Seven GA4 setup mistakes that quietly corrupt your reporting
The dangerous analytics failure is not the one that throws an error. It is the one that returns a believable number. These are the seven we find most often.
1. Internal and developer traffic is still counted
Define internal traffic by IP in the data stream settings and activate the internal traffic filter — creating the rule without activating the filter does nothing. For small sites, staff sessions can be a double-digit share of the total.
2. Consent Mode v2 is missing or misordered
Without consent mode, denied-consent sessions vanish entirely rather than being modelled, and Google Ads conversion imports degrade. The default consent state must fire before any measurement tag, which in practice means loading the CMP first in the container.
3. Cross-domain tracking was never configured
Any checkout, booking tool or payment provider on a separate domain will show up as a referral and steal attribution from the real source. List every domain in the data stream configuration and test the linker parameter end to end.
4. Every event is marked a key event
Key events feed bidding. Marking scroll depth or newsletter clicks as key events teaches your ad platforms to buy low-value behaviour. Keep key events to the two or three actions with revenue attached.
5. Ecommerce events do not follow the spec
GA4 ecommerce reports only populate when events use the exact expected names and the items array structure. Close is not close enough: view_item, add_to_cart, begin_checkout and purchase, with items, currency and value populated.
6. PII is being sent
Email addresses in page paths and query strings are a common and serious problem. Configure query parameter exclusions, and audit page path reports for @ symbols before someone in legal does.
7. Data retention is left at the default
Event data retention defaults to two months. Change it to fourteen, and if the business needs longer history, export to BigQuery — the free link is one of the strongest reasons to use GA4 at all.
A ten-minute verification pass
- 1.Open DebugView and complete one real conversion end to end
- 2.Confirm the key event fires exactly once with the correct value
- 3.Check the traffic acquisition report for self-referrals
- 4.Compare last month's purchases in GA4 with your backend order count
- 5.Confirm consent denial produces a modelled, not missing, session