The Complete GA4 Audit Checklist (2026)

1. Property Configuration Checks

Your GA4 property settings form the foundation of accurate data collection. Misconfigurations here cascade through every report. Start your audit at the Admin panel and work through each setting methodically.

• Verify the data retention period is set to 14 months (the maximum) rather than the default 2 months, which limits historical analysis in Explorations.
• Confirm Google Signals is enabled if you need cross device reporting, but understand the implications for data thresholds. High-cardinality reports may show "(other)" rows.
• Check that enhanced measurement events (scroll, outbound clicks, site search, video engagement, file downloads) are enabled and configured correctly for your site structure.
• Validate the reporting time zone matches your business operations. A mismatch means daily and hourly reports will not align with actual user behavior.
• Confirm the industry category and currency are set correctly, as these affect benchmarking and revenue reporting respectively.
• Verify data streams are correctly configured. Each web stream should have the correct URL with the right protocol (https vs http).
• Check for unwanted referral exclusions. Missing your own payment domain (e.g. Stripe checkout) is one of the most common configuration errors that inflates session counts.
• Validate that internal traffic filters are defined for your office IP ranges and that the filter is set to "active" rather than "testing" (a common oversight after initial setup).
• Confirm cross domain tracking is configured if users navigate between your domains (e.g. main site to checkout subdomain).
• Check that the property is linked to Google Ads, Search Console, and BigQuery where applicable. Missing links mean missing data.

2. Tag Implementation Checks

Tags are the bridge between user actions and your analytics data. A single broken tag can create blind spots that persist for weeks before anyone notices.

These checks validate that your measurement code is firing correctly.

• Confirm the GA4 configuration tag (gtag.js or GTM) is present on every page. Check both the homepage and at least 5 representative interior pages, as template level issues often only affect certain page types.
• Verify the measurement ID (G-XXXXXXX) matches the property you intend to collect data for. Staging and production mix ups are surprisingly common.
• Check for duplicate tag installations. Running both gtag.js and GTM with GA4 tags will double count pageviews and inflate every metric.
• Validate that the dataLayer is initialized before GTM loads. Events pushed to a non existent dataLayer object are silently lost.
• Confirm custom events are firing with the correct event names and parameters. GA4 is case sensitive: "Add_To_Cart" and "add_to_cart" create separate events.
• Check that user properties are being set correctly and within GA4 limits (25 user scoped custom dimensions).
• Verify event parameter names follow GA4 naming conventions. Parameters exceeding 40 characters or 500 character values are silently truncated.
• Test tag firing on critical conversion pages (purchase confirmation, lead form submission, signup completion) to ensure no data gaps on high value events.
• Check for tag firing order issues. If a conversion tag fires before the config tag, the event may be lost or attributed incorrectly.
• Validate that debug mode works correctly by enabling GA4 DebugView and verifying events appear in real time.

3. Consent Mode Checks

With the Digital Markets Act (DMA) and evolving privacy regulations, consent mode is no longer optional for properties with European users.

Google has made consent mode v2 a requirement for using audience features and remarketing in the EEA. These checks ensure your implementation meets both legal and technical requirements.

• Verify that the consent mode default state is set before the GA4 tag fires. The default should be "denied" for ad_storage and analytics_storage in regions where consent is required.
• Confirm that consent state updates correctly when a user interacts with your consent banner. Granting consent should update both ad_storage and analytics_storage to "granted."
• Check that the consent banner actually appears for users in applicable regions. A banner that fails to load means all traffic defaults to "denied," losing conversion modeling data.
• Validate that consent mode is implemented as v2, which requires the additional ad_user_data and ad_personalization parameters introduced in late 2023.
• Verify that consent settings persist across sessions. If consent resets on every visit, users see repeated banners and you lose modeling coverage.
• Check that Google tags respect the consent state. No cookies should be written before consent is granted when ad_storage and analytics_storage are "denied."
• Confirm that URL passthrough and/or ads_data_redaction are configured based on your privacy requirements and measurement needs.
• Test the consent flow in an incognito window from a European IP (or using a VPN) to simulate the actual user experience.

4. UTM and Campaign Tracking Checks

Campaign attribution is only as good as your UTM discipline. Inconsistent tagging leads to fragmented source/medium data, making it impossible to accurately measure marketing ROI.

These checks validate the quality of your inbound traffic classification.

• Audit utm_source and utm_medium values for consistency. "Facebook" vs "facebook" vs "fb" creates three separate sources in your reports.
• Check for campaigns using utm_medium values that do not match GA4 default channel grouping rules. Using "social" instead of "paid_social" misclassifies paid social traffic as organic social.
• Verify that all paid campaigns include utm_campaign, utm_source, and utm_medium at minimum. Missing any of these parameters results in traffic appearing as "(not set)."
• Check for UTM parameters on internal links. Internal UTMs override the original traffic source and artificially restart sessions, destroying attribution data.
• Validate that auto tagging (gclid for Google Ads, dclid for Display) is enabled and not conflicting with manual UTM tagging.
• Look for URL-encoded characters in UTM values that might cause parsing issues (%20 vs + for spaces).
• Check that email campaigns use consistent UTM structures across all email platforms and templates.
• Verify that organic social traffic is not being tagged with UTMs. Social platforms append their own parameters and double tagging causes attribution conflicts.

5. Data Quality Checks

Even with correct configuration and tagging, data quality issues can emerge from unexpected traffic patterns, implementation bugs, or platform changes.

These checks look at the data itself to identify anomalies that configuration checks alone cannot catch.

• Compare session counts between GA4 and a secondary source (server logs, CDN analytics, or another analytics tool). Discrepancies greater than 15-20% warrant investigation.
• Check for (not set) values in key dimensions: page title, source/medium, country, language. High volumes of (not set) indicate tracking gaps.
• Look for sudden traffic spikes or drops that do not correlate with known campaigns or site changes. Bot traffic and tag failures both manifest as anomalies.
• Verify the bounce rate and engagement rate are within expected ranges. A 0% bounce rate usually indicates duplicate pageview tracking, not perfect content.
• Check the ratio of users to sessions. Extremely high sessions per-user ratios can indicate session splitting issues (e.g. from missing referral exclusions).
• Validate that key events (conversions) have consistent daily volumes. A day with zero conversions on a normally active site suggests a tracking failure, not a sales problem.
• Look for data sampling indicators in your reports. High-traffic properties may require BigQuery export for accurate analysis.
• Check for PII (personally identifiable information) in page URLs, event parameters, or custom dimensions. Email addresses in URLs are a common violation of Google Analytics ToS.
• Verify that real time reports show data within 30 seconds of a test pageview. Delays beyond a few minutes indicate configuration or network issues.
• Audit custom definitions (dimensions and metrics) for unused entries. GA4 has a limit of 50 custom dimensions per property.

6. E-commerce Tracking Checks

E-commerce tracking in GA4 follows a specific event schema (view_item, add_to_cart, begin_checkout, purchase).

Getting these events right is critical for revenue reporting, ROAS calculation, and product performance analysis. These checks validate your e commerce data layer implementation.

• Verify that the purchase event fires exactly once per transaction. Duplicate purchase events inflate revenue data. Check for double firing on page reloads, back button navigation, and redirects.
• Confirm that transaction_id is unique for each purchase event. Reusing or omitting transaction IDs prevents GA4 from deduplicating, leading to inflated revenue.
• Validate that the currency parameter is present and uses a valid ISO 4217 currency code (e.g. "USD", "EUR"). Missing currency makes revenue data unusable.
• Check that item arrays include all required fields: item_id, item_name, price, and quantity. Missing price or quantity means GA4 cannot calculate item revenue.
• Verify the complete e commerce funnel: view_item_list, select_item, view_item, add_to_cart, begin_checkout, add_shipping_info, add_payment_info, purchase. Missing steps create gaps in funnel reports.
• Compare total purchase event revenue in GA4 with your actual backend revenue. Discrepancies indicate missed transactions, duplicate events, or tax/shipping inclusion differences.
• Check that refund events are being tracked. Without refund data, your GA4 revenue will permanently exceed actual revenue.
• Validate that item level promotions (view_promotion, select_promotion) are firing correctly if you use on site promotional banners or featured product placements.
• Verify that item_brand, item_category, and item_variant are consistently populated across all e commerce events. Inconsistencies fragment product performance reports.
• Test the complete purchase flow in GA4 DebugView to confirm every e commerce event fires with the correct parameters and values in the expected sequence.