In short
- Data retention is set to two months. Move it to fourteen. The change is not retroactive: what has been deleted never comes back.
- The internal traffic filter exists, but it is inactive. Creating the rule is not enough, the filter has to be switched on. Otherwise your own team counts as visitors.
- The referral exclusion list is empty. Without your payment domains, the return from a banking page opens a session and steals the attribution of the sale.
- The gap with Google Ads is not a bug. The two tools count neither the same unit nor on the same date. The only useful question is whether that gap is stable.
On 1 July 2023, Universal Analytics stopped collecting. Tens of thousands of companies had switched to GA4 in the preceding weeks, often through the automatic migration assistant. Property created, code installed, box ticked, and nobody went back.
That is what almost every audit we run shows: GA4 collects, displays green curves, and six settings are still on their factory values. None of them raises an alert, they degrade the data in silence, like broken tracking that never warns you. The good news: all of it is fixed in the interface, without touching the site’s code.
The factory settings nobody changes
Data retention, stuck at two months
Standard aggregated reports stay available with no time limit. Event-level and user-level data, the kind that feeds explorations and custom segments, is deleted at the end of the retention period: two months by default.
Open an exploration in October to compare your traffic with March: nothing appears, the underlying data no longer exists. Moving to fourteen months takes two clicks, but has no retroactive effect: you stop the bleeding without recovering the purged months. Hence the urgency.
Internal traffic filtering, created but never activated
GA4 lets you declare an IP range as internal traffic, then apply a filter that excludes it from reports. The trap has two parts: the rule and the filter are two separate objects, and the filter is born in a testing state that removes nothing from reports. Many properties have the rule, very few have the filter active.
On a site with a few thousand sessions a month, ten colleagues visiting it daily weigh heavily: abnormally high engagement, journeys that look like no customer’s.
The referral exclusion list, and the hole in attribution
By default, GA4 excludes one single domain from referrals: yours. A visitor arrives from a Google Ads campaign, fills their basket, leaves for their bank’s authentication screen, then comes back to your confirmation page. That return is seen as a visit from another site: GA4 opens a new session whose source is that intermediate domain, and the sale is recorded there.
The mistake to avoid Leaving this list empty on a site that takes payments. Sales going through a banking redirect are attributed to the payment provider, never to the channel that brought the customer: your campaigns look unprofitable and you cut budgets that were working. Add the domains of your payment methods, your 3-D Secure pages and your external sign-ins.
The control table for your property
What we open first, in this order.
| Setting | Default | Recommended | What the error costs |
|---|---|---|---|
| Data retention | 2 months | 14 months | No year-on-year comparison in explorations |
| Internal traffic filter | Absent or in testing mode | IP rule, filter switched on | Sessions and engagement inflated by your own teams |
| Referral exclusion | Your domain only | Payment, 3-D Secure, external sign-in | Sales attributed to the payment provider |
| Session timeout | 30 minutes | 30 minutes in almost every case | A shorter delay cuts one visit in two and duplicates acquisition sources |
| Google Signals | Often switched on by the migration | Judge by whether you actually use demographics | Thresholding: rows disappear from reports |
| Key events | Inherited from the migration | 3 to 5 actions with real value | Diluted signal passed to automated bidding |
| BigQuery export | Not configured | Configured from day one | No raw history recoverable after the fact |
Key events: three good ones beat fifteen
GA4 now calls key events what it used to call conversions. The most frequent mistake is marking a generic page view: a thank-you page reachable by simply reloading produces a counter that climbs on its own, since GA4 counts the event on every occurrence, not once per session.
The real cost is downstream. If those events feed into Google Ads as bidding objectives, the algorithm optimises on a noisy signal and buys traffic that triggers actions with no value. Keep three to five actions with identifiable economic value, with a value parameter where they have one. That belongs in the tagging plan.
Users, sessions, engaged sessions: why nothing matches
Three counters measure three different things. A session groups the events of one visit and closes after thirty minutes without activity. An engaged session lasted more than ten seconds, or saw two pages, or fired a key event. An active user is an identifier that produced at least one engaged session. An engagement rate is therefore calculated on sessions, revenue per customer on people.
Why does GA4 report forty conversions when Google Ads claims sixty? The two tools diverge on three points.
- The attribution date. Google Ads attaches the conversion to the date of the click that preceded it, GA4 to the day it happened. On a long buying cycle, the curves are offset.
- The scope. Google Ads also counts conversions that occurred after a mere ad impression. GA4 does not see them: no interaction, no session.
- The unit of account. Google Ads reasons per ad click and follows the user across devices. GA4 reasons per session and attributes the sale to that session’s source.
These gaps are normal, but they must not move. A report that deforms sharply signals a breakage, and only reconciliation against your real orders settles it.
Thresholding and sampling: when GA4 hides rows from you
Thresholding is about confidentiality. When Google Signals is active and a report crosses demographic or interest data on low volume, GA4 masks the rows that would allow a person to be identified: the report stays on screen, but truncated. The remedies are to widen the date range, remove the demographic dimension, or switch off Google Signals if you do not use that data.
Sampling is about volume. Standard reports are never subject to it. Explorations are, beyond a quota per query, in the order of ten million events on a free property: GA4 calculates on an extract and says so discreetly at the top of the report. Shorten the period or filter upstream.
What GA4 will never do for you GA4 does not keep your raw data and does not cross-reference with your back office or your CRM. Real margin per channel, the twelve-month value of a customer acquired in January, cohorts by product: those answers require a database where the event is stored row by row. That is the role of the GA4 export to BigQuery, to be switched on before you need it: it exports nothing from the past.
Consent Mode: what GA4 actually receives
Since March 2024, European advertisers using Google’s audience and measurement features must transmit the consent state through Consent Mode v2. What GA4 then receives depends on how your banner is wired.
- In basic mode, no tag fires before the click on the banner. GA4 receives nothing from visitors who refuse, nor from those who leave the site without answering.
- In advanced mode, tags load and send signals with no cookie and no identifier as long as analytics consent is refused. GA4 knows a visit happened, without being able to tie it to a user.
Those cookieless signals feed behavioural modelling, through which Google estimates the missing share from consenting visitors. It only switches on above a minimum daily volume sustained over several days, which many SMEs never reach: their site in advanced mode sees the same figures as in basic mode, without knowing it.
Comparing a curve from before and after a banner change therefore makes no sense: it is not the traffic that moved, it is the observation window. The acceptance rate becomes a metric to follow, which brings us back to how the consent request is written.
What you can fix this week
- Move data retention to fourteen months. Every day you wait costs a day of history.
- Check that your internal traffic filter is active, not merely defined, on the IPs of your offices and providers.
- List the domains a purchase passes through, payment and banking authentication included, and exclude them from referrals.
- Count your key events. Beyond five, ask what decision each one allows you to take.
- Switch on the BigQuery export, even with no analysis project. It only exports the future.
- Compare seven days of real orders against the purchases seen in GA4.
The first five are handled in the property’s admin, with no developer. The sixth takes an hour, and it is the one that reveals the most.
Frequently asked questions
Why does GA4 show fewer conversions than Google Ads?
Google Ads attaches the conversion to the click date and also counts those that happened after a mere ad impression. GA4 attaches it to the day it occurred, and records only what produced a session. The gap is structural: watch its stability, not its value.
Do we really need to move retention from 2 to 14 months?
Yes, on any property used for decisions. The setting does not affect standard reports, but it governs explorations, and therefore any year-on-year comparison. It does not restore data already deleted: act early.
Does Consent Mode skew my GA4 statistics?
It does not skew them, it narrows their scope. Visitors who refuse analytics cookies are no longer identified individually, and depending on your configuration they are not measured at all. Behavioural modelling only compensates above a daily volume many sites never reach.
How do I know if my GA4 reports are sampled?
Standard reports never are. In explorations, GA4 states at the top of the report that the calculation covers an extract. Shortening the period or filtering upstream is usually enough.
A well-configured GA4 still does not guarantee correct figures
Fixing these settings makes a whole family of unexplained gaps disappear, for the best ratio of time invested to reliability gained. Your reports will finally measure what you think they measure.
That leaves the other half of the subject, between the visitor’s browser and the property: blockers, browser restrictions, the same purchase sent twice. A clean configuration does not protect you from faulty collection, which is separate work covered in our data, analytics and performance expertise.
That double send of the same purchase deserves another word, because it is very widespread and triggers no alert: GA4 does not deduplicate, it adds up. We tell a real case, with figures, in your tracking may be lying to you in silence, along with the five checks that catch it.
Unsure about your GA4 property’s configuration? On a first engagement we open your admin, check the seven points in the table above, then set your declared conversions against your real orders over thirty days. Let’s talk.