The athletics site is vendor-hosted on Sidearm Sports and already carries tags nobody at Guilford installed. This runbook covers what is on it today, how to get Guilford's container onto a template you cannot edit, and the cross-domain and consent configuration that makes the data usable next to guilford.edu.
Read from the live homepage on 27 Jul 2026. Everything below arrived with the Sidearm template — none of it was installed by Guilford, and none of it reports into the guilford.edu property.
| Type | ID | How it loads | What it does |
|---|---|---|---|
| GTM container | GTM-TW6R675 | Hardcoded in the Sidearm template, plus a <noscript> iframe. | Ships the Sidearm dataLayer — dataLayerLoaded, schoolAttributes, ssClientID 2047. Vendor-owned; leave it alone. |
| GTM container | GTM-K3TH4CC | Hardcoded, second container, loads in parallel. | Owner unconfirmed. Check your GTM account first — if Guilford owns this one, there is nothing to install. |
| GA4 | G-9ZEY3G5WQF | Hardcoded gtag.js in <head>, not via GTM. | An athletics-only GA4 property, entirely separate from guilford.edu's 359308554. |
| Universal Analytics | UA-195038689-33 | Present as a dataLayer value only. | Dead — UA stopped processing in July 2023. Vestigial, harmless, remove opportunistically. |
1 · There is no consent gate. No consent platform is present, and gtag('consent', …)
is never called. Analytics and any advertising tags on the athletics site currently fire for every
visitor from the first millisecond, with no opt-in and no way to withdraw. The consent banner built for
guilford.edu does not cover this domain.
2 · The two sites do not share sessions. guilfordquakers.com shows up as a
referral source in guilford.edu's GA4 today. A prospect who reads a roster page and then clicks
through to Admissions is counted as two people on two sessions, and the athletics half of the journey
is credited to a referral rather than to the channel that actually earned it.
GTM-K3TH4CC. If it is
in Guilford's account, skip section B entirely — the container is installed and you only need the
configuration in C.359308554.Sidearm is a hosted platform. There is no <head> you can open in a text
editor, so the usual "paste it in the theme" instruction does not apply. Three routes, best first.
Sign in to the Sidearm CMS and look under Settings → Integrations / Tracking (wording varies by contract tier) for a custom-code or third-party-tracking field. Where the field exists, paste the container ID or the head snippet there and save. It applies site-wide with no ticket.
If there is no such field — common on standard tiers — raise a ticket with Sidearm support. Give them all four of these, or it will bounce back:
<head> as possible; noscript snippet
immediately after the opening <body>.If GTM-K3TH4CC turns out to be Guilford's, stop. Adding a third container would just
double-fire everything. Go straight to section C.
<!-- Google Tag Manager -->
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-XXXXXXX');</script>
<!-- End Google Tag Manager -->
BODY SNIPPET — IMMEDIATELY AFTER <body>
<!-- Google Tag Manager (noscript) --> <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-XXXXXXX" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript> <!-- End Google Tag Manager (noscript) -->
Containers coexist safely. GTM-TW6R675 carries Sidearm's own reporting and the school
dataLayer; deleting it breaks the vendor's analytics and buys nothing.
Installing the container is the easy half. These three settings are what turn two disconnected sites into one measurable journey.
In GA4, open Admin → Data streams → the guilford.edu web stream → Configure tag settings → Configure your domains. Add every domain in the journey:
Then fire the same measurement ID on both sites from the container. Sharing the ID is
what lets GA4 stitch the session; listing the domains is what lets the linker pass the client ID across.
One without the other does nothing. Finally add guilfordquakers.com to
Admin → Data streams → List unwanted referrals so the old referral rows stop accruing.
None of this takes anything away from the athletics team. G-9ZEY3G5WQF keeps running
exactly as it does now — a page can send to two GA4 properties at once. Guilford's stream is added
alongside it. Report athletics separately with a hostname comparison inside property
359308554, and nobody has to give up their numbers.
Consent Mode defaults must be pushed before the container loads. On guilford.edu the banner script does that directly. Here you cannot guarantee script order — so set the defaults inside the container instead: create a Consent Mode default tag on the built-in Consent Initialization — All Pages trigger, which GTM guarantees to run before every other tag.
Deny everything except security_storage, then have the Guilford banner's
consent_update dataLayer event drive the update. The banner already pushes it, so the same
categories mean the same thing on both domains.
G-9ZEY3G5WQF is hardcoded — so if you ever move athletics into 359308554,
strip the hardcoded gtag in the same change, not after.Do all of this in Preview before publishing. A container published wrong on a vendor template is slow to unwind, because the rollback goes through the vendor too.
https://guilfordquakers.com. Tag Assistant should connect and show your container
alongside the vendor containers. If it never connects, the snippet is not on the page yet — go back
to the Sidearm ticket.359308554: with
Preview on, a page view from guilfordquakers.com should appear within seconds. Check the
hostname on the event._gl= parameter, and DebugView should
not show a new session_start. A new session at the boundary means the domain list
in C·1 is wrong.guilfordquakers.com should stop appearing as a referral. It will not disappear
retroactively — you are watching for new rows to stop.Work in this order: (1) consent is denied by default, so nothing fires until you accept — that is correct behaviour, not a fault; (2) the snippet may be on the homepage only, so test an interior roster page; (3) an ad blocker will silently drop GTM, so retest in a clean profile.
Found during the 27 Jul audit. None of them block the install — but a Sidearm ticket is slow to open and cheap to extend, so send them together.
The hardcoded athletics GA4 config sets user_id to crypto.randomUUID() — a fresh random value on every single page load. GA4 treats each one as a different signed-in person.
User counts, returning-user rates and any user-scoped audience on G-9ZEY3G5WQF are currently meaningless. Sessions and page views are unaffected.
Remove the user_id parameter, or set it to a genuinely stable identifier. Sidearm ticket, same as the install.
No consent platform is present and gtag('consent', …) is never called, so tags fire before any opt-in.
A compliance exposure on a public-facing college domain, and it will skew any before/after once consent does land.
Ship the Consent Initialization tag in C·2 with the container — do not treat it as a later phase.
Both GTM-TW6R675 and GTM-K3TH4CC load on every page, each with its own noscript iframe.
Duplicate containers routinely double-fire the same events, and they compete for the shared dataLayer.
Audit what each one fires before adding a third. If one is Guilford's and idle, use it instead of installing.
UA-195038689-33 is still published in the Sidearm dataLayer payload.
Harmless — UA stopped processing in July 2023 — but it misleads anyone auditing the site.
Remove opportunistically, bundled into the next Sidearm change. Not worth its own ticket.