GA4 Audit Checklist: 16 Things to Check Before Your Data Costs You Money
Most GA4 setups we inherit have the same problems. Missing events. Broken conversions. Traffic source data that makes no sense. These are not edge cases. They are the norm.
We audit GA4 properties for agencies and their clients every week. This checklist covers the 16 most common issues we find, in rough order of impact. Use it on your own properties, or on the ones your agency manages. Either way, you will catch something.
1. Data stream configuration
Check that your data stream is measuring the right domain. Sounds obvious, but we regularly find staging sites, old domains, and development environments reporting into production GA4 properties. Go to Admin → Data Streams and verify every URL. One stray staging stream can inflate your numbers by 30% or more.
2. Internal traffic filtering
If you have not defined internal traffic rules, your own team's clicks, pageviews, and test purchases are in your reports. Go to Admin, then Data Streams, then your stream, then More Tagging Settings, then Define Internal Traffic. Create a rule matching your office IP or IP range. Then create a data filter to exclude it.
Important: defining the internal traffic rule is only half the job. You also need to activate the data filter. Go to Admin, then Data Settings, then Data Filters, and change the filter state from "Testing" to "Active". We see this step missed on roughly half the properties we audit. The rule exists but the filter is still in testing mode, which means internal traffic is still being included in your reports.
3. Unwanted referrals
Payment gateways, third-party checkout pages, and subdomains often appear as referral traffic when they should not. Check Admin → Data Streams → your stream → More Tagging Settings → List Unwanted Referrals. Add every domain that should not count as a referral source. Stripe, PayPal, and your own subdomains are the usual suspects.
4. Cross-domain tracking
If your user journey crosses multiple domains (shop.example.com to checkout.example.com, or your main site to a booking engine), you need cross-domain tracking configured. Without it, every domain transition looks like a new user, traffic source is lost, and conversion attribution breaks. Test this with Tag Assistant.
To verify cross-domain tracking is working, open Tag Assistant and navigate through the full user journey across domains. Check that the client ID remains the same throughout the journey. If it changes at any domain boundary, the linker is not passing the measurement parameters correctly. Common causes include missing domains in the cross-domain configuration, iframes that load on a different domain, or third-party redirects that strip query parameters.
5. Enhanced measurement review
Enhanced Measurement is on by default for new streams. It auto-tracks pageviews, scrolls, outbound clicks, site search, video engagement, and file downloads. Some of these are useful. Some produce noise. Go to Admin, then Data Streams, then Enhanced Measurement and turn off anything you do not need or that duplicates your custom events.
Site search tracking deserves particular attention. Enhanced Measurement looks for a "q" or "s" query parameter by default. If your site search uses a different parameter, the built-in tracking will not capture searches. If your site does not have a search function at all, turn it off entirely to avoid false positives from URLs that happen to contain those query parameters.
6. Event naming consistency
GA4 has recommended event names (add_to_cart, purchase, generate_lead, etc.) and parameter naming conventions. Using custom names where recommended ones exist means you lose automatic reports and cannot use GA4's built-in audiences. Open Events in the left nav and scan for non-standard names. Rename what you can and document the rest.
7. Key events (conversions)
In GA4, events do not become conversions until you mark them as Key Events. We regularly find properties where the purchase or lead event fires correctly but nobody turned on the key event toggle. Go to Admin → Events → mark the events that matter as Key Events. You get 30 by default on a standard property.
8. Conversion counting method
Each key event has a counting method: once per event or once per session. The default is once per event, which makes sense for purchases (every transaction counts). For lead forms, once per session usually makes more sense (you do not want 5 form submissions counted as 5 separate leads if someone double-submits). Review each one.
9. Attribution model settings
GA4 defaults to data-driven attribution. That is fine for most use cases, but you should verify. Go to Admin → Attribution Settings. Check the reporting attribution model (data-driven is Google's recommendation) and the lookback window (default is 30 days for acquisition, 90 days for conversion). Adjust if your sales cycle is longer or shorter.
10. Data retention
GA4 defaults to 2 months of data retention. After those 2 months, your data in Explore reports is gone (standard reports keep aggregated data, but raw event-level data is what you need for proper analysis). Go to Admin, then Data Settings, then Data Retention and change it to 14 months. There is no cost for this. There is no downside. Just do it.
If you need data beyond 14 months, which you likely will for year-over-year analysis, set up BigQuery export. GA4 data in BigQuery is retained indefinitely and gives you full access to raw event-level data without sampling. The export is free for the first million events per day. For most small to mid-size sites, this means zero cost.
11. Google Signals
Google Signals enriches your data with cross-device and remarketing information from users who have Ads Personalisation turned on. It improves demographic reporting and enables remarketing lists. Go to Admin → Data Settings → Data Collection and turn it on if it is off. Check your privacy policy covers it.
12. Consent Mode verification
If you run ads or use analytics in the UK or EU, Consent Mode v2 is not optional. It is a legal requirement for Google's EU User Consent Policy. Without it, your data degrades and your ads stop working properly. Check that consent signals are reaching GA4 by looking at the consent state in Realtime reports or DebugView. If they are not, your CMP integration is broken.
13. Thresholding and data quality
GA4 applies data thresholds when Google Signals is on and your report has small numbers. You see a warning icon or "thresholding applied" in your reports. This protects user privacy but can hide real patterns in low-traffic segments. Switch to device-only reporting in the report identity settings if you consistently hit thresholds on important reports.
14. Custom dimensions and metrics
GA4 limits you to 50 event-scoped custom dimensions and 25 user-scoped custom dimensions per property. If you are near the limit, audit what is actually being populated. We regularly find custom dimensions that were set up for a one-off test and never removed, eating slots that could be used for real business data. Prune unused ones.
15. Linked accounts
GA4 works best when linked to Google Ads, Search Console, and BigQuery. Go to Admin, then Product Links and verify that the right accounts are connected. Google Ads linking enables audience sharing and conversion import. Search Console linking adds organic search query data. BigQuery linking gives you raw unsampled data for proper analysis. All three are free. Set them up.
For BigQuery specifically, make sure you understand the export options. GA4 offers both daily and streaming exports. Daily exports are free and sufficient for most reporting needs. Streaming exports provide near-real-time data but incur BigQuery storage and insertion costs. Start with daily exports unless you have a specific real-time reporting requirement.
16. DebugView verification
DebugView is the single most useful tool for validating your GA4 setup. It shows you events in real time as they fire, along with their parameters and consent state. Go to Admin, then DebugView, and browse your site with GTM Preview mode active.
Check the following in DebugView:
- Pageview events fire on every page load with the correct page_location parameter.
- Custom events appear with the expected parameters and values.
- User properties are set correctly on the first event after login or identification.
- Consent state events show the correct values for all consent types.
- Ecommerce events (if applicable) include the correct items array with product details.
DebugView is your last line of defence before publishing. If events look wrong here, they will be wrong in your reports. Do not skip this step.
What if the audit finds problems you cannot fix?
That is what we do. If your audit turns up more than you can handle internally, get in touch. We will tell you honestly what needs immediate attention, what can wait, and whether you need outside help at all. No pitch. No pressure. Just a second opinion from people who do this every day.