GA4 for small business: what to track and how to read it

Start from the outcomes your business already counts: enquiries, bookings and sales. Work backwards to the events GA4 needs to record and the reports you need to read. Because GA4 only describes recorded website behaviour, a lead business needs a separate record of real enquiries. A tag being installed is not evidence that any of it works.

What do events, key events and conversions mean?

An event is a recorded interaction, with parameters that describe its context. Page views, scrolls, clicks on a phone number and form submissions are all events. A key event is one you've marked as important to the business. A conversion is the version of that action used for advertising measurement and bidding.

Google's documentation on key events and conversions says conversions can now be created from Analytics events. They can be shared with a linked Google Ads account from the same place. The catch is that the feature may not be available to every property.

Conversions do not exist only in Google Ads. GA4 events do not all become bidding goals on their own, either. Somebody chooses.

The label is a measurement choice. It does not prove the event behind it was implemented correctly, either.

Keep four counts apart from the start: sessions, users, event counts and unique enquiries. Event counts include repeats. Only your inbox or CRM can confirm unique enquiries.

When an owner and agency argue about a GA4 number, check one thing before anyone gets defensive. Are they quoting the same one of those four?

What should a small business track in GA4?

Pick from these seven actions. The useful part of each row is the last column. That's because every action has a version that looks like a lead and isn't.

With a click event alone, GA4's view of a phone enquiry ends at the tap. The whole call journey runs from the number on the page to a call someone answers. Our guide on how to get more phone calls from your website covers the rest of it.

Use Google's recommended events where the meaning fits. Don't create several overlapping lead events of your own. Google describes generate_lead as a user who submits a form online or submits information offline. It describes purchase as a user who completes a purchase.

The same list includes lead lifecycle events such as qualify_lead, working_lead and close_convert_lead. They exist so a business with a connected CRM can send the outcome back.

A standard installation creates none of the custom events in the table. A documented event name still has to be implemented and tested. If your property already has useful names like phone_click, plan any rename so reporting continuity survives.

Our website audits show how often this goes wrong. The sample is 100 website audits from May 2023 to September 2026. In it, about 3 in 4 sites had no working key event for the main enquiry. That figure includes about 1 in 2 sites where GA4 was not installed or not collecting at all.

Get the main enquiry measured properly before you add anything else to the list.

Priorities differ by business. The difference is which action to prove first.

Trade businesses can read our guide to web design for tradies alongside this. It gives the fuller picture of what their site should do.

Before anyone builds an event, brief it. The template is the difference between an event name and a measurement.

Safe context means only a form category or a button location. Register a custom dimension if that parameter needs to appear in reports. Never send submitted names, emails, phone numbers, free text or anything about the enquiry itself.

Google's policy on personal information bans passing Google any data it could recognise as personally identifiable. It names URLs, page titles and form fields as the usual leaks.

A thank you page URL carrying the visitor's email address as a query string breaks that rule. GA4 can redact email addresses, but only on a best effort basis. So fix the URL rather than relying on the redaction.

How do you set up and test GA4 properly?

One workflow, seven checks, in this order. Access comes first for a reason. In the same website audits, we checked who held the Administrator role. On about 1 in 3 sites with a GA4 property, nobody at the business did.

The detail behind the steps

The last four steps carry detail that decides whether the numbers mean anything. Google's Enhanced measurement covers:

• page views

• scrolls

• outbound clicks

• site search

• video engagement

• file downloads

• form interactions

Enhanced measurement's form_start fires the first time a user interacts with a form in a session. And form_submit fires when the user submits a form.

A submit is an attempt. It is not confirmation that the form validated, that the server accepted it or that anyone received it.

So the lead event belongs in the code that runs after the server accepts the enquiry. It never goes on the Submit button. On a site that loads the Google tag directly, the developer's version looks like this.

// Runs once, after the server confirms it accepted the enquiry
gtag('event', 'generate_lead', {
form_type: 'quote_request'  // a category, never personal details
});

The form_type value is the safe context from your event brief, never anything the visitor typed. With Tag Manager, the developer pushes the same event to the data layer instead. Google's guide to setting up events shows the syntax.

For the special journeys, cross domain measurement needs the same Google tag ID on every domain involved. It's configured in the web stream, under Configure your domains. Google's cross domain measurement page describes the _gl parameter that carries the IDs across.

For the test itself, Tag Assistant and GA4's DebugView show events as they arrive. Neither proves receipt.

A successful test needs both sides of the journey. The first is one legitimate test enquiry in the inbox or CRM. The second is the matching event in GA4, where collection is permitted. Check that invalid forms and server failures do not send a success event. Check that refreshing or directly visiting a thank you page does not create another enquiry.

Confirmation page tracking can be useful. An unguarded page view is not proof of receipt.

Acceptance, event collection and business follow up can each fail on their own. That is why the flow has three checks, not one. A visible event does not establish attribution, deduplication or lead quality.

A missing event can be:

• a denied consent state

• an active filter

• a browser restriction

• processing delay

The fix for a tracking test that fails under a privacy choice is never to bypass the choice.

Two housekeeping items finish the setup. Define internal and developer traffic with care. GA4's data filters do not affect historical data. Once a filter is active the excluded data is never processed and cannot be recovered. So leave a new filter in its testing state, check who it catches, then activate it.

And use consistent campaign tags only on external marketing links. Internal UTM tags break session attribution. Names or email addresses in campaign tags break Google's policy on personal information. Redirects that strip the tags lose the campaign altogether. Nothing reconstructs last year's events, not even installing GA4 today.

If the form itself is the problem, see our guide to website enquiry form design. It covers fields, error messages and accessibility. The Google Ads side of these events belongs to our guide to Google Ads conversion tracking setup.

Which privacy and retention settings matter?

It depends on three separate questions, which talk about cookie banners tends to merge.

On the first question, Privacy Act coverage has exceptions for some small businesses. So neither "every site needs a banner" nor "small businesses are exempt" is true. And being based in Australia does not settle your obligations to every visitor.

For covered organisations, the OAIC's guidance on tracking pixels and privacy obligations expects:

• due diligence on third party tools

• minimal collection

• clear disclosure

• express consent for any sensitive information

Who is covered, and what's changing, belongs to our guide to Australian privacy law changes for websites.

A privacy policy link alone does not make a collection lawful. The policy itself should say what the site collects and who receives it. That's the subject of our guide to website privacy policies and terms.

On the third question, Google's Consent Mode overview defines four consent types:

• analytics_storage for analytics cookies

• ad_storage for advertising cookies

• ad_user_data for sending user data to Google for advertising

• ad_personalization for personalised advertising

The last two are the additions usually called Consent Mode v2.

In the basic implementation, Google tags stay blocked until the visitor consents. If they decline, nothing is sent, not even the consent status. In the advanced implementation, the tags load with consent defaulted to denied. While consent stays denied, they send cookieless measurements. Cookieless does not mean nothing is sent.

Defaults must be configured deliberately. A consent platform can pass the state to Google for you. But you still need to check that every tag responds the way you intended.

Behavioural modelling is where the sales pitch outruns the documentation. Google's page on behavioural modelling for consent mode sets the entry conditions.

Consent Mode has to run on every page, with the tags loading before the consent dialog appears. The property also has to clear two volume thresholds. Even then, Google says meeting them does not guarantee eligibility.

A site with fewer than 1,000 visitors a day cannot reach the second threshold at all. Nobody should promise recovered data, restored accuracy, full attribution or a percentage uplift because Consent Mode is on. Expect your measured totals to change after a consent implementation. Annotate the date so next quarter's comparison is honest.

Retention is a decision, not a default to maximise. Google's data retention page offers standard properties 2 or 14 months. The setting covers the user level and event level data that explorations and funnel reports use. Google's guide to getting started with Explorations confirms new properties keep 2 months by default. Standard aggregated reports are not affected by the setting.

Choose 14 months when you need year on year exploration and your data handling policy supports it. Review the option that resets a user's retention period on new activity. The setting sits in Admin, under Data collection and modification, then Data retention.

Deletion runs monthly. Analytics gives you 24 hours to revert a change before applying it. Increasing the period keeps eligible data not yet deleted. But nothing restores data already gone.

Treat Google signals and advertising personalisation the same way. Both are features to assess for a purpose. They're not switches every small business should flip for an owner dashboard.

How do you link Search Console and Google Ads?

Both links take a few minutes if your account holds the right role in each product.

Both links live under Admin, Product links. For Search Console: Search Console Links, Link, choose the property and the web stream, review and submit. For Google Ads: Google Ads links, Link, choose the account. Review the personalised advertising and auto tagging settings, then submit. Allow processing time before judging either.

Google's page on linking Search Console sets the limits:

• one Search Console property per web stream, and one web stream per Search Console property

• data arrives 48 hours after Search Console collects it

• the data covers at most 16 months

• Search Console metrics combine only with Search Console dimensions plus Landing page, Device and Country in Analytics

You cannot join query data to every GA4 dimension, whatever a dashboard template promises. If Search Console isn't set up yet, set up Google Search Console first. Then use our Google Search Console guide to read its reports in their own home.

Google's page on linking Google Ads adds two things worth knowing before you click. Personalised advertising is enabled by default. With it on, events such as add_to_cart and begin_checkout are marked as key events automatically. So review the key events list after linking and unmark anything that is not a business outcome.

And a link is not conversion tracking. To bid on an Analytics key event you still create the conversion in Google Ads. Choose the real outcome rather than every click or every key event. Make sure a native Ads lead and its imported GA4 version are not both primary.

The configuration detail and the attribution differences belong to our guide to linking GA4 and Google Ads.

The three are complementary. But linking them does not make their totals agree. Search Console clicks and GA4 sessions have different definitions, scope, processing, time zones and coverage. Google's own page on why Search Console and Analytics differ spells that out.

Keep organic search analysis in Search Console and on site outcomes in GA4. Stop expecting a linked report to reveal the search query behind each lead. It will not.

If a shared dashboard helps, the product is Data Studio, formerly Looker Studio. Google brought the Data Studio name back on 10 April 2026. There's a no cost edition and a paid Pro edition. Google said existing reports, data sources and users would move across without action.

Connect it with the Google Analytics connector and select the right account and property. Keep CRM qualification or revenue in a separately labelled panel unless there is a verified join.

And check the data credentials before you share. Owner's credentials let every viewer see the underlying data without their own access. Because of that, never make a client dashboard public by default. A dashboard is not a repair for faulty collection. It is faulty collection with a logo.

Which six GA4 reports should you read?

These are the six views we'd start any small business on. Each one made the list because it answers a real question an owner has. The navigation varies with the property's report collection and permissions. So a report may need adding to the menu first.

Each row has a limit the report will not tell you. Traffic acquisition needs the period and the definition matched before any budget moves. And direct is not proof that people typed the address. User acquisition is first touch, not the source of each session or sale.

The landing page report is session scoped. That means it does not prove the action happened on the entry page.

Pages and screens does not credit a later confirmation event to every page that helped. Raw event totals include repeats. So investigate a spike before celebrating it. Small device segments and a changed traffic mix mislead.

Wherever a report shows a Key events column, it starts on All events. That option totals every event you've marked as a key event. Google's page about key events shows how to open that menu and choose one specific key event. That one click turns a blended number into a rate you can act on.

Ecommerce businesses add the purchase and checkout reporting once those events exist. A business with a complete lead event integration can use the lead reports. Neither is a prerequisite for the routine. Realtime and DebugView are validation tools, not the monthly scorecard.

Google's data freshness page says processing can take 24 to 48 hours. Data in reports may change during that time. Intraday data refreshes in roughly two to six hours and Realtime in minutes. So the mistake of reading yesterday as final is built into the product.

How do you read the numbers without fooling yourself?

Define the numbers before interpreting them. The Traffic acquisition report shows a session key event rate. That's the percentage of sessions in which a user triggered a key event. It is not event count divided by sessions. The user version uses users instead.

Keep the same event choice, scope, dates and filters when you compare. Never add several events marked important into one "leads" total.

Google's definitions of engagement rate and bounce rate are plain. Engaged sessions last longer than 10 seconds, have a key event or have two or more page views. Bounce rate is the percentage of sessions that were not engaged.

So a bounce is not every one page visit. Take a visitor who taps your number within a few seconds, with no phone event set up. That's a bounce with a job attached. Our guide to what bounce rate means in GA4 takes that further.

Traffic, page views and time are context, not vanity. Before concluding that a page or channel failed, check for:

• incomplete recent data

• report quality indicators

• missing values

• consent coverage

Extend the period when the counts are small.

When the number you care about is zero, work the tree before blaming the page.

Do not diagnose a poor landing page from one unexplained zero. Remember how often our website audits found the enquiry event broken. So rule out tracking and report scope before anyone touches the page.

A one page owner dashboard, in Data Studio or on paper, has four layers:

Keep the dashboard's definitions identical to the GA4 report it summarises. A dashboard can quietly use a different event or date range from the report. That's how two people in the same meeting end up with two different months.

How do you turn a monthly review into action?

Thirty minutes, once a month, with the same six questions. Thirty is a suggested time box, not a promise that every account can be fully reviewed in it. A fault found mid month gets fixed mid month rather than filed for the meeting.

The connections between a pattern and a fix are practical and limited. Low relevant traffic justifies an acquisition review. A service page with visits and no action justifies looking at its clarity and proof. Our guide to service page structure and copy covers both.

Campaign traffic landing on a page never built for it justifies a page built for it. That's where our guide on how to build a landing page that converts comes in. Paid clicks with no enquiries have their own order of checks in Google Ads clicks but no leads. A verified mobile form failure justifies a developer.

What GA4 cannot do is prove the cause. A drop in event rate does not establish slow load time, a confusing sentence or a bad offer. Confirm speed with a speed check. Our guide to why your website is slow starts there. Confirm usability by watching someone use the page.

Two mistakes bracket this review. The first is writing off social traffic because it recorded no enquiries. It may have a different task, a later influence or a measurement gap. A channel is judged on a defined commercial outcome over a defined period, with its coverage known. It isn't judged on last month's zero.

The second is the opposite, excusing poor traffic indefinitely because attribution is hard. Define the outcome, the window and the coverage, then decide.

The evidence may point to friction in the enquiry journey rather than the traffic. If so, a conversion rate review is the next step. It starts with the same validated numbers. Our guide on why your website is not converting covers the wider diagnosis.

What we recommend at Elev8d

FAQ

Next steps

Written by Ajay K.Co-founder, Elev8d

Ajay is the co-founder of Elev8d and writes most of what you will read here. Psychology grad turned marketer, which is a fancy way of saying he cares about why people click, not just where things rank. Every guide is written in plain English for Australian businesses, tested on real campaigns before it earns a spot on this site.