Free GA4 audit tool:check tags and consent on any website
Waftr's free GA4 audit tool, the Tracking Scan, opens your page the way a first-time visitor does and records what fires before anyone touches the cookie banner: GA4, Google Tag Manager, Consent Mode v2 defaults, Google Ads and the Meta Pixel. Nobody logs in to your accounts; the report arrives by email.
Nothing to install. The scan reads public requests from one page load and needs no GA4, Tag Manager or Google Ads login.
Tracking Scan report, line by line
Anatomy of a Tracking Scan report: what the GA4 audit tool checks
The report has eight lines, one per check, each marked pass or flag for a first-time visitor who has not clicked Accept or Reject. Pick a line to see what the scan looks for, how a pass and a flag read, and a related result from Waftr's client work.
What loads
Consent, before any choice
Collection path
01
Line 1 of 8 · What loads
GA4 tag
What the scan looks forWhether a GA4 tag loads for a first-time visitor, either as gtag.js in the page code or as a GA4 tag inside Google Tag Manager.
How the line reads in the report Wording illustrative
PassGA4 tag found on the page.
FlagNo GA4 tag loaded during the visit.
What a flag usually means
The tag was dropped in a template or CMS change, or it waits for Accept under basic Consent Mode. Read this line next to line 06: a scan that never clicks Accept cannot tell those two apart.
What it costs the business
A page without GA4 drops out of reporting and out of the GA4 audiences Google Ads uses. A pass is the best case, too: the scan runs no ad blocker, and many real visitors do.
28-41%of CRM form leads arrived with no GA4 client ID
Measured across Waftr client audits
The client ID was passed into the CRM as a hidden field on every form submit, and the delivery pipeline was checked clean. A missing ID meant the browser never wrote one. Ad blockers accounted for roughly 25-30% of CRM form records, and Reject All for up to roughly 40%, with overlap between the two.
What the scan looks forWhich Google Tag Manager containers load on the page, and how many of them.
How the line reads in the report Wording illustrative
PassOne Google Tag Manager container loads.
FlagNo container found, or two or more containers on the same page.
What a flag usually means
A second container is often a leftover from a past agency, a CMS plugin or a landing page builder. Two containers tend to carry the same GA4 or Google Ads tag, and nobody owns the changes in the second one.
What it costs the business
Duplicate tags double page views and send repeat conversions to Google Ads, which then bids on inflated numbers. The scan sees that a container loads; which events it is missing is a question for a GTM audit.
+23%conversions on the page that changed, 50 days before vs 50 days after
Dubai real estate · Tracking Audit, then a CRO audit
The CRM held the leads but could not show the visitors who gave up. Form initiate and submit events built in Google Tag Manager, read alongside Microsoft Clarity, showed the long form running past the fold on phones. A shorter, progressive form followed.
What the scan looks forWhether a Google Ads tag, for conversions or remarketing, loads on the page for a first-time visitor.
How the line reads in the report Wording illustrative
PassGoogle Ads tag found on the page.
FlagNo Google Ads tag found. This only matters if you buy Google Ads clicks.
What a flag usually means
Conversions are either imported from GA4 or not recorded. When the tag does load, the next questions sit inside Google Ads: which conversion actions it feeds, and whether enhanced conversions are on.
What it costs the business
Smart Bidding learns from the conversions it receives. Missing conversions shrink remarketing audiences and push bids toward clicks that never turn into leads.
+20%remarketing conversions in Google Ads, counted on the rebuilt audiences
SaaS company · Tracking Audit, then Build
A broken first event and form submits that never fired kept converters out of the right audiences. The audit found both in 7 business days; the Build reworked Tag Manager, rebuilt Consent Mode v2, cleaned GA4 settings and fixed form tracking.
What the scan looks forWhether the Meta Pixel loads on the page, and whether its PageView goes out before the visitor has chosen anything in the banner.
How the line reads in the report Wording illustrative
PassMeta Pixel absent, or present and silent until Accept.
FlagMeta Pixel PageView sent before the visitor chose.
What a flag usually means
The Pixel was added through a platform plugin or a GTM tag triggered on page load, with no consent condition attached. It runs whatever the banner says.
What it costs the business
Under GDPR and India's DPDP Act, a PageView sent before Accept is personal data processed without consent, and it repeats on each page load where anyone can see it in a browser's network panel.
Page load → Acceptwhen the Meta Pixel fires, before and after the Build, verified by test
NexTranslate · Tracking Build
The Meta Pixel was one of the tags firing before visitors chose, next to GA4 and Google Ads. After the Build with Cookiebot and Consent Mode v2, it waits for Accept with the other marketing tags.
What the scan looks forWhether a consent banner appears for a first-time visitor before they do anything on the page.
How the line reads in the report Wording illustrative
PassConsent banner shown on first load.
FlagNo consent banner shown to a first-time visitor.
What a flag usually means
No consent platform is installed, or it is set to show only in some regions or on some templates. A banner that does show proves little by itself: lines 06 and 07 test whether the tags obey it.
What it costs the business
Tags that set cookies without a choice are the exposure GDPR, UK GDPR and the DPDP Act address. For EEA and UK traffic, Google also requires consent signals for ad personalization and remarketing.
OneTrustconsent setup left exactly as it was
Enterprise SaaS · Audit, Build and Care
When server-side tagging and Google Tag Gateway went in, the client's OneTrust banner stayed untouched. Where the tags load from changed; what visitors had agreed to did not.
What the scan looks forWhether Consent Mode v2 defaults are in place before Google tags load, and whether they start at denied for a visitor who has not chosen.
How the line reads in the report Wording illustrative
PassConsent Mode v2 defaults set to denied before Google tags load.
FlagNo Consent Mode v2 default found, or defaults that start at granted.
What a flag usually means
Without a default, Google tags have no instruction until the banner answers, and many fire in that gap. The default command has to cover all four v2 signals, ad_storage, analytics_storage, ad_user_data and ad_personalization, and run before any Google tag.
What it costs the business
Advanced Consent Mode v2 is what makes GA4 behavioral modeling and Google Ads conversion modeling eligible for visitors who decline. Missing defaults leave those conversions unmodeled.
-20%cost per lead once the server-side setup was live
US retail · Tracking Build
Consent Mode v2 went in alongside server-side tracking and server-set cookies, after Safari ITP had cut cookie life to 7 days, and to 24 hours for paid search visits. With it, GA4 and Google Ads model the conversions they cannot observe directly.
What the scan looks forEach request the page sends to GA4, Google Ads, Meta and other marketing platforms before the visitor clicks anything in the banner.
How the line reads in the report Wording illustrative
PassMarketing tags wait for a choice.
FlagOne or more tags fired before the visitor chose.
What a flag usually means
The tags trigger on page load in Google Tag Manager, or sit hardcoded in the page, with consent bolted on after they went live. That retrofit is the most common failure Waftr finds, which is why we set up consent before rebuilding Tag Manager.
What it costs the business
Each early page view sends visitor data to Google or Meta without a choice: the core exposure under GDPR, UK GDPR and the DPDP Act, and a CCPA question where data is shared with ad platforms.
100%of tags held until Accept, confirmed by test
NexTranslate · Tracking Build
Before the Build, GA4, Google Ads and the Meta Pixel all fired before the visitor chose. GA4, Google Tag Manager, Cookiebot and Consent Mode v2 were set to the strictest of GDPR, CCPA and the DPDP Act, and a test confirmed nothing fires before Accept.
What the scan looks forWhether tags load from your own domain, through server-side tagging or Google Tag Gateway, or straight from Google and Meta domains in the browser.
How the line reads in the report Wording illustrative
PassFirst-party tagging found: server-side or Google Tag Gateway.
FlagEvery tag loads from a third-party domain.
What a flag usually means
Third-party tag requests are the ones ad blockers and privacy browsers stop first. Safari ITP also caps cookies set by browser scripts at 7 days, and at 24 hours after a paid click.
What it costs the business
Visits that never reach GA4 become CRM leads with no source, counted as direct. Paid search and organic then look weaker than they are, and budget follows the wrong channel.
53% → 38%of CRM leads counted as direct, 2 months before vs 2 months after the setup
Enterprise SaaS · Audit, Build and Care
Ad blockers and privacy browsers were stopping GA4 for part of the audience. Server-side tagging with Google Tag Gateway, plus UTM and referrer fallbacks, moved most of those leads back to paid search and organic.
Every line describes one visit in the no-choice state. The scan does not re-test after Accept or Reject, and the case results above come from paid Audits and Builds, not from the scan.
What a GA4 audit tool can check from a browser, and what stays out of reach
The scan's browser arrives without cookies, without an ad blocker and without a login, then waits. That makes it a faithful record of what your page sends to a stranger, and blind to three kinds of fault.
GA4 property settings, key events, data retention, Google Ads conversion actions, enhanced conversions and the BigQuery export. Reading them takes read-only access, which is what the Google Analytics audit starts with.
After a click
The consent update after Accept or Reject, plus events that need a person to act: form submits, generate_lead, add_to_cart and checkout steps. Google Tag Assistant shows them if you click through the page yourself.
Beyond one visit
Visitors running ad blockers, Safari users returning after ITP has expired a cookie, and leads whose GA4 client ID never reaches the CRM. That last gap ran to 28-41% of CRM form leads across Waftr client audits.
Free scan or paid Tracking Audit: which do you need?
The scan answers what a browser sees on one page. The Tracking Audit, a full Google Analytics audit plus a GTM audit of your containers, reads GA4, Tag Manager, consent and Google Ads from the inside and explains why their numbers disagree.
Read-only access to GA4, Tag Manager, consent and Google Ads
What it reads
One page, loaded as a first-time visitor
Account settings, containers and conversion data
Checks
8 public checks
60+ checks from tag to BigQuery
Tags before consent
Yes
Yes
GA4 settings and key events
No
Yes
Google Ads conversion settings
No
Yes
BigQuery export
No
Yes
What you receive
A report by email
Findings Sheet, Slides walkthrough, ranked fix plan and a walkthrough call
Time
One page load, then the report
7 business days
Cost
Free
Fixed quote agreed in writing; credited against a Build started within 30 days
Move from the scan to the audit when the report comes back clean and GA4 still disagrees with the CRM, or when you run several sites, GA4 properties or containers that one page cannot represent.
Scan the page where your leads convert
Pick the page that matters most to revenue, usually the one with the form or the checkout. Here is what happens after you press the button.
1
Enter one URL and a work email
The page you choose is the page that gets tested, and the report goes to that address.
2
A clean browser opens the page
It arrives with an empty cookie jar and never touches the banner, like a first-time visitor who has not decided.
3
Requests are logged against the 8 checks
Calls to GA4, Google Tag Manager, Google Ads and Meta, plus the consent signals that travel with them.
4
The report lands in your inbox
Each line marked pass or flag. If you want the flags walked through, a 30-minute call is free.
Yes. The Tracking Scan is free and asks for two things: a URL and a work email for the report. Waftr runs it because a public check is the quickest way to show whether GA4, Tag Manager and consent need a closer look, and the report says which issues your developers can fix without help.
Does the scan need access to my GA4 or Tag Manager?
No. It reads only what a browser receives when it loads your page: which tags load, which containers serve them, and what the banner and Consent Mode v2 defaults do before a choice. Settings inside GA4, Tag Manager and Google Ads need read-only access, which the paid Tracking Audit asks for.
What can the scan not see?
Anything behind a login or after a click. That covers GA4 property settings, key events, data retention, Google Ads conversion actions, the BigQuery export, the match between GA4 and your CRM, and the consent update after Accept or Reject. A Google Analytics audit reads the account side over 7 business days.
Can the scan check whether Consent Mode v2 is working?
Half of it. The scan checks the default state: whether Consent Mode v2 defaults start at denied before Google tags load, and which tags fire before a visitor chooses. There is no re-test after Accept or Reject. For that half of how to check Consent Mode, click through both choices in Google Tag Assistant.
Does the scan check consent for GDPR, CCPA and DPDP?
It checks the technical side for one visit: whether a banner shows, whether Consent Mode v2 defaults start at denied, and which tags send data before a choice. Those are the behaviours GDPR, UK GDPR, CCPA and India's DPDP Act care about. The report describes your tags; it is not legal advice.
Which page should I scan?
Start with the homepage or the landing page your ads send traffic to, since most first-time visitors meet the banner there and the tags load first. If checkout or a lead form sits on another domain, scan that page as well: cross-domain tags only show up on the page that loads them.
Can an agency scan a client or prospect site?
Yes. Agencies run it before a pitch or a handover to show what a client's tracking sends, without asking anyone for account access. If the report leads to an audit or a rebuild, Waftr can deliver the GA4, Tag Manager and consent work under the agency's brand through the agency partner program.
What should I do if the scan finds problems?
Fix the small ones with your developers, using the report. If GA4, Google Ads and the CRM still disagree afterwards, book the Tracking Audit: it reads the account side, finds the cause behind each flag and ranks the fixes. A Build started within 30 days gets the audit fee credited against it.
