GA4 audit: a checklist for agencies, in the order that saves data

What is a GA4 audit?

A GA4 audit is a structured check of a Google Analytics 4 property: who can change it, whether it collects every visit once and correctly, whether its events and key events mean what the reports claim, and whether any setting is quietly losing or tainting data. The output is a list of fixes in priority order.

Most GA4 audit guides list the settings well. MeasureSchool’s and Vidi Corp’s cover the main areas, and tools such as GA4 Auditor automate part of the check. What this guide adds is the order, Google’s own limit or rule for each setting, and a way to tell a tracking fault from a real change in the business.

Where GA4 sits among the metrics a business should track is covered in the guide to marketing metrics worth tracking.

The order of the audit

Audit GA4 from the settings that do permanent damage to the ones that only affect how data is read. A wrong report can be fixed tomorrow; a wrong filter or a missing retention setting cannot be undone.

1. 1AccessWho can change the property, and whether the business owns it.
2. 2Data lossFilters, retention and PII: settings that lose or taint data permanently.
3. 3CollectionTags, consent, cross-domain and referrals: is every visit recorded once, correctly?
4. 4MeaningKey events, custom dimensions and campaign tagging: does the data mean what reports say?
5. 5ConnectionsGoogle Ads, Search Console and other links, and what each one changes.
6. 6ReportsThresholding, comparisons and the dashboards people actually read.

The order also suits a client conversation. The first two steps produce the findings that most need fixing quickly and that a client most needs to approve. The later steps produce improvements that can be scheduled.

Step 1: access and ownership

The first question in any audit is who controls the property. In Google’s access management, a user needs the Administrator role to add or modify users, and the Administrator role at account level to delete them. If a former agency or employee is the only Administrator, the business cannot fully control its own data.

• The business holds Administrator. At account level, in a Google account the business controls.
• Named users only. Each person or supplier has their own user, so access can be removed individually.
• Lowest role that works. Suppliers who report need Viewer or Analyst; those who configure need Editor. Very few people need Administrator.
• Remove leavers. Former staff and suppliers are removed at account level, which also removes them from properties below it.

An agency auditing a client’s property should say plainly if the agency itself holds more access than it needs. It is the finding clients remember, and it is the one that builds trust.

Step 2: settings that lose data permanently

Three settings can lose or taint data for good: data filters, data retention and personally identifiable information. Check them before anything else.

Data filters

Google’s help on data filters says filters are evaluated from the point of creation forward, do not affect historical data, and that once an exclude filter is applied, the excluded data is never processed and will never be available in Google Analytics or BigQuery. A filter set up with the wrong IP range or the wrong developer-traffic rule removes real visits permanently.

Check every active filter against its documentation, and confirm new filters were tested before being made active. Google’s guidance on internal traffic notes you need the Editor role to create or edit filters, and that internal traffic cannot be filtered out of app users.

Data retention

On standard properties, user-level data retention can be set to 2 or 14 months, and key events data follows the same setting. Google says the setting does not affect standard aggregated reports; it affects explorations and funnel reports. At 2 months, a year-on-year exploration has nothing to compare against.

Explorations and funnel reports only see user-level data inside the retention period. A year-on-year comparison needs at least 13 months.

Retention setting (months)History your comparisons need (months)

Months of history explorations can show

2.0

Months missing for your comparison

11.0

Standard aggregated reports are not affected

Retention options for standard properties are 2 or 14 months, per Google Analytics Help. The setting affects explorations and funnel reports, not standard aggregated reports.

With the defaults, a 2-month setting and a 13-month comparison leave 11 months missing from explorations. Moving to 14 months fixes it from the date of the change forward; it does not bring back data already deleted. That is why retention is in the data-loss step, not the reporting step.

Personally identifiable information

Google’s PII guidance says its policies mandate that no data be passed to Google that Google could use or recognise as personally identifiable information, including email addresses and personal mobile numbers. The usual culprits are page URLs that carry an email address after a form submission, page titles that include a name, and event parameters that capture form fields.

Search page paths and event parameters for an @ sign and for patterns that look like phone numbers. If anything turns up, the fix is in the site or the tag, and the client needs to know the property has been receiving data it should not.

Step 3: collection

Collection checks answer one question: is every visit recorded once, from the right source, with the visitor’s consent choices respected?

The tag and enhanced measurement

Check the Google tag fires once on every page, not twice through both a hard-coded tag and Tag Manager. Then check enhanced measurement, which Google describes as collecting events such as page views and scrolls without code changes. Its scroll event fires the first time a user reaches 90% of the page; if the site also sends its own scroll event, reports double count.

Consent

Tag Manager’s consent settings include a Consent Initialization trigger that fires before all other tags, so the consent state is set before measurement begins. Check that the consent banner sets that state, that tags respect it, and that nothing fires before the banner has loaded. The banner and its legal wording belong to the business; the audit checks the tags.

Cross-domain and referrals

If a journey crosses domains, such as a marketing site and a separate checkout or booking domain, cross-domain measurement lets Analytics attribute the activity to a single user. Without it, one visitor becomes two, and the second session is credited to the first domain as a referral.

Payment providers cause the same problem from the other direction. Google’s unwanted referrals setting lets you list domains whose traffic should not count as referrals; Analytics then marks matching events with ignore_referrer=true. A property where the payment provider is a top referrer for purchases needs this fixed before any channel report can be trusted.

Step 4: meaning

Meaning checks ask whether the data says what the reports claim: whether key events are real results, whether event names and custom dimensions are usable, and whether campaign traffic is tagged consistently.

Key events

Google allows a standard property to mark up to 30 events as key events. The common fault is the opposite of running out: page views, scrolls and button clicks marked as key events, so the conversion rate counts activity rather than results. Key events should be the actions tied to revenue or leads: a purchase, a qualified form, a booked call.

Event names and limits

Google’s collection limits say event names over 40 characters are not processed, and that a key event whose name exceeds 40 characters will not be reported as a key event, because the appended suffix is lost. Long, descriptive event names written by a developer are a common cause of key events that never appear.

Custom dimensions

Parameters only appear in standard reports once they are registered as custom dimensions. Standard properties allow 25 user-scoped and 50 event-scoped custom dimensions. Check that the parameters people report on are registered, and that slots are not used up on ones nobody uses.

Campaign tagging

Google’s campaign URL guide sets out the UTM parameters, including utm_source, utm_medium and utm_campaign. Most channel reports go wrong because the same channel is tagged three ways: email, Email and newsletter as the medium for the same send. Agree one convention, write it down, and build links with a tool such as the UTM builder so nobody types parameters by hand.

Step 5: connections

Linked products add data to GA4 and send data from it. Each link should be checked for whether it exists, whether it points to the right place, and what it changes.

• Google Ads. Google’s Ads linking guide says linking lets you create consistent Google Analytics and Google Ads conversions based on key events. Check that the link exists, that the right key events are used as conversions, and that bids are not optimising towards an event that is not a real result.
• Search Console. Google’s Search Console integration links one web data stream to one Search Console property, and the reports hold at most 16 months of data because Search Console keeps 16 months. Check it is linked to the right stream.
• BigQuery and other links. If they exist, check who set them up and whether anyone still uses them.

How Google Ads data should then be reported to a client, including the rules Google sets for third parties, is covered in PPC reporting.

Step 6: reports, and telling a fault from a real change

The last step checks the reports people actually read, and whether a surprising number is a tracking fault or a real change in the business. Getting that distinction wrong is the most expensive mistake in an audit.

Thresholding

Google applies data thresholds to prevent anyone inferring the identity of individual users. Data may be withheld in reports or explorations that include demographic data, and rows with search query information may be withheld when there are not enough total users. Small reports with missing rows are often thresholded, not broken.

Did the change start on the same day as a site release, a tag change or a consent banner change?

Yes

Start with the tracking. Compare the tag set-up before and after the change, and check the key events and consent settings fire as they did.

No

Does the change show up in an independent source too, such as sales in the CRM, Search Console clicks or ad platform clicks?

Yes

It is probably real. The business changed, not the tracking. Look for the cause in campaigns, seasonality or the site itself.

No

Is the report small, filtered to a short date range, or using demographics?

Yes

Check thresholding and sampling first. Small reports can withhold rows to protect privacy; widen the date range or remove demographic dimensions.

No

Audit the collection settings: filters, referrals, cross-domain and any recent change to data streams.

A diagnostic guide, not a rule. Always confirm with a second source before telling a client the numbers are wrong.

Check against a second source

No GA4 number should be called wrong on its own. Compare purchases with the ecommerce platform, leads with the CRM, organic clicks with Search Console and paid clicks with the ad platform. They will not match exactly, because each counts differently, but they should move together. When they do not, the gap points to the fault. Why some channels never reconcile perfectly is covered in measuring organic when attribution breaks.

The settings in one table

The table below brings the settings together with Google’s rule for each and the fault an audit most often finds. Use it as the reference while working through the checklist.

Setting	Google’s rule	What goes wrong
Data filters	Filters apply from creation forward, and an exclude filter’s effect is permanent	A wrong filter deletes data for good; test filters before activating them
Data retention	User-level retention can be 2 or 14 months on standard properties; it affects explorations and funnels, not standard reports	Year-on-year explorations come back empty at 2 months
Key events	Up to 30 key events on a standard property	Every click marked as a key event, so the conversion rate means nothing
Event names	Event names over 40 characters are not processed; a key event over 40 characters loses its key-event flag	Long names silently disappear from reports
Custom dimensions	Standard properties allow 25 user-scoped and 50 event-scoped custom dimensions	Slots used up on parameters nobody reports on
Unwanted referrals	Listed domains are not credited as referrals	Payment providers or your own subdomains take credit for sales
Cross-domain	Configured domains are treated as one journey	One visitor counted as two, and the second session credited to your own site
PII	Google’s policies say no personally identifiable information may be sent to Google	Email addresses in page URLs or form events
Search Console link	One web data stream to one Search Console property; reports hold up to 16 months	Organic query reports missing or tied to the wrong stream
Thresholding	Data may be withheld in reports with demographics or search queries when user counts are low	Rows missing from small reports, mistaken for a tracking fault

Google Analytics Help: data filters, retention, key events, collection limits, custom dimensions, unwanted referrals, cross-domain, PII, Search Console, thresholds. Read on 15 November 2026.

Ecommerce and lead-generation properties

The same audit applies to every property, but the checks that matter most differ between a shop and a business that sells through enquiries.

Ecommerce

For a shop, the purchase event is the number every other report depends on. Check that it fires once per order, not again when the customer reloads the confirmation page; that the value and currency are sent with it; and that the transaction ID is unique, so a duplicate can be spotted. Then compare a month of purchases and revenue with the ecommerce platform. The totals will not match exactly, because of refunds, blocked tags and consent, but a large or growing gap means the tracking needs work before any channel report is trusted.

Payment providers matter more here than anywhere else. If customers leave the site to pay and come back, the payment domain belongs in the unwanted referrals list, or the provider will take credit for sales the campaigns produced.

Lead generation

For a business that sells through enquiries, the key event is usually a form submission or a booked call. Check that it fires on a real submission, not on a button click that might fail validation, and that spam submissions do not count. The useful comparison is with the CRM: the number of genuine leads should move with the key event count, even if the totals differ.

If the business can pass lead quality back, from the CRM or sales team, record it. A report that stops at leads cannot say which channel brings customers; one that reaches qualified leads can.

Writing up the audit

An audit is only useful if the client can act on it. Write it as findings, each with evidence, impact and a fix, in priority order.

1. Start with data loss. Filters, retention and PII findings go first, because every day they stay unfixed costs data that cannot be recovered.
2. Show the evidence. A screenshot of the setting, the report row or the duplicated event, so the client does not have to take the finding on trust.
3. State the impact. What decision the fault affects: budget allocation, channel credit, the conversion rate.
4. Give the fix and the owner. What changes, in which tool, and whether the agency, the developer or the client does it.
5. Separate fixes from opinions. A wrong filter is a fault; a different naming convention is a preference. Label them differently.

For agencies, the write-up is also where the client’s trust is won or lost. Reports built on a property with known faults should say so until the faults are fixed.

How often to audit GA4

Audit GA4 fully when you take on a client, after any site rebuild or tag change, and once a year. In between, a short monthly check of the settings most likely to drift catches problems early.

• When a client starts. Before the first report, so the baseline is trustworthy.
• After a site or tag change. Releases, new consent banners and new checkout providers are the most common causes of broken tracking.
• Monthly. Key events still firing, no new top referrer that is really a payment provider, and no sudden drop that the second source does not show.
• Yearly. Access, filters, retention, custom dimensions and links, in full.

The GA4 audit checklist

The checklist below follows the audit order. Work through it top to bottom; the first two groups matter most.

Access and ownership

The business, not a supplier, holds the Administrator role Everyone has a named user; nobody shares a login Former staff and suppliers have been removed

Settings that lose data

Every data filter is documented, and tested before it was made active Internal traffic is defined and filtered Data retention is set deliberately, usually 14 months No email addresses or other PII in page URLs, titles or event parameters

Collection

The Google tag fires once on every page Tags respect consent settings Cross-domain measurement covers every domain in the journey Payment providers and own subdomains are listed as unwanted referrals

Meaning

Key events match real business results, not every click Event names are under 40 characters and follow one convention Custom dimensions are registered for the parameters people report on Every campaign link uses the agreed UTM convention

Connections and reports

Google Ads is linked and key events are imported as conversions where needed Search Console is linked to the right web data stream Reports people rely on have been checked against a second source

Ticks are saved in your browser.

If you would rather have the audit done for you, my analytics service starts with exactly this check, and agencies can buy it under their own brand through white-label reporting and analytics.