The GA4 Audit Checklist: 10 Things Wrong with Your Setup

Here is an uncomfortable truth: we have never audited a GA4 property and found zero errors. Not once. Every business we examine — from five-person agencies to national e-commerce retailers — has at least three major configuration flaws. Some are minor (misnamed custom dimensions), but others are critical (personally identifiable information leaked into URLs, double-counted purchase revenue, or invalid consent signals). Work through this 10-point checklist to audit your property today.

1. Tag Firing & Scope Verification

Open GTM Preview and navigate across multiple page templates (Homepage, Category, Product, Checkout, Contact). The GA4 Google Tag must fire exactly once per pageview. Common failure modes include tags firing only on the homepage (due to restrictive triggers like Page Path equals /) or double-firing because a legacy hardcoded gtag.js snippet exists alongside GTM.

2. Consent Mode v2 Default Configuration

Inspect your consent initialization script before GTM loads. Under UK GDPR and EU rules, analytics_storage and ad_storage must default to 'denied'. If your setup defaults to 'granted' without prior user consent, you risk non-compliance with ICO enforcement notices.

3. Personally Identifiable Information (PII) Leaks

Google's terms strictly forbid collecting PII (email addresses, phone numbers, postcodes, full names). Audit your event parameters in Admin → Events and check your URL query strings. If form redirect URLs pass ?email=user@example.com, configure GTM redacting variables or strip query parameters before firing the GA4 tag.

4. Key Events (Conversions) vs Micro-Interactions

Check Admin → Key Events. Only mark distinct business outcomes as key events (e.g. generate_lead, purchase, booking_confirmed). Marking micro-interactions like scroll, file_download, or click as key events distorts Google Ads automated bidding models.

5. Duplicate Conversion Tracking

Ensure you are not firing multiple overlapping conversion tags on the same trigger. For instance, firing both a generic form_submit event and a specific generate_lead event as key events on the same thank-you page doubles your recorded lead count.

6. Data Retention Period (Default 2 Months vs 14 Months)

GA4 properties default to a 2-month retention window for user and event-level data in explorations. Go to Admin → Data Settings → Data Retention and switch event data retention to 14 months to retain year-over-year cohort capabilities.

7. Internal & Developer IP Traffic Filtering

Under Admin → Data Settings → Data Filters, ensure your internal office, remote team VPN, and developer IP addresses are excluded. Verify the filter state is set to Active rather than stuck in Testing mode.

8. Google Ads & Auto-Tagging Integration

In Admin → Product Links → Google Ads Links, verify that auto-tagging is enabled in Google Ads and that Enable Personalised Advertising is active to allow audience export for remarketing.

9. Cross-Domain Tracking Architecture

If your checkout or booking system lives on a separate domain (e.g. store.example.com to checkout.thirdparty.com), configure cross-domain measurement under Data Streams → Configure Tag Settings → Configure Your Domains. This ensures session and client ID continuity without generating self-referrals.

10. Custom Dimensions & Metrics Registration

Sending custom parameters in your dataLayer.push is useless if they are not registered in GA4. Go to Admin → Custom Definitions and ensure all critical event-scoped and user-scoped parameters are explicitly mapped.

The GA4 Audit Summary Matrix