Ecommerce tracking audit: what it should include, and DIY vs paid

If you're spending money on ads and making decisions from GA4, your tracking is part of your infrastructure. When it breaks, nothing errors and nothing goes down. The numbers just quietly drift away from reality. A tracking audit is how you find out whether you can trust them, and whether your cookie banner actually does what it claims.

This guide explains what a good audit should include, so you can run one yourself or judge what you're paying for.

When you need an audit

• GA4 revenue or purchases don't line up with your Shopify or WooCommerce orders
• Google Ads warns about missing consent signals or conversion problems
• You've changed theme, consent app, checkout or tracking setup recently
• Nobody is sure what's installed, or who installed it
• You've never checked what loads before a visitor accepts cookies
• You're about to scale ad spend and want to trust the numbers first

What a good audit covers

1. Consent behaviour: the three states

The audit should test what your site does in each consent state, in a clean browser, on more than just the homepage:

• Before any choice: which trackers send data and which cookies are set
• After "Reject all": does everything non-essential stay off, including add-to-basket events?
• After "Accept all": does tracking you're entitled to actually work?

It should also cover banner design (is rejecting as easy as accepting?) and whether returning visitors' choices are applied. Our 10-minute consent audit is a cut-down version of this part.

2. Google Consent Mode v2

Are all four signals present? Is the default set before any Google tag fires? Does the update arrive on choice and on return visits? Do the GA4 and Google Ads tags behave correctly in each state? See our Consent Mode v2 explainer for background.

3. Tag inventory and duplicates

A list of every tracking tool on the site and how it's installed: platform app, custom pixel, GTM, theme code or plugin. Duplicates should be flagged, because they're the most common cause of inflated revenue. So should non-Google pixels that ignore consent.

4. Purchase tracking

A test purchase to confirm exactly one purchase event fires, with transaction ID, value and currency. It should also check that refreshing the thank-you page doesn't send a second one, and that checkout tracking uses the right mechanism for your platform (for example, Shopify's app or custom pixels rather than old checkout scripts).

5. Data reconciliation

The part most audits skip. Compare GA4 purchases and revenue with store orders over a meaningful period (30 days is a good start), day by day, and ideally match individual transaction IDs. This shows whether the gap is steady and explainable (consent, ad blockers) or a sign of breakage (sudden drops, GA4 above orders, revenue far apart). Our guide to why GA4 doesn't match Shopify explains the patterns.

6. Ad platform check

Do Google Ads and Meta conversion counts make sense against GA4 and orders? Watch for conversions counted twice, for example Ads importing from GA4 and running its own tag, or Meta Pixel plus Conversions API without de-duplication.

7. Documentation

Does the cookie policy list the cookies actually found? Does the privacy policy name the third parties receiving data?

What you should receive

• Findings with evidence: what was tested, how and when, with what was observed (not just "fail")
• A prioritised fix list: ordered by risk and effort, with specific steps for your theme, apps, GTM or plugins
• The reconciliation: the numbers and the likely causes of any gap
• A plain-English explanation your team or developer can act on
• A record of what passed, useful if anyone asks later what you checked

Be wary of audits that only produce an automated scan report, promise "100% compliance", or end with a pitch for an expensive ongoing retainer before you've seen the findings.

DIY vs paid: how to decide

	Do it yourself	Pay for an audit
Best if	You're comfortable with DevTools, GTM and your store admin, and have a few hours	You want an independent check, evidence and a fix list quickly
Cost	Your time (plus any toolkit you buy)	A fixed fee is easiest to budget
Risk	Easy to miss things in setups you built yourself	Choose someone who tests real behaviour, not just a scan

Our options

• Free: the cookie-consent and tracking checklist, or a free homepage pre-consent scan from us.
• Done for you: the TrackCheck Health Check covers the consent test, GA4 reconciliation, a prioritised fix list and a recorded walkthrough at a fixed price, delivered in 5 working days.

How often?

Run a full audit once, then a light check after every new app, plugin, theme change or tag, plus a monthly GA4-vs-orders comparison. Tracking rarely breaks on its own; it breaks when something else changes.

Quick answers

Do you need access to my store for an audit?

The consent tests only need your public site. A reconciliation needs read-only GA4 access (or an export) and an orders export. Nobody auditing tracking should need your passwords.

How long does it take?

A DIY consent check takes under an hour; adding a 30-day reconciliation takes another hour or two once you have the exports. A done-for-you audit is usually quoted in working days, because of the reconciliation and write-up.

Will an audit make me compliant?

An audit tells you what your site actually does and how to fix it. It's a technical review, not legal advice, and compliance depends on decisions only you (and your adviser) can make.

This article is technical guidance, not legal advice. Platform menus change; check the vendor's current documentation if a setting has moved.