GA4 Compliance Tracker — Is Your Google Analytics Setup Actually Complete?

The Problem: Most GA4 Setups Are Incomplete

Here is a number that should concern you: 40-60% of GA4 best practices are missed in the average implementation we audit. Not small businesses with no analytics team — mid-market companies with dedicated marketing ops, agencies managing their tags, and in-house data teams reviewing dashboards daily.

The issue is not that people are not trying. It is that GA4 is a fundamentally different product from Universal Analytics, and most migrations treated it as a "swap the tracking code" project. It was not. GA4 has a different data model (event-based vs. session-based), different configuration requirements, different privacy controls, and different reporting paradigms. A technically correct GA4 setup requires deliberate configuration across at least six distinct areas — and most setups only address two or three of them.

The result? You are making business decisions on incomplete data. Your conversion counts are wrong. Your attribution is skewed. Your consent controls may not actually be controlling anything. And you probably do not know it, because GA4 does not tell you what you have not configured — it just silently gives you worse data.

What "GA4 Compliance" Actually Means

When we say "GA4 compliance," we do not mean regulatory compliance alone (though that is part of it). We mean: is your GA4 setup complete, accurate, and configured according to Google's own best practices?

Think of it like a GA4 setup audit. A compliant GA4 property has properly configured data streams, a deliberate event architecture, working consent controls, accurate conversion tracking, clean data quality, and reporting that actually answers business questions. Miss any one of these and your data has blind spots.

Our GA4 Compliance Tracker evaluates your setup across these six categories. Here is what each one covers and what good versus bad looks like.

The 6 Categories of GA4 Compliance

1. Data Streams and Property Configuration

What it covers: Your GA4 property structure, data stream setup, measurement ID deployment, enhanced measurement settings, and Google Signals activation.

What good looks like:

• One web data stream per domain (not multiple streams for the same site)
• Enhanced measurement enabled with deliberate toggle choices — not everything left at defaults
• Google Signals activated for demographics and cross-device reporting
• Data retention set to 14 months (the maximum), not the default 2 months
• Measurement ID deployed via GTM, not hardcoded in the site template

What bad looks like:

• Multiple data streams for the same domain (creates duplicate events)
• Data retention at 2 months (you cannot do any year-over-year analysis in Explorations)
• Google Signals off (no demographics, no cross-device)
• Enhanced measurement left entirely at defaults (scroll tracking firing at 90% threshold when your content is long-form — useless)

2. Event Architecture

What it covers: How your events are structured, whether you are using recommended events correctly, custom event naming conventions, and parameter strategy.

What good looks like:

• Recommended events (like purchase, add_to_cart, generate_lead) used with their required parameters
• Custom events following a consistent naming convention (snake_case, no spaces, descriptive)
• Event parameters that carry meaningful context — not just event names with no parameters
• Custom dimensions and metrics registered in the GA4 admin for the parameters you actually use
• No more than 500 distinct event names (GA4's hard limit)

What bad looks like:

• Universal Analytics-style events crammed into GA4 (category/action/label passed as parameters)
• Hundreds of unique event names generated dynamically (e.g., click_button_hero_homepage_variant_a)
• Parameters collected but never registered as custom dimensions — meaning they exist in raw data but are invisible in reports
• No use of recommended events, even when your business model maps directly to them

3. Consent Mode v2

What it covers: Your Google Consent Mode implementation, default consent state, consent signal propagation, and integration with your Consent Management Platform (CMP).

Why it is critical: As of March 2024, Consent Mode v2 is required for any advertiser serving ads in the EEA. But here is what most people miss: Google has also confirmed that Consent Mode affects data quality globally. Without it, you lose behavioural and conversion modelling in GA4. Your Google Ads campaigns lose smart bidding signals. Your remarketing audiences shrink.

For businesses operating in India, the DPDP Act's consent requirements make Consent Mode v2 not just a Google requirement but a legal one. If your consent banner says "analytics cookies blocked" but GA4 is still collecting data with analytics_storage: granted, you have a compliance problem and a data integrity problem.

What good looks like:

• Default consent state set to denied for analytics_storage and ad_storage
• Consent signals updated dynamically when the user makes a choice
• All Google tags (GA4, Google Ads, Floodlight) responding to consent state changes
• Consent Mode implemented as "Advanced" (tags load with limited functionality, then unlock on consent) rather than "Basic" (tags blocked entirely until consent)
• URL passthrough and ads data redaction configured for maximum data recovery

What bad looks like:

• No Consent Mode at all — tags fire regardless of user consent
• Default state set to granted — effectively bypassing your consent banner
• Consent Mode v1 (only two consent types) instead of v2 (which adds ad_user_data and ad_personalization)
• CMP deployed but not integrated with GTM consent types

4. Conversions and Key Events

What it covers: Whether your important business actions are marked as key events (formerly "conversions"), whether they fire accurately, and whether attribution is configured correctly.

What good looks like:

• Key business actions (purchases, form submissions, qualified leads) marked as key events
• Conversion counting method set appropriately — "once per session" for leads, "every event" for purchases
• Conversion values assigned where applicable (not just binary conversion/no-conversion)
• Google Ads linked and importing GA4 key events for smart bidding
• Attribution model understood and deliberately chosen

What bad looks like:

• No events marked as key events (GA4 tracks everything but optimises for nothing)
• Page views marked as conversions (inflates conversion counts, destroys CPA metrics)
• Google Ads importing conversions that are not being tracked accurately in GA4
• No conversion values — making ROAS-based bidding impossible

5. Data Quality

What it covers: Internal traffic filters, unwanted referrals, debug mode configuration, cross-domain tracking, and data anomaly monitoring.

What good looks like:

• Internal traffic filter defined using your office IP ranges and testing environments
• Unwanted referrals list configured (payment gateways, SSO providers, CDNs that show up as referral sources)
• Debug mode used during development to validate events before they hit production
• Cross-domain tracking configured if you have multiple domains in the user journey (e.g., main site to checkout subdomain)
• Regular review of real-time and DebugView to catch data anomalies

What bad looks like:

• No internal traffic filter — your team's daily usage inflates pageviews and skews engagement metrics
• Payment gateway (Razorpay, Stripe, PayPal) showing as a top referral source — breaking attribution for every transaction
• No debug mode usage — events deployed to production untested, errors discovered weeks later
• Cross-domain tracking not configured — users crossing between domains appear as new sessions, doubling your user count

6. Reporting and BigQuery Export

What it covers: Whether you are actually using GA4's reporting capabilities, custom reports, Explorations, Looker Studio integration, and the most underused feature in GA4 — BigQuery export.

Why BigQuery export matters: GA4's native interface has sampling, data retention limits, and cardinality issues. BigQuery export gives you raw, unsampled, unlimited-retention event data. It is free for the first 1 million events per day (which covers the vast majority of businesses). If you are not exporting to BigQuery, you are voluntarily accepting worse data than what GA4 is capable of providing.

What good looks like:

• BigQuery export enabled (streaming or daily) — even if you are not querying it yet
• Custom Explorations built for your specific business questions
• Looker Studio dashboards connected to GA4 (or BigQuery) for stakeholder reporting
• Audiences defined based on actual user behaviour, not just demographics
• Regular data audits comparing GA4 numbers against your CRM or backend

What bad looks like:

• BigQuery export not enabled — you are losing raw data that cannot be recovered retroactively
• Reliance on default GA4 reports only (which rarely answer specific business questions)
• No Looker Studio dashboards — stakeholders either do not look at analytics or misinterpret raw GA4 screens
• No data validation against backend systems — GA4 says 100 purchases, your database says 87, and nobody has investigated the discrepancy

Consent Mode v2: What Happens Without It

This deserves its own section because the consequences are severe and underappreciated.

Without Consent Mode v2:

• Google Ads: You cannot use remarketing audiences created from GA4. Your smart bidding loses the behavioural signals it needs to optimise. Your campaign performance degrades — not visibly at first, but compounding over time.
• GA4 modelling: GA4 uses machine learning to model conversions and behaviour for users who decline consent. Without Consent Mode, there is no modelling — those users simply disappear from your data. Your reported conversions drop, but your actual conversions have not changed. You are now making decisions on artificially deflated numbers.
• Regulatory risk: In India, the DPDP Act requires meaningful consent for data processing. In the EU, GDPR requires it. If your tags fire before or regardless of consent, you have a legal exposure. Consent Mode is the technical mechanism that connects your legal obligations to your data collection.

Setting up GA4 consent mode correctly is not optional. It is the foundation that everything else sits on. Get this wrong and nothing else in your GA4 setup matters.

How to Use OPIN's GA4 Compliance Tracker

1. Navigate to the tool: Go to opinsolutions.com/tools/ga4-compliance-tracker
2. Assess each category: The tracker walks you through questions across all 6 compliance categories. For each item, indicate whether it is implemented, partially implemented, or not implemented.
3. Be honest: If you are not sure whether something is configured, treat it as not implemented. Uncertainty is a gap.
4. Review your score: The tracker calculates a compliance percentage for each category and an overall score.
5. Read the guidance: Each gap comes with an explanation of why it matters and what to do about it.
6. Prioritise: Start with Consent Mode (it affects everything downstream), then data quality (garbage in, garbage out), then conversions (this is what you are ultimately optimising for).

What Your Score Means and What to Prioritise

Your GA4 compliance score is a percentage across all 6 categories. Here is how to interpret it:

• 90-100%: Your setup is comprehensive. You are in the top 5% of GA4 implementations we see. Focus on ongoing monitoring and optimisation.
• 70-89%: Solid foundation with notable gaps. You likely have data streams and basic events right, but are missing consent mode, BigQuery export, or data quality filters. These are high-impact fixes.
• 50-69%: Significant gaps. Your data is directionally useful but has material accuracy issues. Consent mode is probably not configured, internal traffic is inflating numbers, and key events may be miscounted. Prioritise a structured GA4 setup audit.
• Below 50%: Your GA4 setup needs a rebuild, not a tune-up. The data you are collecting is unreliable for decision-making. Consider engaging a specialist for a free analytics tracking audit before making any business decisions based on your current data.

Priority order for remediation:

1. Consent Mode v2 — legal requirement, affects data modelling and ads performance
2. Data quality filters — internal traffic, unwanted referrals, cross-domain tracking
3. Key events and conversions — this is what your business optimises against
4. Event architecture — structured events with parameters and registered dimensions
5. BigQuery export — enable it now, even if you will not query it for months. Data does not backfill.
6. Reporting — Explorations, Looker Studio, audience definitions

BigQuery Export: The Most Underused GA4 Feature

We need to talk about BigQuery export because it is genuinely the most important configuration in GA4 that nobody enables.

Here is what you get with BigQuery export:

• Unsampled data: GA4's interface samples data for properties with more than 500K events. BigQuery does not.
• Unlimited retention: GA4 keeps data for 14 months max. BigQuery keeps it forever (or as long as you want to pay for storage — which is cheap).
• SQL access: Query your analytics data with SQL. Join it with CRM data, backend data, ad spend data. Build analyses that GA4's interface cannot support.
• Raw event-level data: See every event, every parameter, every user property. No aggregation, no cardinality limits.
• Free tier: The first 1 million events per day of export are free. Storage in BigQuery is approximately USD 0.02 per GB per month. For most businesses, this costs literally nothing.

Enable it today. Even if you do not know SQL. Even if you have no plans to use it. Because data that is not exported is data that is gone forever once it passes the retention window.

Take Action

Your GA4 setup is either an asset or a liability. If it is configured correctly, it gives you reliable data to make better business decisions. If it is configured poorly, it gives you confident-looking numbers that are wrong — which is worse than having no data at all.

Start with the GA4 Compliance Tracker. It takes 10 minutes. You will know exactly where your gaps are.

If your score is below 70% and you want hands-on help, request a free analytics tracking audit. We will review your GA4 setup, your tag management, your consent implementation, and your data quality — and give you a prioritised action plan.

No fluff. No upsell on the call. Just a clear picture of where your analytics stands and what to fix first.

Frequently Asked Questions

What is a GA4 compliance checklist?

A GA4 compliance checklist is a structured audit of your Google Analytics 4 setup against established best practices. It evaluates whether your property configuration, event architecture, consent controls, conversion tracking, data quality filters, and reporting are set up correctly. Unlike a generic "how to set up GA4" guide, a compliance checklist identifies what is missing or misconfigured in an existing implementation.

How do I know if my GA4 setup is complete?

Most GA4 setups are incomplete without anyone realising it. Signs of an incomplete setup include: data retention still at the default 2 months, no internal traffic filter, no Consent Mode implementation, no events marked as key events, no BigQuery export, and payment gateways appearing as referral sources. OPIN's GA4 Compliance Tracker evaluates your setup across 6 categories and gives you a percentage score for each.

Is Consent Mode v2 required for GA4?

Consent Mode v2 is required by Google for any advertiser serving ads in the EEA as of March 2024. For businesses in India, the upcoming DPDP Act enforcement (May 2027) makes consent-gated data collection a legal requirement. Even outside regulatory requirements, Consent Mode v2 is critical for GA4 data quality — without it, GA4 cannot model conversions for users who decline consent, resulting in artificially deflated metrics.

Why should I enable BigQuery export for GA4?

BigQuery export gives you unsampled, unlimited-retention, event-level analytics data accessible via SQL. GA4's native interface samples data for high-traffic properties, limits retention to 14 months, and has cardinality limits on dimensions. BigQuery removes all of these constraints. The first 1 million events per day are exported free, and storage costs approximately USD 0.02/GB/month. Data cannot be backfilled — if you enable export today, you only get data from today forward.

What GA4 best practices should I prioritise in 2026?

In 2026, the top GA4 best practices to prioritise are: (1) Consent Mode v2 implementation with proper default-denied state, (2) internal traffic and unwanted referral filters for data quality, (3) key events configured with appropriate counting methods and values, (4) event architecture using recommended events with registered custom dimensions, (5) BigQuery export enabled for raw data access, and (6) regular data validation against backend systems. Consent Mode is the highest priority because it affects both regulatory compliance and data modelling quality.