GA4 Audit: A 25-Point Checklist to Check Whether Google Analytics Measures What It Should

A GA4 audit is a systematic check of whether Google Analytics 4 collects data correctly: whether every pageview and every event is counted once, whether property settings distort the reports, and whether measurement respects user consent. You run it because GA4 does not report its own errors: a misconfigured property looks as credible in reports as a correct one, and you base ad budgets on those numbers. Below is the 25-point checklist, split into four layers, that we use at our marketing agency when reviewing measurement.

What a GA4 audit is and when to run one

A GA4 audit checks three things: whether data is complete (nothing gets lost), clean (nothing is counted twice or comes from your own team) and compliant with the law. Run it after an implementation or migration, after every site redesign and cookie banner change, after launching a new campaign with a sales goal, and on a regular quarterly rhythm. Before a big sales campaign, a shorter version is enough: tag, funnel events and currency. The first full review usually takes a few hours.

Layer 1: does the tag fire once per pageview and in the right place

A correct GA4 tag sends one page_view event per pageview, from one measurement ID (G-XXXXXXXX), to Google's collection endpoint. The most common mistake is a double implementation: code pasted by hand into the template plus the same tag fired from Google Tag Manager, which produces two page_views per pageview, inflated pageviews and a deflated bounce rate.

• 1. One page_view per pageview. Open the site with GTM preview (Tag Assistant) on and count page_view events per pageview in GA4 DebugView. There should be one.
• 2. G- measurement IDs. In the browser's Network tab filter requests by “collect”: check how many G- IDs the site uses and whether each is intended (old properties left by previous agencies are common).
• 3. Dead UA- tags. Watch for UA- IDs: Universal Analytics has not collected data since July 2023, so such a tag is dead code that only slows the page down.
• 4. Collection endpoint. Hits from Europe usually go to a regional Google address (e.g. region1.analytics.google.com) — that is normal and does not mean a custom server. A server-side setup is recognized by a first-party domain, which we cover in server-side tracking: is it worth it.
• 5. Navigation without a reload. Check pages after navigation without a reload (SPA stores): page_view must fire on every view change as well as on the first visit.
• 6. The 404 page. Open a non-existent URL: the 404 page should carry the same tag, so you can see where you lose users.

Layer 2: do funnel events send complete data

E-commerce funnel events are the path view_item_list, view_item, add_to_cart, view_cart, begin_checkout and purchase, and each one must carry parameters: a product list (items), currency and value. Without them the Monetization report is empty or incomplete, and Google Ads and Meta campaigns have nothing to learn from.

The costliest mistake in this layer concerns the purchase event. Without a unique transaction ID (transaction_id), the same transaction is counted every time a customer refreshes the confirmation page or returns to it from an email, and revenue in reports grows artificially. Check in DebugView that transaction_id is filled in and that one test order produces exactly one purchase event. If you set budgets from ROAS, also read Break-even ROAS and maximum CPC, because inflated revenue inflates ROAS too.

While you are there, check that the currency in events is passed by the store. Revenue reports rely on that value, so a missing currency means a purchase with no revenue. If GA4 is linked to Google Ads, also check that the key event you optimize campaigns for is the right one. You can compare against the setup in our GA4 service.

• 7. Event parameters. Every funnel event carries a product list (items), currency and value.
• 8. view_item. Fires when a product page opens, with items filled in, and does not fire on category pages.
• 9. add_to_cart. Fires on every add to cart, also from a listing and a cart drawer.
• 10. begin_checkout. Fires on entering checkout, also when checkout sits on a separate domain or an external payment page.
• 11. purchase with transaction_id. One test order produces exactly one purchase event with a filled-in transaction_id, and refreshing the thank-you page does not count the purchase again.
• 12. generate_lead (service sites). Fires only after the form is submitted; a button click alone or a validation error does not trigger it.
• 13. Currency. The store passes the currency parameter in every event, because a purchase without a currency has no revenue.
• 14. Key event for Google Ads. Campaigns optimize for the right key event.

Layer 3: which GA4 property settings to review

Property settings determine how GA4 interprets correctly sent data, and most “silent” errors live here because nobody reviews them after implementation. Retention matters most: by default GA4 keeps event data for 2 months, and in the data retention settings you can extend it to 14 at most, so year-over-year analysis in Explorations only works after you change this setting.

Referral exclusions directly change the sources report. When a customer pays through an external gateway and returns to the site, GA4 may treat the gateway as a new traffic source and credit it with a purchase that actually came from an ad. The result is deflated campaigns and inflated “referral”. Add payment and login gateway domains (e.g. paypal.com) to the unwanted referrals list.

• 15. Event data retention. Set to 14 months instead of the default 2.
• 16. Internal traffic. Defined in tag settings, with the data filter in the “Active” state, because only that state excludes data.
• 17. Referral exclusions. Payment and login gateway domains are on the unwanted referrals list.
• 18. Key events. Only those with business value are marked (limit of 30 in a standard property).
• 19. Custom definitions. Every event parameter you want to see in reports has a registered definition.
• 20. Time zone and currency. They match the market and the store.
• 21. Attribution window. It fits the length of your buying cycle.

Layer 4: does measurement respect consent and avoid collecting personal data

Correct measurement honors user consent: without consent, tags do not collect identifiers, and with Consent Mode v2 they send only cookieless signals. The second part of this layer is personal data: Google prohibits sending email addresses, phone numbers and names to GA4, and it happens more often than you would assume, such as through a page URL with an ?email= parameter or a form field value sent as an event parameter.

• 22. Personal data in URLs. Review URLs with parameters in the Pages and screens report: if you see emails, names or order numbers tied to a person, they need to be redacted or no longer sent.
• 23. Forms and site search. In DebugView check the parameters of form and site search events: a search box is often where customers type their own data.
• 24. Three consent states. Test the site in three states: before choosing in the banner, after accepting and after rejecting. Scripts should not send hits with a client ID before consent.
• 25. page_view resent after a consent change. After a consent change, gtag sends page_view again so the hit carries the “granted” state. This is expected gtag behaviour; tell it apart from two hits from two tags.

We describe configuration details and the impact on data in Consent Mode v2: how much data you lose; you can test the banner with the free Consent Mode Checker.

What you can check yourself in an hour and what needs container and account access

From the outside you can only verify what is visible in the browser's network traffic: the number of tags, measurement IDs, sent events, parameters and request addresses. The inside of the property (retention, key events, links, filters) and the GTM container configuration are visible only to a person with access, which is why a full audit combines both approaches.

• You can check yourself in an hour: DebugView and Tag Assistant (tag, page_view, funnel events on a test order), URLs with personal data in the Pages and screens report, retention and internal traffic in the settings.
• A quick scan from a URL: our free GA4 audit opens the site, clicks consent and checks tags and events (up to the first checkout step); it never submits an order or a form.
• Needs access: trigger rules in GTM, browser and server deduplication, links to Google Ads, custom definitions and revenue reliability against the store system.

What to do with the GA4 audit results

After the audit, order fixes by their impact on decisions, not by their position on the list: first whatever distorts revenue and conversions (a doubled page_view, purchase without transaction_id, missing currency), then whatever distorts sources (referral exclusions, internal traffic), and last the housekeeping (event names, dead tags, definitions). Verify every fix in DebugView and note the deployment date, because from that day the data in reports stops being comparable with earlier data.

When measurement runs through the browser and you lose some events to blockers and Safari, the next step is sometimes moving tags to your own server. If you are considering it, start with the server-side GTM offer and the article on whether it pays off, and fix the basics from this checklist first, because server-side repeats configuration errors instead of fixing them. Data loss without cookies has its own scale, described in Conversions Without Cookies.

FAQ: GA4 audit