Google Tag Manager and GA4 audit checklist
This is what I check in the Measurement & Consent Audit. It covers the Tag Manager container, the GA4 property, how tags behave with each consent choice, and whether each key action reaches GA4, Google Ads and Meta.
The short answer
A useful audit checks three sources against each other: what the Tag Manager container is set up to do, what actually fires on the live site, and what GA4 records. Each one alone misses problems the other two would catch. Every key action then gets the same five questions in a key events matrix.
On this page
The Tag Manager container
I export the live version and any open workspace and go through every tag, trigger and variable.
- What each tag, trigger and variable does, and which tags are paused
- Unpublished changes in a workspace, and who owns each container on the site
- Triggers and variables that nothing uses
- Key event tags whose trigger can’t fire, or fires on far more than the action it’s named for
- The same event sent twice, by Tag Manager and by GA4’s enhanced measurement
- Custom HTML tags that throw script errors
- Tracking IDs typed into each tag instead of held in one variable
- Consent settings on each tag, and consent defaults in the container
- Conversion linker and cross-domain settings, including staging domains that don’t belong there
- Tags also hard-coded in the page, outside Tag Manager
- Leftover Universal Analytics tags
- Naming, folders and version notes, so the next person can follow the history
The GA4 property
I review 55 settings in GA4’s admin. Here they are in groups, in roughly the order they appear there.
- Property basics: time zone, currency, industry and data streams
- Data collection: enhanced measurement, event changes made in GA4, and Measurement Protocol secrets
- Privacy settings: email and URL parameter redaction, Google Signals, user-provided data and data retention
- Consent settings: whether GA4 receives the ads measurement and personalization signals
- Traffic hygiene: internal and developer traffic filters, unwanted referrals, domains GA4 suggests adding, and debug mode left on in production
- Key events: which ones record recent conversions, which have gone quiet, and which aren’t business outcomes
- Events: every event GA4 records and what sends it, including events nobody can account for
- Custom definitions, including parameters Tag Manager sends that GA4 never registered
- Attribution and reporting identity settings, audiences and channel groups
- Links to Google Ads and Search Console, and whether the right Search Console property is linked
- A data review: channel mix, share of Direct traffic and signs of automated traffic
The live site, in four consent states
I load the key pages in a fresh browser and record what happens in four states.
- Before the visitor makes any choice on the banner
- After Accept all
- After Reject all
- With Global Privacy Control turned on in the browser
In each state I record which tags load, what GA4 receives and with which consent signals, which Google Ads and Meta requests go out, and any script errors. Form tests use a test form or test entries your team expects, so no fake lead lands in your CRM.
The key events matrix
Every key action gets the same five questions. This sample shows the layout filled in for a typical lead generation site.
| Key action | Event | Fires correctly | Follows consent | Reaches GA4 | Reaches Google Ads | Reaches Meta |
|---|---|---|---|---|---|---|
| Contact form sent | form_ | Yes | Yes | Yes | Yes | Yes |
| Demo booked | meeting_ | Yes | Fires before consent | Yes | Yes | Not sent |
| Newsletter sign-up | newsletter_ | Misses the footer form | Yes | Yes | Not in scope | Not in scope |
| Quote form started | form_ | Counted twice | Yes | Yes | Not in scope | Not in scope |
| Button clicks | button_ | Counts more than clicks | Fires before consent | Yes | Imported as a conversion | Not in scope |
In the audit, each gold cell links to a finding with the evidence, the change I recommend, and the decision your team needs to make.
What comes with the matrix
The audit also includes a traffic-quality check, a findings register that keeps confirmed issues apart from open questions, priorities, and a handoff your team or developer can work from.
What a checklist can’t tell you
Findings cover the sites, containers and key actions in scope, and the evidence I could collect. Tests run from the United States unless other regions are part of the scope, so a banner set to appear only in Europe needs its own test. Whether your setup meets a privacy law is a question for your counsel. I test what the tags do.
Checklist questions
What does a Google Analytics audit include?
A review of the GA4 property’s settings, events and key events, a check of the Tag Manager container behind them, and live tests of each key action. In the Measurement & Consent Audit, that ends in a key events matrix showing whether each action fires correctly, follows consent and reaches GA4, Google Ads and Meta.
How long does a Tag Manager audit take?
About two weeks once I have access, for one flat fee.
