Six tracking audits, six segments
Outside-in reviews of six public sites: e-commerce, nonprofit, industrial manufacturing, media, SaaS and healthcare. Same method each time, run on 2026-10-29.
Scope and limits: I have no access to these sites' GA4 properties or GTM workspaces, I am not affiliated with any of them, and everything below comes from one page load of the home page in a clean browser, without clicking a consent banner. Items marked "verify" need confirmation inside the account before anyone acts on them. These samples are for demonstration only, and the sites may have changed since.
What I found
| Segment | Site | Main finding |
|---|---|---|
| E-commerce | Google Merch Shop | Seven GA4 IDs on one page and duplicate data layer events |
| Nonprofit | charity: water | Many ad and tracking pixels, with marketing cookies already present at load |
| Manufacturing | Dow | Adobe stack instead of GA4, duplicate consent events, canonical mismatch |
| Media | ProPublica | Legacy Universal Analytics requests still firing next to GA4 |
| SaaS | Webflow | Consent set up well; two Google tag load paths to reconcile |
| Healthcare | Mayo Clinic | Tealium and Adobe stack; no meta description on the home page |
Google Merch Shop
shop.merch.google. One GTM container, seven GA4 measurement IDs, several Google Ads and Floodlight tags, a legacy Universal Analytics script and a third-party analytics script.
| # | Finding | Priority | Why it matters |
|---|---|---|---|
| 1 | pageview, user_consent and view_item_list appear twice in the data layer on one category page load | High | If both reach GA4, pageviews and list impressions are overcounted. Verify in GA4 DebugView. |
| 2 | Seven GA4 measurement IDs load on the same page | High | Hard to know which property is the source of truth. Duplicated hits add cost and reporting confusion. |
| 3 | Legacy Universal Analytics files still load (analytics.js, ec.js, a _dc_gtm_UA-… cookie) | Medium | UA stopped processing data in 2023. Dead tags add weight and risk without producing reports. |
| 4 | Promotion event uses the old Enhanced Ecommerce shape (promoView.promotions) with GA4-style item fields inside | Medium | GA4 expects items[] plus promotion parameters. A hybrid payload can drop fields. |
| 5 | Consent platform lists only strictly necessary cookies at load, yet _ga* cookies are set and ad-conversion requests fire | High | Depends on region and the consent mode configured. Verify with a clean session in the EU and the US. |
Fix first: reproduce the duplicate events in GTM Preview, then map every GA4 ID to a purpose and keep one production stream.
charity: water
charitywater.org. One GTM container and one GA4 ID, plus a long list of advertising and testing tools.
| # | Finding | Priority | Why it matters |
|---|---|---|---|
| 1 | The home page contacts TikTok, X (Twitter), Bing, Impact, Dstillery, Tatari and Mountain domains, on top of Google, Optimizely and Stripe | High | Every pixel adds page weight, privacy exposure and one more number to reconcile. Confirm each one still has an owner and a live campaign. |
| 2 | A consent tool (Cookie-Script) pushes a Google consent update, yet _ttp, _twpid, _uetsid and _gcl_au cookies are already present | High | Marketing cookies before a visible choice can be a compliance problem. Verify banner state by region in a clean session. |
| 3 | Optimizely experiments run next to GTM | Medium | Experiment exposure should reach GA4 as an event or dimension, or test results cannot be tied to donations. |
| 4 | Engagement events exist (gtm.scrollDepth, a 10-second timer), but the donation step is not visible on the home page although Stripe loads there | Medium | For a donation site the key event is the completed gift. Verify it fires once, with value, on the thank-you step. |
| 5 | No structured data found on the home page | Low | Organization markup is a quick win for search results and knowledge panels. |
Fix first: inventory every pixel against active campaigns, then align consent behaviour with what the banner promises.
Dow
dow.com. No Google tag found on the home page: analytics runs through Adobe, with OneTrust for consent.
| # | Finding | Priority | Why it matters |
|---|---|---|---|
| 1 | OneTrustLoaded and OptanonLoaded each appear twice in the data layer | Medium | Any tag triggered by those events fires twice. A single initialisation is cleaner. |
| 2 | The canonical tag points to /en-us.html, while the live page address is /en-us | Medium | Mismatched canonicals split signals between two URLs. Confirm which one should rank. |
| 3 | Adobe identity cookies (AMCV, kndctr_…) are set at load | Medium | Check they follow the consent choice in each region. Verify with a clean session. |
| 4 | No GA4 or Google Ads tag on the page | Info | Fine if intentional. If paid search or Search Console data is wanted, B2B lead attribution would need a Google tag added. |
| + | Organization and breadcrumb structured data present | Good | Search engines get clear company data. |
Fix first: remove the duplicate consent events and fix the canonical, then decide whether Google tags belong beside Adobe.
ProPublica
propublica.org. One GTM container and one GA4 ID, plus several audience and testing tools.
| # | Finding | Priority | Why it matters |
|---|---|---|---|
| 1 | Universal Analytics still loads: analytics.js and a pageview request to a UA-… property run next to GA4 | High | UA stopped processing in 2023. The requests produce no reports and slow the page. |
| 2 | Five measurement systems on one page: GA4, Parse.ly, Sailthru, Jetpack stats and an A/B testing tool | Medium | Different tools report different numbers. Name one source of truth for traffic and one for newsletter signups. |
| 3 | The data layer holds only gtm.js, gtm.dom and gtm.load on load | Medium | Newsletter signups and donations are core goals. Verify they are tracked as events, not just pageviews. |
| 4 | _ga, _gid and audience cookies are set with no consent platform detected | Medium | Check requirements for EU, UK and Brazil visitors. Verify with a clean session per region. |
| + | Website, Organization and Breadcrumb structured data present | Good | Solid base for search features. |
Fix first: retire the Universal Analytics tag, then define conversion events for signups and donations.
Webflow
webflow.com. One GTM container, one GA4 ID and one Google Ads ID, with a consent manager (Transcend) and a personalisation tool.
| # | Finding | Priority | Why it matters |
|---|---|---|---|
| + | A consent default is pushed before the GTM container runs, and no GA4 hits or _ga cookies appear before a choice | Good | This is the correct order. Keep it when tags change. |
| 1 | gtag.js loads the GA4 and Google Ads IDs next to the GTM container | High | If the same IDs are also configured inside GTM, conversions can be counted twice once consent is granted. Verify in GTM Preview. |
| 2 | The personalisation tool pushes a variation_viewed event | Medium | Send the variation as a GA4 parameter so conversion rates can be read per variant. |
| 3 | Sign-up events are not visible on the home page, and the product lives on another subdomain | Medium | Confirm cross-domain linking and that signup start and completion each fire once. |
| 4 | A programmatic ad platform and a second ad script load on the page | Low | List them in the tag inventory so retargeting audiences stay documented. |
Fix first: reconcile the two Google tag load paths, then add variant data to the signup funnel.
Mayo Clinic
mayoclinic.org. A very light tag footprint: Tealium and an Adobe analytics object, with Transcend consent. No Google tags found on the home page.
| # | Finding | Priority | Why it matters |
|---|---|---|---|
| + | Consent default is set, and no advertising pixels load in this session | Good | A careful setup for a sensitive category. |
| 1 | No meta description on the home page | Medium | Search engines will write their own snippet. Easy to fix. |
| 2 | Structured data includes an empty entry in the JSON-LD list | Low | Harmless but untidy. Validate the markup and remove empty blocks. |
| 3 | Tracking runs through a tag manager I cannot see into from outside | Info | An internal audit would list what each Tealium and Adobe tag sends. |
| 4 | Condition and symptom pages were not checked | High | For health content, confirm no page URL, search term or form value reaches an ad platform. Not tested here. |
Fix first: audit what the analytics tags send from health content pages, then fix the metadata.
How each audit was done
- Loaded the home page in a clean browser session and waited for tags to settle.
- Listed scripts, requests, measurement IDs, cookies and data layer events in order.
- Checked the canonical, meta description and structured data.
- Not covered: server-side tagging, real GA4 data quality, ad-account conversion accuracy, checkout or signup flows.
Want this for your site?
A paid audit adds your GA4 and GTM access, a prioritised fix list and a short walkthrough call.
Ask for an audit →