Google Ads and GA4 Tracking Audit Checklist: The 33 Checks We Run Before Trusting an Account's Numbers

Why it is Critical: every downstream item in this audit assumes this link exists. Audiences (checks 24 to 28), the GA4 import option (check 3), and cross-platform reporting all ride on it. The classic failure is a link created years ago by a previous agency under their manager account: it works until they clean up their MCC, then audiences and imports die with no error on your side. Verify the customer ID on the link matches the account currently spending, and that someone at the store, not only the agency, has admin on both sides.

How to check properly: the setting itself takes ten seconds, but the failure lives on the site. Click a live ad, or append ?gclid=test to a landing URL, and confirm the parameter survives to the final page. Common strippers: http to https redirect chains, country or currency redirects, and URL rewrites in the theme. When the GCLID is stripped, GA4 files the session under google organic or direct, your paid revenue in GA4 collapses, and someone wrongly concludes the ads do not work. If you must run manual UTMs as well, keep auto-tagging on: they coexist, and Google Ads reporting needs the GCLID.

The decision in plain terms: Google Ads can count a purchase from its own tag, or from the GA4 purchase event imported as a key event. Both being Primary is the single most common cause of an account reporting roughly double its real revenue. How to check: Goals, then Conversions, then Summary; look for two purchase-shaped actions both labeled Primary, one with source Website and one with source Google Analytics (GA4). The fix is a decision, not a deletion: keep the Google Ads tag as Primary for bidding on most ecommerce accounts (it reports faster and supports enhanced conversions cleanly), set the GA4 import to Secondary so it still appears in reports, and write the decision down so the next person does not re-import it.

Where duplicates come from on Shopify: the Google sales channel installs GA4, then someone adds the same measurement ID through theme.liquid or GTM, and every page view and purchase fires twice. Check with Tag Assistant or the GA4 DebugView on a test order: one page_view per page, one purchase per order. Two purchases with the same transaction ID in DebugView is the smoking gun. Remove the manual snippet rather than the channel integration unless you have a documented reason to prefer the manual route.

What to verify beyond the toggle: open three real orders from the last week and find their conversion values in Google Ads. The value must match the order (or match it minus tax and shipping, if that is your written policy) and the currency must be the account currency or convert correctly. Static default values are worse than no values for tROAS: Smart Bidding will treat a 15 dollar order and a 900 dollar order as identical and optimize toward cheap volume.

Why this is the first thing to check when revenue looks inflated: without an order ID on the conversion, every reload of the thank-you page, every back-button return, and every email receipt click that re-opens the confirmation URL counts again. Shopify's order status page is revisitable by design, so stores without dedup drift 10 to 30 percent high without anyone noticing a single broken thing. Test: place a test order, reload the confirmation page three times, and watch the conversion count. It must stay at one.

What enhanced conversions actually does: sends hashed first-party data (email, and optionally name, address, phone) with the conversion so Google can match conversions that browser privacy features would otherwise drop. Where to check: the conversion action's Diagnostics tab shows whether hashed data is arriving and matching. Common silent failure: the toggle is on but the tag never receives the email variable, so diagnostics show it active with nothing arriving. For UK and EEA traffic, enhanced conversions also depends on the consent signals from check 29.

The logic of the ceiling: Google Ads can only ever take credit for a subset of store revenue, so Ads conversion value above 100 percent of store revenue is proof of a tracking error, no interpretation needed. Compare like for like: same date range, same currency, and remember Ads back-dates conversions to click date (see check 22), so use a window long enough to absorb the lag, which is why this check runs on 21 days. Healthy accounts usually sit meaningfully below the ceiling; how far below depends on channel mix and is a judgment call. At or above the ceiling is not a judgment call. Work checks 3 and 11 first.

The gaps that are normal, so you can spot the ones that are not: Google Ads reports click-attributed, modeled, back-dated conversion value; GA4 purchase revenue is event-based with its own attribution and consent modeling; the backend is cash truth including phone orders, refunds, and post-purchase edits. Expect Ads below backend, GA4 near backend but not equal. Red flags: Ads above backend (see check 14), GA4 far below backend (missed purchase events on some checkout path), GA4 above backend (duplicate events, see checks 5 and 11). Name the reason for every gap and write it in the sheet's notes column.

A public-safe suffix to standardize on: utm_source=google&utm_medium=cpc&utm_campaign={campaignid}&utm_content={adgroupid}&utm_term={keyword}. Use the dynamic {campaignid} ValueTrack rather than hardcoding a name, so one account-level suffix serves every campaign and nothing mislabels when campaigns are renamed. If you also run a custom parameter scheme for your own reporting stack, layer it in the tracking template and keep the UTM suffix intact; the two are not exclusive.

Where the report lives now: the Goals icon, then Measurement, then Attribution. This moved from the old location years ago and plenty of checklists still point at the wrong menu. What to do with it: before cutting any campaign for weak last-click ROAS, read how often it appears on conversion paths without taking the last click. On one client account, a Demand Gen remarketing campaign had spent a few hundred dollars with zero direct attributed ROAS in the dashboard. Instead of killing it on that number alone, the review covered assisted conversions, engaged-view influence, audience quality, spend level, frequency, and whether it was helping Search and PMax close later. That is the difference between an attribution decision and a dashboard reflex.

Two different failures with the same symptom: audiences missing from the audience manager entirely means a link or personalized-advertising problem (checks 1 and 4). Audiences present but stuck near zero for UK or EEA traffic means consent signals are not arriving (check 29): since 2024 Google will not populate personalized audiences from that traffic without valid Consent Mode v2 signals, and enforcement has removed the grace period. US-only stores rarely see the second failure; UK-serving stores see it constantly and misdiagnose it as a linking bug.

What it is in one line: two extra consent signals (ad_user_data and ad_personalization) on top of the original storage signals, delivered by a certified consent platform, telling Google what it may do with a visitor's data. Why it sits in a tracking audit: without valid signals from UK and EEA visitors, remarketing lists from that traffic stop filling, conversion modeling for non-consented users is lost, and reports quietly shrink while the site looks fine. Check it in DevTools: Network tab, filter collect, read the gcs parameter on GA4 hits, and confirm your consent banner is from a Google-certified CMP with the v2 signals enabled. Then re-run the check after any banner or GTM change (check 30), because one mis-ordered tag resets everything to denied.