What a Tracking Audit Found: Anonymized Horror Stories and Lessons

What's Really Living Inside Your Analytics

In the past few years, we've audited hundreds of websites' tracking setups. The patterns are remarkably consistent. The same mistakes appear on enterprise sites and startup landing pages alike.

This post shares the most instructive findings from real client audits -- fully anonymized. Not to embarrass anyone, but because seeing what goes wrong helps you understand what to look for in your own setup.

Case Study 1: The eCommerce Brand That Thought It Was Unprofitable

The client: A mid-sized direct-to-consumer brand spending ,000/month on Google Ads.

What we found: The purchase conversion action in Google Ads was configured to fire on the order confirmation page URL. However, the developer had changed the thank-you page URL six months earlier during a site redesign. The new URL no longer matched the trigger pattern.

For six months, zero purchases had been recorded in Google Ads. Smart Bidding had no conversion signal and defaulted to maximizing clicks. The marketing team, seeing terrible ROAS numbers, had been incrementally cutting budgets and reducing bids -- making performance worse in a doom loop.

The fix: Updated the conversion trigger to match the new URL pattern. Within two weeks, Smart Bidding had enough conversion data to optimize. ROAS improved by 180% over the following month without any change to budget or creative.

The lesson: Every site deployment should include a conversion tracking verification step. A 10-minute check after every deploy can prevent months of bad decisions.

Case Study 2: The Lead Gen Site Counting the Same Lead 12 Times

The client: A B2B software company with a free trial conversion.

What we found: The free trial sign-up conversion was configured as a GA4 event that fired whenever the /thank-you page was visited. No deduplication. No session-scoped limit. Users who bookmarked the thank-you page and revisited it were counted as new conversions on each visit. One particularly enthusiastic early employee had visited the thank-you page 12 times in a week while testing the product -- generating 12 phantom conversions from a single account.

The fix: Implemented a unique transaction ID parameter on the form submission event and configured the conversion to fire only once per unique transaction. Moved the trigger from the thank-you page URL to a form submission GTM event with de-duplication logic.

The lesson: Thank-you page URL triggers are the most common cause of inflated conversion counts. Event-based triggers with transaction IDs are more robust.

Case Study 3: The Retail Brand Attributing All Revenue to Direct

The client: A specialty retailer with an online store and a separate checkout subdomain.

What we found: The main website was on the main domain and the checkout was on a checkout subdomain. Cross-domain measurement had never been configured in GA4. Every user who moved from the main site to the checkout appeared as a new direct session in GA4 -- breaking the session and losing all source attribution.

The result: 73% of their revenue appeared as direct in GA4 reports. The marketing team believed word-of-mouth and branded search were responsible for most revenue, and were severely under-investing in paid acquisition, which was actually responsible for a much larger share of purchases.

The fix: Configured cross-domain measurement in GA4 Admin and updated the GTM linker tag. Within 48 hours, the source breakdown for revenue looked completely different. Paid acquisition's share of revenue tripled in the reports -- not because anything had changed in reality, but because it was finally being attributed correctly.

The lesson: Any website with a separate checkout domain must configure cross-domain measurement. Without it, almost all purchase attribution is wrong.

Case Study 4: The Agency That Left 40 Dead Tags in a GTM Container

The client: A financial services company that had worked with three different marketing agencies over four years.

What we found: 43 tags in their GTM container, 29 of which were either deprecated, redundant, or firing incorrectly. Active tags included three different versions of Google Analytics, two different Facebook Pixels (one from a previous domain), a LinkedIn Insight Tag for a campaign that ended in 2020, and a heat-mapping tool's tag that was firing on the checkout page potentially capturing form field data.

More seriously, one of the three GA4 setups was sending data to a property owned by a previous agency's Google account -- not the client's own property. The client had zero access to 18 months of their own analytics data.

The fix: Full GTM container audit and rebuild. Archived all legacy tags. Rebuilt a clean container with 11 tags. Requested data access restoration from the previous agency.

The lesson: GTM containers accumulate technical debt. Every agency handover should include a container audit. And every tracking implementation should be set up in accounts owned by the client, not the agency.

The Common Thread

Every case above shares the same root cause: no one was checking. Tracking was set up once and then assumed to keep working. No post-deploy testing. No quarterly audits. No anomaly alerts in GA4.

The fix isn't complicated: build verification into your deployment process, set up anomaly detection alerts in GA4, and conduct a formal tracking audit at least once a year. Most of the problems we find in audits have been silently affecting data for 6-18 months before anyone noticed.