The GA4 Audit Checklist: 10 Things Wrong with Your Setup Right Now

Here is an uncomfortable truth: we have never audited a GA4 property and found nothing wrong. Not once. Every business we look at — from five-person agencies to national retailers — has at least three of the problems on this list. Some are minor (a misnamed event that muddies reporting). Some are serious (personally identifiable information being sent to Google without consent, which is a GDPR violation). Here is the full checklist. Work through it. The fixes are simple; knowing you need them is the hard part.

1. The Tag Fires — but on the Wrong Pages

Open GTM Preview and navigate through your site. The GA4 Configuration tag should fire once per pageview on every page — no more, no less. The most common failure: the tag only fires on the homepage because someone set the trigger to "Page URL equals /" instead of "All Pages." The second most common: the tag fires twice on some pages because a developer added both GTM and a hardcoded gtag snippet. Open your page source and search for gtag — if it appears outside of the GTM container, you have a double-firing problem and your pageview count is inflated.

2. Consent Mode Is Defaulted to Granted

Open your consent default script — the one that fires before GTM loads — and check the values. If analytics_storage is set to 'granted' by default, your setup is not compliant with UK GDPR. The ICO requires analytics cookies to be off until the user explicitly consents. The correct default is 'denied' for all consent types except security_storage. This is not a grey area — the ICO has been explicit. If you are using Google's own consent default template and have not modified it, you are fine. If a developer hand-wrote your consent script, check it now.

3. You Are Sending PII to Google

GA4's terms of service explicitly forbid sending personally identifiable information — email addresses, phone numbers, full names, postcodes, National Insurance numbers, anything that can identify an individual. Yet GA4 properties routinely receive PII through misconfigured events. Check your event parameters in Admin → Events. Look for any parameter that might contain an email address (often called user_email or email — these should never be event parameters), a full name (user_name), a phone number (phone), or a IP address you are explicitly passing. If you find any of these, remove the event parameter immediately. GA4 can suspend your property for PII violations.

4. Conversions Are Not Actually Key Events

In early 2026, Google renamed "conversions" to "key events" and changed how they work. If your GA4 property was set up before the change, check Admin → Key Events. Are your important events — form submissions, purchases, bookings — marked as key events? If not, open the event, toggle the "Mark as key event" switch, and save. Without this, your conversion reporting is blank and your Google Ads conversion import will show zero conversions. One client came to us after six months of running Google Ads with "no conversions" — the ads were driving leads; the key event toggle was just off.

5. Duplicate or Overlapping Conversion Events

While you are in the Key Events list, check for duplicates. A common pattern: you have both a purchase event and a generate_lead event marked as key events, but the generate_lead event fires on the same thank-you page as purchase. Every sale is counted twice — once as a lead and once as a purchase — and your total conversion number is meaningless. Only mark as key events the events that represent distinct, non-overlapping business outcomes. For most small businesses, one or two key events are enough.

6. Data Retention Is Still at 2 Months

GA4 defaults to 2-month data retention for granular reports. Admin → Data Settings → Data Retention. If it says "2 months," switch it to "14 months." This is free, instant, and means that in January next year you can compare to January this year. Without this setting, your historical data degrades into useless aggregates after 60 days. This one setting alone makes the difference between analytics that get more useful over time and analytics that reset every quarter.

7. Your Internal Traffic Is Not Filtered

Admin → Data Settings → Data Filters. If there is no active internal traffic filter, your team's browsing — including every test, every page build, every designer refreshing to see CSS changes — is mixed in with real customer data. Define your office IP address, create a filter, test it in "Testing" mode to confirm it catches your traffic, then activate it. For remote teams, add your VPN IP. For hybrid teams, add both office and home IPs — but update home IPs when they change.

8. Google Ads Linking Is Set Up but Broken

Admin → Product Links → Google Ads Links. If you have a link listed, click into it and check two things. First, is "Enable personalised advertising" toggled on? Without this, you cannot build GA4 audiences and push them to Google Ads for remarketing. Second, is "Auto-tagging" enabled? Without auto-tagging, Google Ads clicks arrive at your site without the GCLID parameter and GA4 cannot attribute the session to the ad. The link might show as "active" but if neither toggle is on, no data flows between the two platforms.

9. Cross-Domain Tracking Is Not Configured

If your business operates on more than one domain — your main site on example.co.uk and your booking system on booking.example.com or a third-party platform — and cross-domain tracking is not configured, every time a user moves between domains they become a new user with a new session. Your user count is inflated, your session count is inflated, and your conversion attribution is wrong because the ad click is attributed to one session and the conversion to a different one. In GTM, add all your domains to the GA4 Configuration tag under "Fields to Set" → cookie_domain → 'auto', then configure cross-domain tracking under Tag Configuration.

10. No One Has Looked at This in Six Months

The most common audit finding is not a technical fault — it is neglect. GA4 properties accumulate dust. Events get added for a campaign and never cleaned up. Custom dimensions get created, used once, and left to clutter reports. Google deprecates a feature and your setup silently breaks. If the last time anyone touched your GA4 configuration was the day it was set up, your audit has already found its biggest finding. Schedule a 15-minute GA4 health check on a recurring calendar invite — first Monday of every quarter — and work through this checklist each time.

UK-Specific Audit Points

ICO Consent Banner Alignment

Check your consent banner against ICO guidance. Does it have an equally prominent "Reject All" button alongside "Accept All"? Are any cookie categories pre-ticked? Is the language clear about what each category does? The ICO has published cookie compliance guidance and has signalled that enforcement action is coming. Your consent banner should also integrate with Google Consent Mode v2 — verify in GTM Preview that consent state updates correctly between "denied" and "granted" when you interact with the banner.

.co.uk Domain Audit

If you run a .co.uk domain, check that your GA4 property's reporting currency is set to GBP (Admin → Property Settings → Currency for reporting). Check that your timezone is set to UK time (GMT/BST). If you also run a .com or .eu domain, verify each has its own data stream or proper cross-domain tracking is in place.

Google Search Console Integration

Admin → Product Links → Search Console Links. If this link is missing, you are flying blind on SEO. The Search Console integration shows you exactly which Google queries are driving traffic to which pages. It is free and takes two minutes to set up. If you have not linked Search Console to GA4, do it now.

Want Someone Else to Do This?

North Digital offers a flat-fee GA4 audit that covers all 10 points above plus a written report with prioritised fixes, exact remediation steps, and a 30-minute walkthrough call. We have done this for marketing agencies, e-commerce sites, service businesses, and SaaS companies — and we have never sent a report that said "everything is fine." Get in touch and we will have your audit back within three working days.