The 2026 GA4 + GTM Setup Checklist

Most analytics problems are not analysis problems. They are setup problems that nobody noticed for six months, and by the time somebody does, the data behind them is unrecoverable. GA4 will not tell you that a parameter was never registered as a custom dimension. GTM will not tell you that a trigger stopped matching after a front-end refactor. Both systems fail silently, and both fail in ways that look exactly like a business result.

This is the checklist we run at the start of a year, at the start of an engagement, and after any significant site change. It is organised in the order things break: collection first, then configuration, then consent, then campaigns, then the governance layer that keeps all of it from rotting.

Work through it once properly and you will spend the rest of the year answering questions about the business instead of questions about the tracking.

1. Collection — is data arriving at all?

Everything downstream is worthless if the hits are wrong. Start here.

• One GA4 configuration tag, firing once, on every page. Duplicate config tags are the single most common cause of inflated users and broken sessions. If you have both a hard-coded gtag.js snippet and a GTM tag, you have two.
• Measurement ID matches the property you actually report on. Staging IDs reaching production is a weekly occurrence in agencies.
• page_view fires on soft navigations in single-page apps. The default GA4 tag fires on load; a React or Vue route change is not a load.
• No duplicate page_view from GA4 Enhanced Measurement's history change setting running alongside a manual SPA tag.
• Events fire once, not twice. Check the interactions that have both an Enhanced Measurement toggle and a hand-built GTM tag: outbound clicks, file downloads, site search, video.
• Consent-gated tags respect the gate. Verify that nothing fires before consent is granted.
• Cross-domain domains are configured if a user's journey crosses hostnames — particularly a payment gateway or booking engine.
• No PII in any parameter. Email addresses in a page_location query string are a policy violation and a deletion request waiting to happen.

The only reliable way to verify these is to watch the requests leave the browser. Nothing in the GA4 interface will tell you that a hit fired twice. A live tag debugging session will, in about ninety seconds.

2. Configuration — will the data be usable?

Collection gets values into GA4. Configuration decides whether you can ever report on them.

• Every custom parameter you send is registered as a custom dimension or metric. This is the highest-value item on the entire list. An unregistered parameter is collected, stored, and permanently invisible in reports. See custom dimensions vs event parameters for why this trips up almost everyone.
• Registered dimensions are actually populated by a tag. The reverse failure: a dimension exists, nothing sends it, and every report shows (not set).
• Key events are marked and their counting method is deliberate — once per event or once per session changes the number materially.
• Key event count is under 30. Agencies burn through this cap fast.
• Data retention is set to 14 months, not the 2-month default. This is the one setting that destroys data you cannot get back.
• Timezone and currency match the business, not whoever created the property.
• Internal traffic filter is Active, not Testing. A filter left in Testing mode does nothing, forever, and nobody notices because it looks configured.
• Bot filtering enabled.
• Google Ads, Search Console, and BigQuery links are in place if you use them. The BigQuery export in particular is free to set up and impossible to backfill — link it now even if you will not query it until Q3.
• Reporting identity is a deliberate choice (Blended, Observed, or Device-based), not a default nobody reviewed.

3. Container — is GTM maintainable?

A container that works today but nobody understands is a liability with a delayed fuse.

• Naming convention applied consistently across tags, triggers, and variables. If you do not have one, adopt one now — retrofitting 200 assets later is a week of work.
• Folders reflect the naming convention.
• No paused tags older than a quarter. Paused means "we will decide later." Later never comes.
• No tags with zero fires in 90 days. Either the trigger is broken or the tag is dead. Both need action.
• Custom HTML tags reviewed individually. These are arbitrary JavaScript on every page of your site, added by whoever had edit access that quarter.
• No document.write anywhere. It still exists in the wild and it still blocks rendering.
• Triggers scoped as narrowly as possible. All Pages when it should be one page is both a performance cost and a data-quality risk.
• DOM-scraping variables inventoried. CSS-selector and DOM-element variables break on the next design refresh, silently. Know which ones you have before the refresh, not after.
• Dependency graph understood — you should be able to answer "what breaks if I delete this variable?" before you delete it. Dependency mapping covers how.
• Server-side container audited too, if you run one. A second container is a second blind spot.

4. Consent — is the setup legal where you operate?

• Consent Mode v2 implemented, with all four signals: ad_storage, analytics_storage, ad_user_data, ad_personalization.
• Default consent state set before any tag fires, in the correct region.
• The CMP updates consent, and the update is observable in the dataLayer.
• Non-Google pixels gated separately. Consent Mode is a Google protocol; a Meta pixel ignores it entirely unless you gate it yourself.
• Additional consent checks configured on tags that need them.
• Privacy policy reflects what you actually collect. Not what the template said.

The Consent Mode v2 implementation guide walks through each of these with the actual GTM configuration.

5. Campaign tracking — can you attribute anything?

• A written UTM taxonomy exists, and someone owns it.
• Case is normalised. Email and email are two different mediums in GA4, forever.
• utm_medium values map to your channel groups. A medium that matches no rule lands in "Unassigned," which is where attribution goes to die.
• Auto-tagging (gclid) is on and manual UTMs are not overwriting it on Google Ads traffic.
• Referral exclusions cover payment gateways and auth providers.
• Internal links do not carry UTMs. This restarts sessions and destroys the original source.

A UTM taxonomy that survives an agency handover covers the governance side, which is the part that actually fails.

6. Governance — will this still be true in June?

The first five sections are a point-in-time state. This one is what keeps it.

• Access reviewed. Who has Admin on the property and Publish on the container? For most accounts the honest answer is "more people than should." Run an access audit.
• Former agencies and contractors removed.
• Automated monitoring in place so a broken tag is caught in hours, not in the monthly report.
• Anomaly alerting on the numbers for the failures no synthetic test covers.
• The setup is documented somewhere a successor will find it.
• A review date is in the calendar. Quarterly is enough for most accounts.

How Tagfire helps

Working this checklist by hand across one property takes a focused afternoon. Across a dozen client accounts it is not a realistic exercise, which is why it does not get done.

Tagfire automates the parts that can be automated:

• The GA4 audit runs 18+ checks covering most of sections 1 and 2 — configuration, key events, data retention, filters, product links, data quality — and returns a scored report with the specific fix for each finding.
• The GTM audit runs 50+ checks across section 3 and 4, including Consent Mode v2, security risks, and stale assets, for both web and server-side containers.
• The GA4 sync checker compares what your GTM tags send against what GA4 has registered, which is the single highest-value item on this page.
• The tag debugger handles the items that need a live browser — duplicate hits, consent gating, cross-domain — and can then replay that same journey on a schedule so section 6 stops being aspirational.
• The access audit covers governance across every property and container at once.

All of them work against your own Google account with read-only scopes, and the audits are free. Start with the GA4 audit — it will tell you within two minutes whether the rest of this checklist is urgent or routine.

If you would rather read the reference documentation first, the Tagfire docs cover each tool in detail.