GA4 Audit Checklist: 25 Checks to Know If You Can Trust Your Data
22 July 20269 min read
A GA4 audit tells you whether the numbers in Google Analytics 4 reflect what is really happening on your website. Many properties were set up in a rush during the move from Universal Analytics and never checked since.
This checklist gives you 25 checks, grouped into six areas. Work through them and you will know exactly where your data is solid and where it is not.
Quick answer: A GA4 audit is a structured review of your property settings, data streams, tag implementation, key events, consent setup, attribution and reports. The aim is to confirm that every important user action is tracked once, correctly, with the right source attached. If any of the 25 checks below fail, treat the affected reports with caution until they are fixed.
Why a GA4 audit matters
Bad data rarely looks bad. A report with duplicated purchase events still produces a tidy chart. A form that stopped firing three months ago just looks like a dip in leads. Because GA4 feeds bidding in Google Ads, budget decisions and board reporting, small configuration errors spread into real money.
A Google Analytics audit also settles arguments when paid media, SEO and sales all quote different numbers.
Before you start
You will need:
- Editor access (or at least Viewer plus Analyst-level understanding) to the GA4 property
- Access to the Google Tag Manager container, if you use one
- A test device and browser with ad blockers switched off
- A list of the actions that matter to the business: purchases, form submissions, calls, bookings, sign-ups
Log each check as pass or fail with notes. That becomes your fix list.
Section 1: Property and account settings (checks 1 to 5)
1. Data retention is set to 14 months
GA4 defaults event-level data retention to two months. That limits the date range you can use in Explorations. Go to Admin, Data collection and modification, Data retention, and set it to 14 months unless you have a policy reason not to. Standard reports are not affected, but Explorations are.
2. Time zone and currency are correct
Check Admin, Property details. A wrong time zone shifts daily totals and makes comparisons with Google Ads or your CRM harder. A wrong currency distorts revenue.
3. Industry category and reporting identity are deliberate
Reporting identity (Blended, Observed or Device-based) changes how users are counted. Make sure someone chose it on purpose and that the team knows which one is active.
4. Google Signals decision is documented
Google Signals can add cross-device insight but can also trigger thresholding in reports, where GA4 hides small numbers to protect privacy. Decide whether you need it and note the trade-off.
5. User access is tidy
Review who has access. Remove former staff and agencies, and give the minimum role needed.
Section 2: Data streams and tag implementation (checks 6 to 10)
6. There is one web data stream per site
Multiple streams for the same website usually mean duplicated data or a past rebuild that was never tidied up. One site, one stream, one Measurement ID.
7. The GA4 tag fires exactly once per page
Use GA4 DebugView or Tag Assistant to load a page and confirm a single page_view. A hard-coded gtag snippet plus a GTM tag is a very common cause of double counting.
8. Enhanced measurement settings are reviewed
Enhanced measurement can track scrolls, outbound clicks, site search, video engagement, file downloads and form interactions automatically. The form interaction setting in particular can fire on forms you do not care about, or report "form_submit" when a submission failed. Switch off anything that creates noise.
9. Internal and developer traffic is filtered
Define internal traffic rules under the data stream's tag settings, then activate the Internal Traffic filter in Admin. Also activate the Developer Traffic filter so debug sessions stay out of reports.
10. Unwanted referrals are listed
Payment gateways such as PayPal or Stripe checkout, and booking tools on other domains, can break sessions and steal credit for conversions. Add them under Configure tag settings, List unwanted referrals. If you own the other domain, use cross-domain tracking instead. Our guide to cross-domain tracking in GA4 explains the difference.
Section 3: Events and key events (checks 11 to 16)
11. Every important action has an event
Compare your list of business-critical actions with the events report. Missing events are the most expensive gap in any GA4 audit checklist.
12. Event names follow a consistent convention
GA4 event names are case sensitive, so "Form_Submit" and "form_submit" are two different events. Use lowercase with underscores, and use Google's recommended event names (such as generate_lead, purchase, sign_up) where they fit.
13. Key events are marked correctly
In GA4, conversions are now called key events. Only mark the actions that represent real value. Marking page views or scrolls as key events makes your conversion rate meaningless.
14. Key events fire once per action
Submit a test form or test purchase and watch DebugView. A thank-you page that can be refreshed or bookmarked will create duplicate key events. Purchases should include a unique transaction_id so GA4 can deduplicate.
15. Ecommerce parameters are complete
For online shops, check that purchase events carry value, currency, transaction_id and an items array. Missing currency is a common reason revenue shows as zero.
16. Custom dimensions are registered
Parameters you send (such as form_name or lead_type) only appear in standard reports once registered as custom dimensions. Check that each one you rely on exists and is populated.
Section 4: Consent and privacy (checks 17 to 19)
17. Consent Mode v2 is implemented
If you serve users in the UK or EEA and use Google advertising features, Consent Mode v2 should be in place, sending ad_storage, analytics_storage, ad_user_data and ad_personalization signals. Confirm the default state is set before any tags fire, and that it updates when the user makes a choice.
18. You know whether you run basic or advanced mode
In basic mode, Google tags do not load until consent is given, so nothing is sent for users who decline. In advanced mode, tags load and send cookieless pings when consent is denied, which allows GA4 to model behaviour. Neither is wrong, but you need to know which one you have, because it changes how your numbers should be read.
19. No personal data is sent to GA4
Google's policies prohibit sending personally identifiable information such as email addresses or phone numbers. Check page URLs and event parameters, especially on forms that use GET requests and put details in the query string.
Section 5: Attribution and traffic sources (checks 20 to 22)
20. Unassigned and (not set) traffic is low
A large share of Unassigned or (not set) in the traffic acquisition report points to broken UTMs, missing session data or tagging problems. Our article on Unassigned and (not set) traffic in GA4 walks through causes and fixes.
21. Google Ads is linked and auto-tagging is on
Link GA4 and Google Ads under Admin, Product links, and confirm auto-tagging is enabled in Google Ads. Without it, paid clicks can appear as organic or direct.
22. UTM tagging follows a naming standard
Check that email, social and partner links use consistent utm_source and utm_medium values that map to GA4's default channel groups. "Facebook", "facebook" and "fb" will be split into separate rows.
Section 6: Reporting and validation (checks 23 to 25)
23. Key events reconcile with a source of truth
Compare GA4 purchases with your ecommerce platform, or GA4 leads with your CRM, over the same period. Some difference is normal because of consent and ad blockers, but a gap that is large or changing suddenly needs investigating.
24. Search Console and other products are linked
Linking Search Console brings organic query data into GA4. Check that it is connected to the right property.
25. Reports and dashboards use the right definitions
Check that Looker Studio dashboards and custom reports use key events, not deprecated metrics or old Universal Analytics logic. Confirm everyone reading the reports understands what "session" and "key event" mean in GA4.
How to prioritise what you find
Fix in this order:
- Fix anything that breaks key events. Missing, duplicated or misfiring conversions affect bidding and budget decisions immediately.
- Fix source and attribution problems. If conversions are tracked but credited to the wrong channel, you will scale the wrong activity.
- Fix consent and privacy issues. These carry compliance risk as well as data loss.
- Tidy settings and governance. Retention, access and naming conventions protect data quality going forward.
Remember that GA4 will never match every other platform perfectly. Different attribution models and counting rules mean differences are expected. Our guide to why GA4 and Google Ads show different conversions explains which gaps are normal.
DIY or independent tracking audit?
You can run this checklist yourself if you are comfortable with GA4 and GTM. The hard part is usually not finding the settings but proving that events fire correctly across devices, browsers and consent states, and then fixing them without breaking anything else.
An independent tracking audit is useful when you want a second opinion that has no stake in the results, for example before increasing ad spend, after a site rebuild, or when handing an account between agencies.
FAQs
How long does a GA4 audit take?
A focused audit of a typical lead generation or small ecommerce site usually takes a few hours to a couple of days, depending on the number of events, domains and integrations involved.
How often should I audit GA4?
At least once a year, and always after a website rebuild, a new consent banner, a CMS or checkout change, or a new ad platform being added.
Will a GA4 audit make GA4 match my CRM exactly?
No. Consent choices, ad blockers and different counting rules mean some gap is normal. An audit makes sure the gap is understood, stable and not caused by tracking errors.
What is the difference between a GA4 audit and a tracking audit?
A GA4 audit focuses on the analytics property. A tracking audit also covers Google Tag Manager, ad platform conversion tags and how data flows to tools like Google Ads and Meta.
Get your GA4 audit done properly
If you would rather have an expert work through every check, test your key events and fix what is broken, our Tracking Audit + Fix costs a fixed £199 with no retainer. It covers GA4 configuration, GTM validation, conversion event testing and fixes where needed. Get My Audit and find out whether you can trust your data.
Share