A GA4 and tracking audit checklist for new clients.

Most reporting problems start at the tag. A dashboard can only show what was collected, and it shows a figure collected twice with exactly the same confidence as one collected once. No amount of work on the report fixes a page that sends the wrong thing.

So the audit happens on the client's website, with the site loaded the way a visitor loads it, watching what actually leaves the browser.

For an agency the moment to do it is before the first report goes out. Done then, every finding is a fact about the setup you inherited. Done six months later, the same finding is a question about why your reports were wrong.

Roughly in order of how much bad data each one causes.

• One analytics configuration per page

  Two configurations sending the same page view double every count that depends on it. It usually happens when a tag is added in a tag manager while the hard-coded one stays in the template.

• No tags before consent

  Load the page and do nothing. Any advertising or analytics request that fires before the visitor has answered the banner is a finding, and the most serious one on this list.

• Consent signals that are actually sent

  Covered in its own section below, because a banner can look right and still send nothing.

• Nothing left in debug or preview

  Debug settings and preview containers shipped to the live site send test traffic into production data, or send nothing where the real tag should be.

• Pixels on every template

  Check the product, checkout and confirmation pages, not just the home page. A pixel missing from one template is invisible to anyone who only checks the front door.

• Purchases with a value and a currency

  A purchase event without a value is a count with nothing to optimise on, and one without a currency is a value that cannot be added to anything.

• No personal data in URLs

  Email addresses or names in query strings are collected by every tag on the page, which is a privacy problem as well as a data one.

• No leftovers

  Tags for retired tools and old analytics versions still load, still slow the page down, and occasionally still send data somewhere.

Consent Mode is a set of signals the page sends to Google's tags saying what the visitor agreed to. It has to be set to a default before any tag loads and updated when the visitor makes a choice, and its current version carries two further signals, covering whether data may be used for advertising and for personalised ads. A banner can display perfectly and still get all of that wrong.

To check it yourself, open the site in a private window with the browser's developer tools on the network tab, and load the page without touching the banner. Google's requests carry the consent state with them, and Google's Tag Assistant shows the state each tag saw. Then accept, and check that the state changed. Then repeat in a fresh window and decline, and check that advertising requests either stop or carry the declined state.

Tracking breaks in deployments, quietly. A template change drops a tag, a new consent tool loads in a different order, a checkout redesign removes the confirmation page the purchase event lived on. None of it raises an error. On a client's site, releases often go out without the agency being told, so either agree that you hear about them or re-audit on a schedule.

Keep each audit and compare it with the last one. The useful output of the second audit is not the list of findings, it is the list of what changed since the first.

SightShark works downstream of the tags, where their consequences reach your reports. A duplicated tag shows up as a sudden change in a figure, and a tag that stopped firing shows up as data that never arrived. Anomaly rules can watch for both on every client, so a broken release is caught the day after it ships rather than at month end.

The other check it makes possible is the one a tag audit cannot: analytics figures beside the orders and leads the client's own systems recorded, in one modelled table in your own data warehouse. A tag can fire perfectly and still describe the wrong thing, and only the comparison with the client's own records shows it.