Google Analytics 4 and Tag Manager setup: events, consent and server-side tracking

What the setup connects

Google Analytics 4 (GA4) records what visitors do as a stream of events. Google Tag Manager (GTM) is the container that decides which tags fire, when, and with what data. A setup connects three things to GA4: the pages of your site or store, the visitor's consent choice, and your own server, which knows facts the browser does not, such as whether a payment really went through.

The earlier WavX post on how to track your website analytics covers which numbers to watch. This page covers how the data gets there.

Browser                         Your server                    Google
-------                         -----------                    ------
page + dataLayer events  ---->  (optional) server container -> GA4 property
consent banner choice    ---->  consent state on every hit
                                order paid / refunded  ------> Measurement Protocol
                                                               GA4 -> BigQuery export

Data that flows each way

Event design: the mapping to agree first

Google's ecommerce guide lists the recommended events in funnel order: view item list, select item, view item, add to and remove from cart, begin checkout, add shipping info, add payment info, purchase, refund. The mapping below is the document to settle before anyone opens Tag Manager.

The main flow, step by step

1. Write the event plan. One row per action, with its name, parameters and the page or server step that triggers it.
2. Build the data layer. The site pushes structured data for each action. Tags read from it; they do not scrape the page.
3. Set consent defaults. Google's guide requires the consent default command on every page before any command that sends measurement data, and the update command on the page where the visitor makes a choice.
4. Configure tags in GTM, or the Google tag directly, to send each data layer event to GA4.
5. Add server events. For payment, refund and renewal, post to https://www.google-analytics.com/mp/collect with the stream's measurement_id, an api_secret and the visitor's client_id.
6. Validate. Send test payloads to Google's validation server (/debug/mp/collect); events sent there do not appear in reports.
7. Mark key events and register custom dimensions in GA4, then compare a week of GA4 purchases against the order system.

Limits and rules Google documents

Common failure modes

• The tag is blocked by the site's own security header. A Content-Security-Policy that does not list Google's hosts stops the tag without any visible error. Google's CSP guide lists https://www.googletagmanager.com under script-src-elem, img-src and connect-src, with https://*.google-analytics.com added to img-src and connect-src for GA4, and recommends a server-generated nonce for the container script.
• Server events vanish. A wrong api_secret or measurement_id still returns a success status, and Google notes that the validation server does not check those two values.
• Purchases counted twice or not at all. No transaction_id, or a thank-you page that reloads.
• Consent set too late. The default arrives after the first tag has fired.
• Server events create a second user. The client_id from the browser was not stored with the order.
• A year-on-year exploration comes back empty. Retention was left at 2 months.
• A password-protected store sends nothing. Shopify's help centre notes that GA4 cannot track events until private mode is switched off.

What WavX builds around it

For a client who needs GA4 set up properly, WavX builds:

• The event plan and a data layer implemented in the site's code, for Next.js, React, custom stores and Shopify themes.
• A consent banner wired to Google's four consent parameters, with the default set before any tag.
• GTM web containers, and a server container where first-party collection is wanted.
• Server-side purchase and refund events from the order system, keyed on your order ID.
• A scheduled comparison of GA4 purchases with orders, so drift is seen early.
• BigQuery export and reporting where a custom dashboard is needed.

The same event plan feeds ad platforms; see Meta Pixel and Conversions API setup and the performance marketing service. Tracking visits that arrive from AI assistants is covered in measuring AI referral traffic in GA4.

WavX does not publish a price for a single integration; it is quoted after scoping. For planning, the software cost estimator carries third-party integrations as a ₹60,000 feature line on top of a base build. Its output is a planning range, not a quote. Other integrations are listed under API and system integration services.

When Google's own tools are enough

• A brochure site with one enquiry form. Install the Google tag, switch on enhanced measurement, mark the form submission as a key event. No developer needed.
• A standard Shopify store. Shopify's Google & YouTube channel connects GA4 and sends the standard ecommerce events.
• You only need traffic totals. The default reports answer that without custom events.

Custom work earns its cost when revenue in GA4 has to match the order system, when ad spend is optimised against those numbers, or when consent and security headers make the default install fail quietly.