GA4 Audit Checklist for Shopify Brands: 14 Checks

Record the number from step zero with the date range, the Shopify filter you used and the time zone. Every fix below is judged against it: re-run the same comparison two weeks after each change. If you report to clients or a board, put the gap in your agency report template so it stays visible.

GA4 → Admin → Data streams → Web → copy the Measurement ID (G-…). Then find every place that sends to it: the Google & YouTube channel, any custom pixel under Shopify Settings → Customer events, theme.liquid (legacy Universal Analytics or gtag snippets), GTM containers, and apps with their own GA4 integration (Elevar, Stape). Two senders on the same ID double-count; a sender on an old ID loses events. Running both GTM and gtag.js, or two GTM containers, is the double-counting cause named in Krish TechnoLabs' audit guide.

GA4 → Admin → Data collection and modification → Data retention: standard properties offer 2 or 14 months, and the setting applies to explorations and funnel reports, not to standard reports (Google). Set 14 months so year-over-year explorations work. Then define internal traffic and activate the filter. Under Data streams → Web → Configure tag settings → Show all → List unwanted referrals, add third-party payment processors your checkout hands off to — Google gives exactly this case as the example (Google). Otherwise the purchase session is credited to the processor.

Data streams → Web → Enhanced measurement. The options are page views, scrolls, outbound clicks, site search, video engagement, file downloads and form interactions; scroll fires once per page "when a 90% vertical depth becomes visible" (Google). Confirm the ones you rely on are on, and that site search uses your store's query parameter (q on Shopify search).

Admin → Events: purchase must be marked as a key event (GA4's name for what it used to call conversions) (Google). Then in Google Ads → Goals → Conversions, check which purchase actions are Primary. During a tracking migration on one DTC account in Level, two purchase actions ran together for about two weeks, and Google Ads counted those orders twice. One Primary purchase action per account; the rest Secondary or removed.

For web streams, "Google Analytics deduplicates purchase events with the same transaction ID" (Google). So every purchase must carry the Shopify order ID as transaction_id, in the same format from every sender. If the browser and a server container send the same order with different IDs (a suffix is enough), GA4 counts both (Analytico). For Stape, Elevar or a GTM server container, check its request logs, not only the workspace: a server container that is configured but receives no traffic looks fine in GTM.

Needed when a headless storefront, a separate landing-page domain or a booking tool sits between the visit and Shopify checkout. Admin → Data streams → Web → Configure tag settings → Configure your domains (Google). Without it, the session splits at the handoff and the purchase is credited to referral or direct. A standard Shopify store with checkout on its own domain doesn't need it.

GA4's client_id lives in the first-party _ga cookie. Safari's tracking prevention deletes cookies created in JavaScript after seven days of Safari use without a visit, and also caps cookies set by a server that turns out to be a cloaked third party (CNAME or IP address) at seven days (WebKit). A returning Safari visitor after that window looks new, and the purchase loses its original source. In Safari → Develop → Web Inspector → Storage → Cookies, check the _ga expiry: about seven days means the cap applies. A server-side tagging endpoint on your own subdomain and IP range avoids it; a CNAME to a vendor's IP does not.

If the store shows a consent banner, check what GA4 does after a decline. With consent mode, tags send cookieless pings instead of storing cookies, and GA4 uses them for behavioral and conversion modeling; if tags are simply blocked until consent, there is no modeled data for those visitors (Google). Declined visitors widen the reconciliation gap either way; know which setup you have before you treat that part of the gap as a bug.

Klaviyo → account name → Settings → Other → UTM tracking. The "Automatically add UTM parameters to links" toggle covers new campaigns and flow messages only; it "does not turn tracking on for existing messages that have it disabled" (Klaviyo). Open your highest-revenue flows and check that their links carry UTMs. Untagged email clicks land in GA4 as direct, so email looks smaller in GA4 than in Klaviyo.

GA4 isn't part of this match, but the same purchase drives Meta's bidding. Meta treats a browser and a server event as identical when the pixel's eventID equals the Conversions API event_id and the event names match (Meta). In Events Manager, open the Purchase event and check that both sources arrive and are deduplicated. When you export Meta data, count one purchase event name: in the Level account above, Meta returned the same purchase under five names (purchase, omni_purchase, offsite_conversion.fb_pixel_purchase, onsite_web_purchase, onsite_web_app_purchase), and summing them gave ROAS of 12.63× for a quarter whose real figure was 2.53×. The ROAS formula guide shows the full case; the Meta-side setup is in our Meta CAPI for Shopify article.

Shopify sunset checkout.liquid and additional scripts on the Thank you and Order status pages on August 28, 2025; script tags on those pages stopped for Plus stores the same day and for non-Plus stores on August 26, 2026 (Shopify, checked Oct 2026). Any purchase tracking that lived in additional scripts or a script tag on those pages no longer runs. Purchase tracking now has to come from the Google & YouTube channel, an app pixel, a custom pixel under Customer events, or a server-side integration. Place a test order and confirm one purchase reaches GA4 DebugView with the order ID.

If you sell through ReCharge, Skio, Bold or Shopify subscriptions, renewals are created without the customer in a checkout, so no browser tag fires for them. They reach GA4 only if an integration sends them server-side, for example through the Measurement Protocol, which Google describes as "intended to supplement, not replace, automatic data collection methods" (Google). Count renewal orders in Shopify for the month and compare with what GA4 received; decide whether renewals belong in GA4 revenue at all, and keep the same rule in the reconciliation.

Every paid campaign, email and SMS link, organic social link and affiliate or influencer link should carry utm_source, utm_medium and utm_campaign, with a distinct source per partner. GA4's channel grouping is built from these values; missing UTMs inflate direct.