GA4 & GTM Setup Checklist

How to use this checklist

Install Tag Manager first, then GA4 through it, then the events, then the QA. Do not skip the QA: almost every broken analytics setup I inherit was installed correctly and then never tested, so it counts a purchase twice, counts a form submission on page load, or does not count anything at all from mobile.

If your data already looks wrong, start at section 6 and work backwards. Historical GA4 data cannot be corrected retrospectively, so the sooner a fault is found the less of the year is lost.

1. Decide what you are measuring first

1. Write down the actions that are worth money: form submission, call, WhatsApp message, booking, purchase, quote request, brochure download.
2. For each one, note where it happens, how you know it happened, and what it is worth.
3. Note the micro-actions worth watching but not worth calling a conversion: pricing page views, video completion, scroll depth.
4. Agree naming conventions before you build anything: lowercase, underscores, verb_noun, and a document listing every event and parameter.
5. Decide who owns the account. It must be the business, not an agency’s personal Google account.

2. GA4 account and property settings

1. Property created under the business’s own Google account, with at least two admins.
2. Reporting time zone and currency set correctly. Changing them later splits your reporting.
3. Data retention set to the longest available option, since the default discards user-level data sooner than most businesses expect.
4. Internal traffic filter defined by IP and switched from testing to active, so your own team is excluded.
5. Developer or staging traffic excluded, or sent to a separate property.
6. Unwanted referrals configured for payment gateways and booking tools, so a purchase is not attributed to the payment provider.
7. Cross-domain measurement configured if the booking or checkout lives on another domain.
8. Enhanced measurement reviewed rather than left at defaults: decide whether automatic outbound clicks, site search, scrolls and file downloads are useful or noise for you.
9. Google Signals turned on or off deliberately, with the reporting identity you want.
10. Data streams created for the web property, and for the app if you have one.

3. Tag Manager container

1. One container per website, installed with both the head snippet and the noscript body snippet on every page.
2. Container installed once. Search the rendered source for the container ID and confirm there is exactly one.
3. Folder structure and naming convention agreed: tag type, platform, purpose (for example “GA4 – Event – form_submit”).
4. Built-in variables enabled for clicks, forms, scroll, visibility and history change.
5. A GA4 configuration tag fires on all pages, with the measurement ID stored as a constant variable rather than pasted into every tag.
6. Preview mode used for every change, and workspace changes published with a version name and a description of what changed.
7. Publish access limited to people who know what they are doing; everyone else gets edit rights in a workspace.
8. No hard-coded gtag snippet left in the theme alongside the Tag Manager version, which is the most common cause of doubled pageviews.

4. Events and key events

1. An event for each action from section 1, fired from a real signal: a form success callback or thank-you page, not a button click that also fires when the form fails validation.
2. Thank-you page conversions guarded so a refresh does not count a second time.
3. Click-to-call links tracked, and WhatsApp link clicks tracked as their own event.
4. Chat widget and booking tool events captured, using the tool’s own data layer where it has one.
5. Parameters attached that you will actually use: form name, page location, service or product, location or branch.
6. Custom dimensions registered in GA4 for the parameters you want to report on, since unregistered parameters cannot be used in reports.
7. Only genuine outcomes marked as key events. Marking scroll depth as a key event corrupts every conversion report and every ad platform that imports it.
8. No personal data sent to GA4: no email addresses, phone numbers or names in event parameters or page URLs.
9. For health, finance or similarly sensitive businesses, events record that an enquiry happened, not what it was about.

5. Ecommerce, if you sell online

1. The full funnel is implemented: view_item, add_to_cart, begin_checkout, add_payment_info, purchase.
2. Purchase events include transaction_id, value, currency and items, and the transaction_id deduplicates repeat fires.
3. Revenue in GA4 reconciles with the store’s own order report within a small margin. If it does not, fix it before anyone builds a report on it.
4. Refunds are sent, so revenue reporting is not permanently inflated.
5. Item-level data uses the same product IDs as the Merchant Center feed and the Meta catalogue.

6. Platform links and imports

1. Google Ads linked to GA4, with the conversions you want imported chosen deliberately rather than importing everything.
2. The same conversion is not counted twice into bidding: once from the Google Ads tag and again from an imported GA4 key event.
3. Search Console linked so query data appears alongside behaviour.
4. Merchant Center, BigQuery and any dashboard tool linked if you use them; the BigQuery export is worth enabling early because it only collects data from the day you turn it on.
5. Meta Pixel and Conversions API set up in parallel, with their own event names, and not confused with GA4 events.
6. UTM parameters applied to every paid, email and social link using one convention. The UTM builder keeps them consistent, and inconsistent capitalisation is what splits one campaign into four rows.

7. Consent and privacy

1. If you serve markets where a consent banner is required, a consent management platform is in place and Consent Mode is configured so tags respect the visitor’s choice.
2. Consent defaults are set before any tag fires, not after.
3. The privacy policy describes what you collect and why, and matches what is actually installed.
4. IP anonymisation and data-sharing settings reviewed.
5. Sensitive parameters checked once more: nothing that identifies an individual is leaving the site in a URL, an event or a page title.

8. QA before you trust the data

1. Use GTM Preview and the GA4 DebugView together, on desktop and on a real phone.
2. Perform every tracked action yourself and watch the event arrive once, with the right parameters.
3. Submit a form that fails validation and confirm no conversion is recorded.
4. Refresh a thank-you page and confirm the conversion does not fire again.
5. Check Realtime for duplicate pageviews, which show up as two events per page load.
6. Compare a week of GA4 sessions with server logs or another source for a sanity check.
7. Confirm the ad platforms report roughly the conversions you see in GA4; differences are expected, but an order of magnitude is a fault.
8. Document what is installed, where, and who to call. Put it somewhere the next person will find it.

9. Reporting and maintenance

1. One report that answers the only question that matters: how many enquiries came from each channel, and from which pages.
2. Explorations or a dashboard saved rather than rebuilt each month.
3. Alerts set for a sudden drop in conversions, which is how you find a broken tag within days rather than at month end.
4. Tracking retested after every website change, theme update, form plugin change or checkout change.
5. A quarterly review that removes tags nobody uses, since each one costs page speed.

Faults I find most often

Two GA4 installations on the same page. A key event that is really a button click. Payment gateways appearing as the top referral source. Internal traffic never excluded, so the office is the biggest city. UTM tags with mixed capitalisation splitting one campaign across four rows. Every one of them is caught by an hour of the QA in section 8.

If you want this checked or built, the services are GA4 setup, Google Tag Manager and the wider analytics and tracking work, with ad-side tracking under Google Ads conversion tracking and Meta Pixel and Conversions API. A free tracking audit will tell you which of these items are failing on your site. Other checklists are on the resources page.

Last updated 2026-09-03.

Updated September 26, 2026