GA4 setup checklist for a marketing site in 2026: key events, consent mode, retention and filters

The short answer

A GA4 setup for a marketing site is done when four things are true: every lead is counted once, as a key event sent after your form actually succeeds; data is kept for 14 months instead of 2; your own team's visits are filtered out; and consent mode matches what your banner promises. Everything else on this list (UTMs, Search Console, Google Ads, cross-domain) makes the reports easier to read, but those four decide whether the numbers can be trusted at all.

The settings below come from Google's own Analytics Help and developer documentation, read on 21 October 2026. Work through them in order: the first section takes about an hour, the rest can wait until launch week.

The checklist

Start with one property and one stream

A property holds the reports; a web data stream is the site sending data into it. Most marketing sites need exactly one of each, including sites in several languages on one domain. Create them following Set up Analytics for a website, choose the reporting time zone and currency carefully (Google notes that changing the time zone later only affects data going forward and can leave a flat spot or spike in reports), and make sure the account belongs to the company, not to the agency or freelancer who builds the site.

Install the Google tag once. The most common duplication we see is a theme or site builder that already injects the tag plus a Google Tag Manager container that fires it again: every page view and event is counted twice, and nothing in the reports looks broken.

Enhanced measurement: keep most of it, switch off form interactions

Enhanced measurement collects events without code. Google documents each one, and on a marketing site we treat them like this:

• Page views are always on; Google says you can't turn off collection. Leave the history-change option on if your site changes pages without full reloads.
• Scrolls fire once per page, when 90% of the page's height becomes visible. Useful on long articles, meaningless on short pages.
• Outbound clicks fire for links leaving your domain, except to domains you list for cross-domain measurement. Keep them.
• Site search fires when the URL carries q, s, search, query or keyword. If your search uses another parameter, add it in the settings; if you have no search, it simply never fires.
• Video engagement only covers embedded YouTube videos.
• File downloads fire for links to common file types such as PDFs and spreadsheets. Keep them if you publish brochures or price lists.
• Form interactions send form_start and form_submit. Google defines form_submit as "when the user submits a form", which is an attempt: the browser can't know whether your server accepted the lead or returned an error. Turn this option off once you send your own lead event, or you'll have two numbers that never match.

Key events: count leads, not page views

A key event is an event you mark as important; GA4 uses key events in acquisition reports, and Google Ads can import them as conversions. Google lets you mark up to 30 events as key events on a standard property. A lead-generation site needs one primary key event and perhaps two or three secondary ones (a booked call, a newsletter sign-up, a pricing-page visit you've decided matters). Thirty key events is a symptom, not a strategy.

These are the ways to count a lead, from most to least reliable:

Google names generate_lead as the recommended event for "when a lead has been generated (for example, through a form)". Send it from the code that handles the response, not from the button's click:

// Runs only after your form endpoint confirms the lead was stored
const response = await fetch('/api/contact', { method: 'POST', body: formData });
if (response.ok) {
  gtag('event', 'generate_lead', {
    form_name: 'contact',      // which form, never the visitor's details
    value: 150,                // optional: what a lead is worth to you
    currency: 'USD'            // required whenever you send value
  });
}

If you can't touch the code, Google's own help shows how to create a new event from the confirmation page's page view and mark that as the key event. It works if the thank-you page can't be reached any other way: no links to it, excluded from your sitemap and search, and no reload loop that counts the same person twice.

Two settings finish the job. Keep the counting method on "Once per event", which Google recommends. And if you send extra parameters such as form_name, register them as custom dimensions, or they won't appear in reports.

Never send the visitor's name, email or phone in an event or URL. Google's policy on personally identifiable information forbids sending anything Google could use to identify a person, and the page URL is the usual leak: a form that redirects to /thanks/?email=... breaks the policy on every lead. GA4's data redaction can strip email addresses and listed query parameters on a best-effort basis; fix the URL anyway.

Consent mode v2: basic or advanced

Consent mode passes your banner's answer to Google's tags. Version 2 added two consent types to the original two, so a complete setup sends four: ad_storage, analytics_storage, ad_user_data and ad_personalization. Google's EU user consent policy requires legally valid consent from visitors in the European Economic Area, the UK and Switzerland, and the consent mode guide tells advertisers to send the two new types for that traffic.

The choice is between two implementations, as Google's setup guide describes them:

The modeling argument for advanced mode rarely applies to a small site. Behavioral modeling needs advanced consent mode, at least 1,000 events a day with analytics storage denied for 7 days, and at least 1,000 daily users who granted consent on 7 of the previous 28 days. A B2B site with a few hundred visitors a day won't qualify, so for it advanced mode mostly means sending pings about people who said no. Pick the mode your privacy policy and your counsel support; this article isn't legal advice.

For advanced mode, the defaults go before the Google tag, and the update runs when the visitor chooses:

gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied'
});
// Visitor accepts analytics but not advertising
gtag('consent', 'update', { analytics_storage: 'granted' });

Data retention: switch to 14 months on day one

A standard property keeps user-level and event-level data for 2 or 14 months; 26, 38 and 50 months are for Analytics 360 only. The setting doesn't touch standard aggregated reports, but it limits explorations and funnel reports, which are where you answer questions like "how many leads came from organic search last spring". At 2 months, year-on-year comparisons in explorations are impossible.

Change it to 14 months the day you create the property. Age, gender and interest data stay at 2 months whatever you choose. If you need raw history beyond 14 months, the BigQuery export is free to start in the BigQuery sandbox and capped at 1 million events a day on standard properties, far above what a marketing site sends.

Filter your own traffic, and test the filter first

Internal traffic rules tag events from IP addresses you list with traffic_type=internal; a data filter then excludes them. Two warnings from Google's documentation matter more than the steps:

1. An active filter is permanent. Excluded data is never processed and never reaches GA4 or BigQuery, and filters don't apply to data collected before they existed.
2. Filters have three states: Testing, Active and Inactive. Leave a new filter in Testing, check the "Test data filter name" dimension in an exploration, and activate it only once it matches what you expect. Google says a filter can take 24 to 36 hours to apply.

You can create up to 10 data filters per property. Add the developer traffic filter too, so test hits sent in debug mode stay out of reports. IP rules don't help a remote team on home connections; for them, the practical fix is to do testing in debug mode and accept a little noise.

Unwanted referrals and cross-domain measurement

When a visitor leaves for another domain and comes back, GA4 may credit the session to that domain. Unwanted referrals fix this for tools in the middle of your funnel: payment processors, booking or scheduling pages, and login or password-reset flows. You can list up to 50 per data stream.

Cross-domain measurement is the stronger fix when you own both sides, for example a marketing site on one domain and an app or shop on another. GA4 passes its IDs in a _gl URL parameter when visitors click between the domains you list (up to 100 conditions), so one person stays one user and one session.

UTM conventions that keep channels clean

GA4 sorts traffic into channels with fixed rules, and the default channel group definitions can't be edited. Your UTM tags decide which channel a click lands in, so write them for those rules:

Some details from Google's rules: a medium of email lands in Email, and social in Organic Social; Paid Social needs a social source plus a medium matching cp, ppc, retargeting or anything starting with paid. Values are case-sensitive, so LinkedIn and linkedin become two rows; Google's UTM best practices recommend lowercase. Build links with Google's Campaign URL Builder and keep the agreed values in one shared sheet.

Don't tag internal links on your own site, and don't add UTMs to Google Ads when auto-tagging is on. The channel list also includes an AI Assistant channel, which GA4 assigns when the referrer matches its list of AI assistants or the medium is ai-assistant. If you're working on being cited by ChatGPT or Perplexity, that's where the visits show up, and our AI visibility checker shows whether those assistants' crawlers can read your site.

Link Search Console and Google Ads

Linking Search Console adds two reports: organic queries and organic landing pages. One web stream links to one Search Console property, the data arrives about 48 hours late and covers at most 16 months, and the report collection is unpublished by default: find it under Library and publish it, or you won't see it in the navigation.

Linking Google Ads needs Editor access in GA4 and admin access in Google Ads. Keep auto-tagging on, then import your lead key event into Google Ads as a conversion so bidding optimizes for the leads GA4 counts, not for clicks.

Data sharing, signals and reporting identity

Three account-level settings deserve a deliberate choice:

• Data sharing. When "Google products & services" is on, Google says it is an independent controller of the shared data under its controller terms. For a company that wants Google to act only as its processor, as Google's list of processor services describes Analytics, turn it off unless you have a reason.
• Google signals enriches reports with demographic and interest data from signed-in Google users who turned on Ads Personalization. A lead-generation site rarely needs it; turn it on only if you'll use those reports or audiences.
• Reporting identity. Google notes that the Blended and Observed options can make reports subject to data thresholds, which hide small numbers; Device-based uses only the device ID. On a low-traffic site, Device-based shows more of your data, and Google says you can switch between options at any time without a permanent effect.

Verify in DebugView before you trust a number

DebugView shows the events from a device in debug mode as they arrive. Turn debug mode on with Google Tag Assistant's preview mode, then:

1. Load the home page once and check there's one page_view, not two.
2. Accept and decline the consent banner in separate sessions, and check the consent state on the events.
3. Submit a real test lead. Check that generate_lead arrives once, with form_name, and that no form_submit key event fires beside it.
4. Submit the form with an error and check that no lead event fires.
5. Click a link to your booking or payment domain and back, and check that the session's source doesn't change.

Then delete the test lead from your CRM, and write down what you tested and when. The next person who changes the form will need it.

The mistakes we see most often

If you're about to redesign or replatform, add analytics to the launch list: tags and key events are among the things a site migration quietly breaks.

When GA4 isn't the right tool

GA4 earns its place when your growth runs through Google: Search Console and Google Ads link to it at no cost. It's a weaker fit when you need to see what logged-in users do inside a product, when your consent policy makes most visitors invisible anyway, or when you'd rather keep visitor data out of an advertising company. Our comparison of PostHog vs Google Analytics covers when a privacy-first or product analytics tool fits better, and when to run both without counting a lead twice.

What to do next

Work through the checklist table above in one sitting, then run the five DebugView tests before you report a single number to anyone. If you'd like Dardo to set it up or audit an existing property, that's our analytics setup service; once the numbers are trustworthy, conversion rate optimization is the work of improving them.