GA4 Setup & Audit Checklist Template

What the GA4 Setup & Audit Checklist Covers

1. 1
   Phase 1

   Phase 1: Scope, People & Measurement Plan

   4 tasks

   Answer the questions in the first task before anything else: a new property or an existing one, web or app streams, e-commerce, visitors in the EEA or UK, Google Ads and BigQuery. They show the tasks this run needs. Every due date counts from the day the work starts.

   • Record the property, the work and who is involved — the website or app, the Google Analytics account and property, the day the work starts, which every due date counts from, whether this is a new property or an audit of an existing one, and the analytics lead, developer or tag manager, marketing or ads manager and analytics owner
   • Write or review the measurement plan — the business goals the property serves, the user actions that show progress towards them, the event that measures each action, which of those events are key events, and the reports people need from the data
   • Review the last audit and the change history — the actions from the last audit, closed or carried forward with an owner, and the property’s Change history in Admin since then: settings changed, links added or removed, and by whom
   • List every site, app, domain and tag in scope — every domain and subdomain, checkout, booking or payment pages on other domains, each app, the measurement ID or Tag Manager container on each, and any other tool or plugin that sends data to the property
2. 2
   Phase 2

   Phase 2: Account, Property & Access

   5 tasks

   A new property is created here; an existing one has its structure checked instead. User access, the property details and the data retention setting are checked in both.

   • Create the account and property — in Admin, Create, then Account (if the business has none) and Property: a property name, the reporting time zone and currency, the industry category and business size, and the Terms of Service and Data Processing Amendment accepted for a new account, all under an account the business owns
   • Check the account and property structure — the property sits in an account the business owns rather than an agency’s, its name says which site or app it measures, and old or test properties that still collect data are recorded for a decision
   • Review user access and remove leavers — in Admin, Account access management and Property access management: each person or group has the lowest of the five roles (Administrator, Editor, Marketer, Analyst, Viewer) they need, No Cost Metrics or No Revenue Metrics where cost or revenue should stay hidden, and leavers and former agencies removed
   • Check the property details — in Admin, Property details: the property name, industry category, reporting time zone and currency. A time zone change only affects data from then on and can leave a flat spot or a spike, so change it no more than once a day
   • Set and record the data retention period — in Admin, Data retention: 2 or 14 months on a standard property, chosen on purpose and recorded. It limits how far back explorations and funnel reports can look; standard reports are not affected. A change takes effect after 24 hours, and needs the Editor role
3. 3
   Phase 3

   Phase 3: Data Streams & Tag Installation

   6 tasks

   The website tasks appear for web streams and the app task for app streams. Check the tag on real pages, not only the home page, and watch the events arrive before going further.

   • Create or check the web data stream — in Admin, Data collection and modification, Data streams: one web stream for the site, its URL and stream name, and the measurement ID (G-) recorded for the developer
   • Create or check the app data streams — an iOS or Android stream per app with its bundle ID or package name, the Firebase project the stream is linked to, and the Google Analytics for Firebase SDK in the current app release
   • Install the Google tag or Tag Manager container on every page — the Google tag (gtag.js) or a Google Tag Manager container on every page of every domain, using the same tag ID across domains, with the Tag coverage summary in the Google tag settings showing no untagged pages
   • Check for duplicate and leftover tags — one page_view per page load, with no second copy of the tag from a plugin, a hard-coded snippet or an old container, and no tags left by tools the business no longer uses
   • Verify the events in Tag Assistant and DebugView — debug mode turned on for your own device through Tag Assistant (tagassistant.google.com), the events watched in Admin, Data display, DebugView as you use the site or app, and the tag quality status in the Google tag settings
   • Review the Google tag settings — in the web stream, Configure tag settings: automatic event detection, the session timeout (30 minutes by default) and the engaged-session timer (10 seconds by default), each kept or changed on purpose
4. 4
   Phase 4

   Phase 4: Events, Key Events & Custom Definitions

   7 tasks

   Use Google’s recommended event names before inventing your own. The e-commerce tasks appear when the site or app sells online. Key events and custom definitions only count from the day they are set up; they do not change past data.

   • Check enhanced measurement — in the web stream, Enhanced measurement: page views, scrolls, outbound clicks, site search, video engagement, file downloads and form interactions each on or off on purpose, the site search query parameters matching the site, and no personal information collected in page addresses
   • Check the recommended events — the actions in the measurement plan sent with Google’s recommended event names and their prescribed parameters, such as generate_lead, sign_up, login and search, where one fits
   • Check the custom events and their names — every custom event in the measurement plan, named consistently, not repeating a recommended or automatically collected event, firing once per action and carrying no personal information
   • Set up the e-commerce events — the events view_item_list, select_item, view_item, add_to_cart, remove_from_cart, view_cart, begin_checkout, add_shipping_info, add_payment_info, purchase and refund, each with its items array, and currency set at event level whenever value is sent
   • Test a purchase and its transaction ID — a test order with a unique transaction ID (never an empty one), value, tax, shipping and currency matching the order in the shop, a reload of the confirmation page not counted twice, and a refund sent with the same transaction ID
   • Mark the key events — in Admin, Data display, Events: the events in the measurement plan marked as key events with the star, within the limit of 30 on a standard property, and events that no longer matter unmarked. Marking needs the Marketer role and counts from that day, not before
   • Register the custom dimensions and metrics — in Admin, Custom definitions: each custom parameter the reports need registered once, within the standard limits (50 event-scoped and 25 user-scoped dimensions, 10 item-scoped, 50 custom metrics), no predefined dimension registered again and no high-cardinality values such as IDs or timestamps
5. 5
   Phase 5

   Phase 5: Consent & Data Settings

   7 tasks

   Your consent banner and your legal adviser decide which visitors are asked and what waits for their answer; this phase checks the property does what they decided. The consent mode tasks appear when you have visitors in the EEA or the UK.

   • Record what your consent banner and legal adviser require — which visitors see the banner, which tags may run before a choice and which wait, who decided and when, so the checks below have something to test against
   • Set up consent mode — the default consent state set on every page before any tag sends data, all four parameters (ad_storage, analytics_storage, ad_user_data and ad_personalization) updated from the banner’s choice, and basic or advanced consent mode chosen with the legal adviser
   • Test that the banner’s choices reach the tag — accept, reject and change the choice in Tag Assistant: the consent update is sent on the page where the visitor chooses, before they move on, and with analytics consent denied no events appear in DebugView
   • Check Consent settings in Admin — in Admin, Data collection and modification, Consent settings: each data stream shows the ad_user_data and ad_personalization signals arriving. After a fix, the notices can take 48 to 72 hours to update
   • Review Google signals and ads personalisation — in Admin, Data collection and modification, Data collection: Google signals on or off on purpose, the regions it collects in, and the ads personalisation setting by country or region, agreed with whoever owns privacy
   • Review user-provided data collection and the acknowledgement — in Admin, Data collection: whether user-provided data collection is on (it needs a Google Ads link and is not available in the Health industry category), the "I acknowledge" box for user data collection, and the matching Google tag setting, each agreed with whoever owns privacy
   • Check the reporting identity — in Admin, Data display, Reporting identity: Blended, Observed or Device-based chosen on purpose and recorded, with User-ID sent only if the site or app signs users in
6. 6
   Phase 6

   Phase 6: Filters, Referrals & Cross-Domain

   5 tasks

   A data filter is permanent: excluded data is never processed and cannot be recovered. Test every filter before you make it active. Internal traffic, cross-domain and referral settings belong to the web stream.

   • Define internal traffic — in the web stream, Configure tag settings, Define internal traffic: a rule for each office or VPN IP address or range, with traffic_type set to internal (or a name per location)
   • Test and activate the internal traffic filter — in Admin, Data filters: an Internal Traffic filter created in the Testing state, matching events checked in an exploration with the Test data filter name dimension (allow 24 to 36 hours), then made Active
   • Check the developer traffic filter — a Developer Traffic filter, which excludes events sent in debug mode, tested and then made Active, within the limit of 10 data filters per property
   • Set up cross-domain measurement — in the web stream, Configure tag settings, Configure your domains: every domain a visitor moves between in one journey, such as a separate checkout or booking domain, all using the same tag ID, tested by following a link and seeing the _gl parameter
   • List unwanted referrals — in the web stream, Configure tag settings, List unwanted referrals: payment providers and other services visitors return from, such as a password-reset email link, so they do not start new sessions as referrals (up to 50 per stream)
7. 7
   Phase 7

   Phase 7: Links & Reporting

   6 tasks

   The Google Ads tasks appear when Google Ads is in use and the BigQuery task when an export is wanted. Then make sure the people who use the data can find the reports they need.

   • Link Google Ads — in Admin, Product links, Google Ads links: each Google Ads account (or the manager account) linked by someone who is an Editor in Analytics and an administrator in Google Ads, with auto-tagging and personalised advertising set on purpose
   • Check the key events used in Google Ads — the Google Ads conversions created from Analytics key events listed, each still matching an event that fires, and Google Ads traffic not reported as (not set) because of an unlinked account, auto-tagging switched off or incomplete UTM tags
   • Link Search Console — in Admin, Product links, Search Console links: the verified Search Console property linked to the web stream (one each way), and the Search Console report collection published from the Library, since it is unpublished by default
   • Link BigQuery — in Admin, Product links, BigQuery links: a Google Cloud project with the BigQuery API on, linked by someone with owner access to it, the data location, the streams and events to export, and daily or streaming export, kept under the 1 million events a day daily-export limit of a standard property
   • Set up the reports people use — the report collections in the Library match the business, with key event and e-commerce reports where they apply, and the people in the measurement plan know where to find what they need
   • Build the explorations and saved comparisons — the free form, funnel and path explorations the measurement plan asks for, shared with the property, and saved comparisons such as web against app or one country against the rest
8. 8
   Phase 8

   Phase 8: Data Quality Checks & Sign-off

   8 tasks

   Check the data after at least a week with the filters active. A data quality problem found here adds a task to fix it, and the analytics owner signs off the property as ready for reporting.

   • Compare Google Analytics with the source system — orders, revenue, leads or sign-ups for the same week in Google Analytics and in the shop, CRM or app back end, with the difference recorded and explained
   • Check (not set), Unassigned and self-referrals — (not set) landing pages (sessions with no page_view), (not set) session source or medium (often a Tag Manager tag not firing on Initialization - All pages), campaign links with incomplete UTM tags, and your own domains appearing as referrers
   • Check thresholds and sampling in reports — reports and explorations that show the thresholding notice (data withheld so that no one can identify individual users, most often with demographics or search query data) or sampling, and whether a wider date range or BigQuery gives the people who need the data what they need
   • Record whether data quality problems were found — one answer for the whole run: any gap from the checks above that would mislead someone reading the reports, listed with its cause
   • Fix and retest the data quality problems — each problem fixed and checked again in DebugView or the reports, or accepted by the analytics owner with a reason, and the date of each fix recorded so report users know where the data changes
   • Document the setup — the measurement plan, events and parameters, key events, custom definitions, filters, links, consent setup, data retention and who has access, kept where the next person to audit the property will find it
   • Analytics owner signs off the property as ready for reporting — the analytics owner reviews the checks, the open gaps and the documentation and decides whether people can rely on the property’s reports. Nothing after this task can be completed until the decision is recorded
   • Hand over and book the next audit — the people who use the reports told what changed and from which date, open actions given owners, and the next audit booked, for example every quarter or after a site rebuild, tag change or new link