A read of nexo.com's public tag, consent and attribution setup, compared with five peers, with a plan for each JD duty and a working tracking QA desk that runs the same audit on any site.
GTM, GA4 with Consent Mode defaulting to denied, Segment, Adjust and OneTrust with region rules. Most ad pixels carry a tag-level consent setting.
Five vendors' tags have no GTM consent setting. In a browser test as a visitor from Germany, Meta, OpenAI Ads, Ahrefs and Segment sent events before any choice (§★).
Every homepage app link uses one Adjust campaign value with no ad group or creative, so installs cannot be traced to a page or button.
5 GA4 measurement IDs and 3 Google Ads accounts in one container, and two event-naming styles. One schema and a mapping table make them joinable.
Read from nexo.com's page HTML, the published GTM container and the public OneTrust configuration on 31 Oct 2026.
| Layer | What is live | What it means for the role |
|---|---|---|
| Tag manager | GTM‑NWGJNHR version 144: 71 entries, 57 firing tags, 9 auto-event listeners, 5 paused | A busy container. Peer review and a change log matter more than new tags. |
| Analytics | GA4 G‑WCQVMDL2Y6 in the page; 5 GA4 IDs referenced in the container. Consent Mode default: all 7 types denied, wait_for_update 500 | The right default. Which property feeds which report is the first question. |
| CDP | Segment analytics.js 4.16.1 served from a first-party proxy (sa.nexo.com, API sa-api.nexo.com). Public source settings: GA4, Meta Conversions API and Google Enhanced Conversions destinations, a Google Ads plugin. GTM custom HTML sends AB Test Progress and CTA Clicked | Segment is the second event stream and the server-side path to Meta and Google; its naming differs from GA4's. |
| Ads and pixels | Google Ads (3 accounts), Meta, X, LinkedIn, Reddit, Quora, TikTok, AdRoll, OpenAI Ads, Addressable, Loudecho | Eleven ad platforms, each with its own consent and deduplication rules. |
| Consent | OneTrust SDK 202411.2.0, 4 rules: GDPR opt-in (40 countries incl. UK), LGPD opt-in (Brazil), CCPA and Global notice only. Google Consent Mode on in all 4; GPP off | Tag gating by jurisdiction is set in OneTrust; GTM has to honour it per tag. |
| Mobile attribution | Adjust tracker 538tuyd on 20 homepage app links (Google Play and App Store) | Web-to-app is a measurable channel once links carry their source. |
| Forms and SEO | A Salesforce site flow bridged into the dataLayer by postMessage; Ahrefs Web Analytics | Two more data flows that need a PII review. |
The same audit run on peers' homepages on 31 Oct 2026. "GTM consent setting" counts non-Google tags with a tag-level consent requirement; a site can also gate tags with triggers or its own CMP, so this measures one method.
| Site | Container version | Firing tags | Non-Google tags with a GTM consent setting | GA4 IDs | Ads accounts | CMP in page HTML |
|---|---|---|---|---|---|---|
| Nexo | 144 | 57 | 23 of 37 | 5 | 3 | OneTrust |
| YouHodler | 83 | 145 | 30 of 58 | 1 | 9 | none found |
| Crypto.com | 348 | 60 | 0 of 27 | 2 | 5 | none found |
| Ledn | 186 | 61 | 0 of 43 | 1 | 1 | none found |
| Gemini | 62 | 24 | 0 of 12 | 1 | 2 | none found |
| OKX | 55 | 22 | 0 of 6 | 2 | 2 | OneTrust |
| Kraken, Binance, Bitpanda | No GTM container in the page HTML (tags load another way) | Kraken: OneTrust | ||||
Coinbase and Revolut refuse automated fetches. Counts are a snapshot of the published container.
What I would raise in week one, from public files and a browser test. Each is a question to confirm with the team, since intent and contracts are invisible from outside.
X, LinkedIn, Reddit, Quora, TikTok, AdRoll and Loudecho tags all require ad_storage, and Addressable requires analytics_storage. The tags below have no tag-level setting:
| Vendor | Tags | Browser test, visitor in Germany, before any choice |
|---|---|---|
| Meta Pixel | 7 | PageView sent in 12 of 12 runs on 4 pages, plus card_view, earn_view, borrow_view; _fbp set. The tag template calls fbq('consent','grant') on load, while OneTrust lists _fbp under C0004, which had not been granted |
| OpenAI Ads Pixel | 2 | Events posted to bzr.openai.com in 12 of 12 runs. Not in the OneTrust vendor list |
| Ahrefs Analytics | 2 | Events posted to analytics.ahrefs.com in 12 of 12 runs. Not in the OneTrust vendor list |
| Segment (calls from GTM) | 2 | Page events sent to sa-api.nexo.com with an anonymousId and no consent field, 12 of 12 runs; ajs_anonymous_id (OneTrust C0003) set |
| Salesforce form bridge | 1 | Listens for the form's postMessage; sends nothing on its own |
The gating that is configured works: LinkedIn, TikTok, X, Reddit, Quora and AdRoll stayed silent until Accept, then fired. GA4 sent cookieless pings (gcs=G100) before a choice and switched to G111 after, as Consent Mode is designed to do.
Method: 4 pages, 3 fresh browser contexts each, OneTrust's geolocation override set to DE, no interaction for 15 seconds, repeated by a second independent script. In every run the banner showed and only strictly necessary cookies were active. The override changes only OneTrust's country; anything decided from the visitor's IP still saw Malaysia, so a run from an EU address is the confirming step.
All 20 app-store links on the homepage use tracker 538tuyd with campaign=direct and empty adgroup. Setting campaign, ad group and creative from the page slug, section and button in the shared app-badge component would attribute every install to the page that drove it. The demo's link builder shows the pattern.
The page loads G‑WCQVMDL2Y6; the first GA4 hit in the test went to G‑PDV3L12DHB. Likely deliberate (product lines, regions, tests). Worth one table: property, purpose, owner, which dashboards read it.
GA4 and pixels use sign_up_click, card_view, section_engaged_view; Segment uses CTA Clicked, AB Test Progress. One tracking plan with a column per destination keeps BI joins simple (§05).
The page calls analytics.load on every visit, and the source settings carry no consent block while forwarding to Meta Conversions API and Google Enhanced Conversions. Consent may be applied in destination filters or server side, which is invisible from outside. Worth confirming that OneTrust categories reach context.consent and gate those destinations.
Links point to both nexo-crypto-wealth-platform/id1455341917 and the older nexo-crypto-banking-account/id1455341917. Apple redirects the old slug; one canonical link keeps the copy consistent.
| JD duty | How I would do it | Detailed in |
|---|---|---|
| Event tracking across GTM, Segment, Adjust and GA4; resolve discrepancies | One schema with a column per destination. Reconcile daily on a few key events (sign-up, KYC complete, first deposit): backend count vs Segment vs GA4 vs Adjust, with expected gaps written down (consent rate, ad blockers, ATT, SKAN windows). | §05 |
| Script API jobs and ETL to cut manual work | Small scheduled scripts with tests: audience syncs, a nightly container diff, a consent smoke test, a broken-link and UTM check. Each writes a log BI can read. | §04, demo |
| Segment CDP data flows | Sources, destinations and Protocols plan enforcement; identity rules written down (anonymousId to userId at sign-up); destination filters by consent category. | §05 |
| Peer reviews, OneTrust mappings, PII risk | A review checklist for every GTM publish: consent setting, trigger, PII in parameters, region test. OneTrust categories mapped to every vendor in the container. | §04, ★ |
| Scope cross-team requirements, prioritise by impact | A request template with the decision the data serves, the event, the owner and the deadline. Ranked by revenue or risk. | §06 |
| Mobile performance through Adjust | Campaign structure on every link, deep links to the right screen, SKAN conversion values mapped to the funnel, and a weekly install-to-first-deposit view by source. | ★ 2 |
| Dashboards the team can trust | Each dashboard states its source, refresh time and known gaps. One metric, one definition. | §06 |
Run before every container publish and weekly on production. Fully scriptable with a headless browser.
| Region | OneTrust rule | Pass condition |
|---|---|---|
| Germany, UK | GDPR opt-in | Before a choice: only strictly necessary cookies and cookieless Consent Mode pings. After Accept: every vendor fires once. After Reject: none of the ad vendors fire. |
| Brazil | LGPD opt-in | Same as GDPR. |
| California | CCPA notice | Opt-out link works and stops ad vendors; Global Privacy Control signal honoured. |
| Rest of world | Global notice | Banner text and links correct; tags fire as configured. |
Diff the new container version against the live one; every new tag needs a consent setting and an owner.
Run the region matrix above and attach the request log to the ticket.
Reconcile OneTrust's cookie list with what the browser actually sets.
A sample plan for the core funnel. One row per event, one column per destination, so a count in any tool traces back to the same definition.
| Segment event | GA4 event | Adjust event | Ad platforms | Required properties |
|---|---|---|---|---|
| Signed Up | sign_up | token per app | CompleteRegistration | method, platform |
| KYC Completed | kyc_complete | token per app | custom | level, duration_sec |
| Deposit Completed | deposit_complete | revenue event | Purchase or custom | asset, amount_usd, rail, first_deposit |
| Card Ordered | card_order | token per app | custom | card_type, mode |
| CTA Clicked | cta_click | none | none | cta_source, cta_text |
The demo's Event QA tab checks payloads against this plan: naming, required properties, PII (email, IBAN, card number, wallet address) and the GA4 limits.
Role: Marketing Operations Specialist, Nexo (public job posting, 2026).
Public files read on 31 Oct 2026: nexo.com page HTML; the published container at googletagmanager.com/gtm.js?id=GTM‑NWGJNHR; OneTrust configuration at cdn.cookielaw.org/consent/<id>/<id>.json. Peer sites read the same way.
Browser test: Chrome with a fresh profile, OneTrust geolocation override, no interaction for 15 seconds, every third-party request logged. 4 pages, 3 runs each, repeated by an independent second script.
Nothing here is a legal opinion. Consent decisions depend on contracts and assessments that are not public.
Demo: nexo-martech.pages.dev · Google Consent Mode · Adjust tracker URLs · Segment Protocols
Independent homework for the Nexo Marketing Operations Specialist role · 2026 · edwardtay.com