A clean measurement setup for the new year comes down to five questions: who owns your Search Console, GA4 and Tag Manager accounts, whether your conversions are real business events, whether consent mode actually behaves the way you think it does, whether you filter out your own traffic, and whether there are a few reports someone genuinely reads. Sort it out before the year ends, because several GA4 settings only work going forward: whatever you miss now, you can't fix retroactively in January.
Every marketing engagement we take on starts with a technical audit, and measurement is part of it. If the data is wrong, every decision built on it is wrong too, from the campaign budget to the content plan. The checklist below follows the order in which we go through a new client's accounts.
- Removing a former owner in Search Console only sticks if you also remove their verification token from the site or the DNS.
- Top-level access to Search Console, GA4 and GTM should sit with the business, not with a former agency or an ex-employee's Gmail account.
- Keep key events few, tie each one to a real business event, and reconcile them monthly against your backend.
- Judge consent mode not by how the banner looks, but by what leaves the browser after someone clicks reject.
- Set GA4 event data retention to 14 months and switch the internal traffic filter to Active. Neither applies retroactively.
- Use Search Console's custom annotations to log changes, so next year you still know why the numbers moved.
Who actually owns your Search Console, GA4 and Tag Manager?
This is the dullest item on the list, and the one that causes the most trouble. We regularly find a company's Analytics account registered to an old agency, a marketer who left, or the freelancer who built the site years ago. Nobody minds while things run smoothly, but when something changes, getting access back can take weeks.
Search Console: not all owners are equal
According to Google's permissions documentation, a verified owner has proved ownership with a token (an HTML file, a meta tag, a DNS record), while a delegated owner was added by another owner in the user management screen, without a token. Next to them are full users, who can see all data and take some actions, and restricted users, who can view most data and little else.
The catch is the token. If you delete a verified owner in the interface but their token stays on the site, Google's help page says ownership is granted back to them the next time Google sees the token. Since 2024, Search Console also lists unused ownership tokens in user management, and a "Verify removal" step lets you confirm they're really gone. Walk through that list once a year.
Search Console notifies every verified owner when a new owner is added to a property; if you don't recognise the name, look into it straight away. We verify Domain properties with a DNS record, because it doesn't vanish with a theme change or a rebuilt homepage the way a meta tag can.
GA4 and Tag Manager: the business hosts, the agency visits
Our rule is simple: top-level admin rights stay with the business, held by at least two people, and we and every other partner get only the access the work requires. In Tag Manager, pay special attention to who can publish. Anyone with publish rights can push any script live on your site, including a pixel that bypasses your cookie banner.
| Tool | What to review | Typical problem |
|---|---|---|
| Search Console | Verified and delegated owners, unused tokens | A former colleague's token is still in the DNS |
| GA4 | Who is admin at account and property level | The account belongs to a former agency |
| Tag Manager | Who the account admins are, who can publish | Everyone can publish, nobody reviews |
Are you counting the conversions that actually make money?
Since 2024, what GA4 used to call conversions are called key events. "Conversion" now refers to an event imported into Google Ads. That's also why the two interfaces will never show exactly the same number: attribution differs, and so does the counting logic.
At the start of the year, open your key events list and ask of every row: if this number doubled, would we be happy? If the answer is "not sure", it isn't a key event. The usual leftovers from old setups are scroll depth, video starts and contact page views. Useful events, but not outcomes.
- Webshops: the completed purchase, with a transaction ID so a reloaded thank-you page doesn't count twice.
- Service businesses: the submitted quote request or booking, not the button click.
- Apps and SaaS: sign-up and first real use, not the download.
Then calibrate: compare a closed month's key events with your webshop or CRM data. The gap isn't an error, it's information, because it shows how big a hole declined consent and blockers are punching in your measurement. If the hole is large, server-side tracking may be the next step.
Does consent mode really work the way you think?
The most common problem we see isn't a missing banner, it's a banner and tags that don't talk to each other. Google's consent mode documentation describes the signals it expects (in v2, that includes the ad_user_data and ad_personalization parameters), and we've covered in a separate post why a default-denied state makes measured traffic drop. Here are just the four checks we run every year:
- Open the site in a private window and, before touching the banner, check the Network tab in your browser's developer tools: are measurement requests already firing, and with what consent state?
- Reject everything and watch whether a Meta pixel or another ad tag still loads because someone added it outside the consent logic.
- Accept everything and check that the state updates and persists on the next page.
- In Tag Manager's preview mode, see which tag fires under which consent condition.
If the cookie banner was updated or new tags went into the container, run it again.
Which settings quietly skew your numbers?
Your own traffic
Excluding internal traffic in GA4 takes two steps: add your office IP addresses in the data stream's tag settings, then switch the internal traffic data filter from Testing to Active. As Analytics Mania's guide explains, in Testing the filter only labels the matching data, which still shows up in your reports. Once Active, it excludes that data permanently, with no way to get it back. So we test for a few days and only then go live. For remote teams, IP filtering isn't enough; there we flag the team's browsers with a custom marker in Tag Manager.
Data retention
GA4's data retention setting offers 2 or 14 months on a standard property, and event data defaults to 2 months. This affects Explorations, not most standard reports. The setting isn't retroactive: switch to 14 months now, and you'll have a full year of data by next autumn.
Payment pages and your own domains
In webshops, this is the mistake we see most: a customer returning from the payment provider shows up as a new session with the payment page as the source, so the sale gets credited to the bank instead of the campaign. That's what the unwanted referrals list in GA4's tag settings is for. If your checkout spans several domains, check cross-domain measurement too.
Which reports should you actually check regularly?
Even the cleanest setup is useless if nobody looks at it. Ours is a short monthly routine:
- Search Console, performance: clicks and impressions split into branded and non-branded queries. The non-branded part tells you whether you're reaching new people.
- Search Console, indexing: new exclusion reasons in the Pages report, plus the Core Web Vitals report.
- GA4: key events by channel, set side by side with your backend numbers.
- Bing Webmaster Tools: if you've already connected it, the same round, since it's also your gateway to ChatGPT search.
And write your changes down. Since November 2025, Search Console lets you add custom annotations to performance charts: right-click, "Add annotation", up to 120 characters for a given date. Everyone with access to the property can see them, so keep personal data out, and according to the help page they don't appear in comparison mode or 24-hour views. We log every release, migration, consent change and major campaign there, and in Tag Manager we publish every version with a descriptive name and notes. Next October, that's how you'll know why something dropped or spiked.
Frequently asked questions
How long does a year-start check like this take?
For a well-kept account, a few hours. Where ownership has to be recovered or the consent setup rebuilt, it can take days, because you're waiting on other parties: an old agency, the cookie banner vendor, the developer.
Why don't GA4 and Google Ads conversion numbers match?
Because they're not counting the same thing. GA4 records the key event under its own attribution on the day it happened, while Google Ads records the imported conversion against the ad click date, within its own conversion window. A small gap is normal. A big one points to an implementation issue, such as a duplicate tag or a missing consent signal.
What if our old agency won't hand back access?
In Search Console you can verify yourself with your own token, which only needs access to the site or the DNS, and then remove the old tokens. GA4 and Tag Manager are much harder, because an existing admin has to grant you rights. That's why it pays to sort this out before you switch agencies.
If you'd like a second pair of eyes, our free SEO and AI visibility audit covers Search Console and your measurement basics too. Ongoing measurement and campaigns are part of our marketing services.