI platform. Custom pricing, most accounts $500 to $2,000/month. Has Google Ads Enhanced Conversions, Meta CAPI, LinkedIn CAPI. Strong on hashed first-party data quality and match rate optimization.

What works: If you have CRM data you want to match against Google and Meta's identity graphs, Datahash handles the matching and hashing infrastructure better than most tools. Enterprise compliance documentation is strong.

What does not work: Sales-led pricing and minimum spend thresholds make this irrelevant for SMBs. Setup requires data engineering involvement. No bot filtering upstream of the events being sent.

Right for: Enterprise accounts with existing first-party data pipelines looking to maximize CAPI match rates.

Value 6/10. Price: custom, $500 to $2,000/month typical.

Cometly

Attribution and CAPI platform targeting DTC ecommerce. $199 to $499/month. Google Ads Enhanced Conversions alongside Meta CAPI. Has a revenue attribution dashboard that shows which ads drive actual revenue, not just clicks.

What works: The attribution dashboard is clearer than Google Ads' native interface for understanding cross-campaign performance. Setup is faster than raw sGTM for ecommerce use cases.

What does not work: Pricing is aggressive for what amounts to a managed CAPI layer with a dashboard. No bot filtering. No LinkedIn or TikTok on entry plans. The attribution dashboards overlap with tools like Triple Whale if you are already paying for one.

Right for: DTC brands spending $20K to $100K/month on Google Ads who want consolidated attribution reporting with server-side delivery but do not need multi-platform CAPI breadth.

Value 5/10. Price: $199 to $499/month.

Triple Whale

Attribution dashboard for Shopify ecommerce. $179/month annual, $259/month Advanced. Not primarily a CAPI tool, but has Pixel and CAPI integration as part of its attribution layer. Does Google Ads and Meta attribution.

What works: The attribution intelligence is the point. Triple Whale's dashboard gives you a blended view across Meta, Google, TikTok, and email that Google Ads' own reporting cannot produce. For Shopify brands with multi-channel spend, the dashboard pays for itself in budget reallocation clarity.

What does not work: You are buying an analytics layer, not a data pipeline. Triple Whale ingests whatever your existing tracking sends. If your pixel data is corrupted by bots or ad blockers, Triple Whale charts it beautifully. Garbage in. Beautifully charted garbage out. No bot filtering.

Right for: Shopify brands with $100K+/month in ad spend across multiple platforms who need cross-channel attribution intelligence, not raw tracking infrastructure.

Value 7/10. Price: $179 to $259/month.

Northbeam

Enterprise attribution platform. $1,500/month entry, scales to $5,000 to $10,000+/month for higher volumes. Multi-touch attribution modeling that runs independently of platform-reported data. Has Google Ads and Meta coverage.

What works: The attribution modeling is genuinely sophisticated. Northbeam builds its own attribution model from your first-party data rather than trusting what Google Ads or Meta report back. For accounts where platform-reported ROAS diverges significantly from business reality, Northbeam closes that gap.

What does not work: At $1,500/month minimum, this is an enterprise tool. The attribution modeling takes time to calibrate. Like Triple Whale, Northbeam is a measurement layer. It does not filter bots from the conversion events it ingests.

Right for: Enterprise ecommerce and DTC brands with $500K+/month in ad spend where attribution accuracy has direct budget implications.

Value 6/10. Price: $1,500/month+.

SignalBridge

A smaller player with a notable differentiator: it actually has bot filtering. $29/month. Has Meta CAPI and Google Ads Enhanced Conversions. The bot filtering is lighter than dedicated fraud platforms, but it is present.

What works: The price is accessible. The combination of server-side delivery with at least some bot filtering puts it in a different category than tools that deliver everything without validating anything. For budget-constrained accounts that understand the IVT problem, SignalBridge is worth evaluating.

What does not work: Smaller platform, less established than Stape or Elevar. Limited template coverage. No LinkedIn or TikTok. The bot filtering is not at the depth of a dedicated IP database.

Right for: SMBs that understand the data quality problem and want a low-cost entry point with basic bot filtering included.

Value 7/10. Price: $29/month.

DataCops

First-party analytics, bot-free Google CAPI, Meta CAPI, TikTok Events API, LinkedIn Insight CAPI, and first-party CMP in one architecture. Business plan at $49/month covers 50,000 sessions and all four CAPI platforms with bot filtering. Setup is one script tag and one CNAME record. Works on Shopify, WooCommerce, Webflow, and custom stacks without a developer.

The bot filtering happens before any event fires. 361 billion IPs, covering datacenter and cloud ranges, residential proxies, VPN endpoints, and known fraud subnets. A session flagged by the IP database does not generate a conversion event. It does not reach GTM. It does not reach Enhanced Conversions. It does not contaminate Smart Bidding. The Google CAPI integration sends filtered events server-side with Enhanced Conversions data included.

The first-party CMP loads from your subdomain, not a third-party CDN. uBlock and Brave do not block it. The consent banner renders on every session. Consent Mode v2 signals fire correctly. For EU traffic, this is the piece that makes the rest of the stack function as designed.

The cookieless identity resolution means returning users are identified without cookies. No ITP degradation. No 7-day Safari expiry. No browser-based deletion. For Google Ads attribution, this means the gclid-to-conversion path is intact even for returning customers on Safari who cleared cookies between their first visit and their purchase.

What works: the only tool in this list that combines bot filtering, first-party CMP, and multi-platform CAPI at SMB pricing. The PillarlabAI case: 4,560 signups, only 730 real. 84% fraudulent. 650 accounts from one laptop. With upstream bot filtering, none of those events reach Google Ads. Smart Bidding learns from 730 real conversions, not 4,560 contaminated ones.

What does not work: SOC 2 Type II is in progress, not completed. For enterprise procurement requiring current certification, that is a real constraint. Newer brand than Stape or Elevar. Integration catalog is narrower: HubSpot on Business and above, no Pinterest, no Snapchat. If you need Snap CAPI or Pinterest conversion tracking, DataCops is not the tool today.

Right for: SMBs and mid-market brands running Google Ads alongside Meta, TikTok, or LinkedIn who want bot-filtered CAPI with a compliant CMP in one setup at under $50/month.

Value 9/10. Price: $49/month Business (CAPI starts here), $7.99/month Growth (analytics only, no CAPI), $299/month Organization for higher session volumes.

---

When NOT to use DataCops

You run Shopify at $1M+/year GMV and need millisecond-accurate order-level attribution with Shopify's native checkout data. Elevar was built for exactly this. The order-level fidelity and native Shopify integration at that revenue scale justify the $200 to $950/month.

You have an in-house team of GTM engineers who want full container control and the flexibility to build custom tag logic. Stape gives you that control with 80+ templates and a community of practitioners. DataCops is a managed outcome, not an infrastructure layer you operate yourself.

You need SOC 2 Type II certification today for enterprise procurement or compliance audits. Tracklution has both SOC 2 and ISO 27001. DataCops' certification is in progress.

You are running Google Ads only, with no Meta, TikTok, or LinkedIn spend, at a small budget. Google Tag Gateway is free and covers your use case without any monthly spend.

---

The comparison that matters

No tool in this table except DataCops filters bot traffic before events reach Google. Every other tool delivers whatever arrives at the endpoint.

---

The question the setup guides do not ask

Project Andromeda, fully deployed October 2025, acts on contaminated conversion signals within hours, not weeks. Google's bidding algorithm does not wait for you to audit your data. It trains continuously on whatever you send. An account feeding bot conversions is an account training its bidding algorithm to find more bots, within hours of each contaminated event.

The Shopify App Pixel default changed to "Optimized" on January 13, 2026, with no notification. Throttled pixels when iOS strips fbclid. Merchants who did not know this happened are running attribution on a throttled pixel and building budgets on whatever that produces.

GTM is not the problem. The problem is what GTM receives.

You can follow every step in this guide correctly. Conversion Linker installed. Tags validated. Enhanced Conversions firing. Consent Mode configured. Server-side container recovering blocked events. Everything green in Tag Assistant.

The question is: of the conversions you sent Google last month, what percentage were real humans completing real actions? Can you put a number on it? If you cannot, you are not running conversion tracking. You are running a machine that optimizes on assumptions you have never tested.

What does your filtering layer look like before GTM fires?

---

Related: Advanced Conversion Tracking: The Technical Implementation Guide that Fixes the Foundation · API-to-API Conversion Tracking Setup · AI + Meta CAPI: The 2026 Conversion Stack · B2B Conversion Tracking Best Practices · Best Click Fraud Protection 2026