Google Analytics (GA4)

Audit Checklist

GA4's data model was designed to provide the flexibility that Universal Analytics (UA) lacked. Flexibility comes with pros & cons. It can be powerful in the right hands, but it can be equally as destructive in the wrong hands. A lot of what is included here is opinionated based on our extensive experience working with the platform.

Instrumentation (GTM)

Has a Google Tag (G-XXXXXXXXX) firing on All Pages or similar
Has tags/triggers/variables for the following "core" events and parameters: cta_click, phone_link_click, email_link_click, form_submit

Data Quality

Are event names easily understood?
Do events use a proper snake_case format?
Do events utilize custom dimensions/metrics to provide additional context?
Re: "Key Events": is the events per user metric > ~1.25?

Admin Settings

Data Collection & Modification

Data streams: In most cases there should be a single web data stream where all data is collected.
Data streams > Google Tag:
- Collect Universal Analytics events should be set to OFF
- Allow user-provided data capabilities automatic detection should be turned OFF
Data collection: All regional settings should reflect the businesses target market. Countries outside of a DMA should be disabled for data-privacy considerations.
Data retention: Should be set to 14 months.

Data Display

Custom Definitions > Dimensions: Should have configurations for: form_id, link_path, link_text, link_domain, link_fragment, ui_location, alias, provider, publish_month, and publish_year.
Custom Definitions > Metrics: These are less frequent and are specific account-to-account.

Product Links

Google Ads: Is at least 1 account connected? Is it the correct Account ID?
BigQuery: Export should be configured, with a valid billing profile attached to the project.
Search Console: Is the proper GSC connected?

1st Party Cookies

The [STREAM_ID] placeholder will correspond to the GA4 data-stream implemented on a given site. You may see more than 1 _ga_[STREAM_ID] cookie depending on the setup and how many GA4 properties are implemented to collect data.

Cookie Name	Value Format
`_ga`	`GA1.1.[TIME:MS].[RANDOM:#]`
`_ga_[STREAM_ID]`	`GS2.1.s[SESSION:ID]$o[SESSION:#]$g[IS_ENGAGED]$t[TIME]$j[?]$l[?]$h[?]`

Parsing the `_ga_[STREAM_ID]` cookie(s)

Google recently (~ May 2025) changed the format used to store data inside its session cookies. Unlike in past versions where values were stored in a . delimited string, Google is now storing a serialized object. Read article from David Vallejo here.

 1function parseGa4SessionCookie(cookieValue){
 2 
 3  cookieValue = cookieValue.split('.')[2].split('$');
 4 
 5  return sessionCookie.reduce((obj, item) => {
 6    obj[item[0]] = item.slice(1);
 7    return obj;
 8  }, {});
 9 
10}

Assuming a sample cookie value of GS2.1.s1759781310$o14$g1$t1759782038$j10$l0$h0, you could expect the following return value(s):

1{
2  "s": "1759781310", // [SESS_ID] 
3  "o": "14",         // [SESS_#] 
4  "g": "1",          // [IS_ENGAGED] 
5  "t": "1759782038", // [LAST_HIT_TIME] 
6  "j": "10",     // [?]
7  "l": "0",          // [?]
8  "h": "0"           // [?]
9}