M10.L2 · Analytics & Experiments
GA4 without tears (and its traps)
What you'll be able to doSpecify a minimal, defensible tracking plan — events, key events, exclusions — and explain three specific ways GA4's numbers can mislead, including consent and modelled data.
Learn
The tool is free; the mistakes are expensive
Google Analytics 4 is free, installed on a large share of the world's websites, and quietly wrong in specific, knowable ways. None of them are scandals. All of them will, one day, have you explaining a "traffic crash" that was actually a cookie-banner change — unless you learn the traps before you learn the reports.
This lesson deliberately teaches the mental model, not a click-path. GA4's menus get rearranged every year; the model underneath hasn't changed since launch. Learn the model and you can find any report. Learn a click-path and you're lost at the next redesign.
And to be clear about the goal: your M1.L6 funnel baseline was built from estimates, with the estimate boxes honestly ticked. This lesson is where those estimates start becoming measurements — as long as you remember that measured is still not the same as true.
The model: everything is an event
GA4 records exactly one kind of thing: an event — a page viewed, a button clicked, a purchase completed — each with parameters attached (which page, which button, what value). Users and sessions are not recorded; they are derived from events afterwards. That inversion explains most of GA4's odd behaviour.
Three consequences worth keeping:
- A user is a guess. GA4 stitches events into "users" via cookies and signals. Clear your cookies, switch devices, or refuse consent, and you become two users, or none.
- A session is a grouping rule. Thirty minutes of inactivity ends one. Sessions and users answer different questions; a report that swaps them mid-sentence is how "traffic doubled" and "nothing changed" turn out to both be true.
- A conversion is just an event you flagged. GA4 calls these key events. Keep 2–5 — the ones on your KPI tree from the last lesson — or the word stops meaning anything. Marking ten events "key" is the analytics version of a page with ten CTAs.
Trap one: the payment gateway steals the credit
Ostara's GA4 had run untouched beside Shopify since 2023. When Mateus finally opened it, the #2 "channel" for purchases was mollie.com — the payment gateway, credited with roughly a quarter of tracked orders.
The mechanism is mundane. A buyer leaves the shop to pay, then returns to the confirmation page. GA4 sees a visitor arriving from mollie.com just before purchasing and hands the gateway the credit that belonged to Instagram, email, or search. The fix is one list — unwanted referrals — where payment and login domains are declared so returning from them doesn't start a new attributed visit. Mateus fixed it in an afternoon, and excluded the studio's own IP address while he was there: unfiltered office traffic is the other classic self-inflicted lie, a business admiring its own visits.
The general lesson: before you trust any channel report, ask what the tool counts as an arrival.
Trap two: the consent banner rewrites your traffic
Then it happened — the trap this lesson exists for. Ostara's consent banner gained an equal-weight Reject button (the compliant design; Module 11 covers why). Acceptance fell from roughly 60% to roughly 40%, and overnight GA4-measured sessions dropped by about a third: from ≈3,900 to ≈2,600 of the same ~6,500 real sessions.
Nothing happened to the business. Shopify's server-side order count sat unchanged at ~91. Only the measurement changed — fewer visitors consented, so fewer were seen. Mateus did the two professional things: he annotated the date, and from then on reported "measured sessions" with a footnote, rather than announcing a traffic crisis or quietly hoping nobody compared months.
Under Consent Mode, GA4 goes one step further: refused visitors send cookieless pings, and Google models — statistically estimates — the missing users and conversions to fill the gap. Modelled data is not a scam, but it means your dashboard is partly inference, not observation. You must know which parts, because your boss will ask why two tools disagree, and "one of them is partly modelled" is the actual answer.
Trap three: thresholding — the silently missing rows
GA4 protects privacy by thresholding: when a report row would describe too few people, it hides the row entirely, often without an obvious warning. For a site Ostara's size — a few thousand measured sessions a month — that means small segments, small campaigns and small landing pages can silently vanish from reports while still being real.
You may have heard about sampling — GA4's standard reports are unsampled, and sampling in Explorations only starts at around 10 million events, which no business in our cast will ever see. For small businesses the trap is thresholding, not sampling: not approximated data, but absent data.
One more model output masquerading as a fact: GA4's channel reports default to data-driven attribution — credit assigned by a model, changeable in settings, not ground truth. The next lesson takes that apart properly.
The honest alternative tier
Running GA4 in the EU means running it behind consent — which is exactly what makes its numbers partial. The cast shows the legitimate alternatives. Lena runs Cloudflare Web Analytics on her landing page: cookieless, no banner, no per-user tracking — shallower data, but complete and consent-free. Tomas has no page analytics at all: his baseline is Tally's form-level counts, with page visitors honestly recorded as unknown. Plausible and Matomo occupy the same territory.
None of these is a downgrade. They are trades — depth for completeness, features for defensibility — and choosing one deliberately is a measurement stance, which is precisely what this module is teaching you to have. Whatever you run, the deliverable is the same: a written tracking plan. Events, key events, exclusions, consent position, and — the part most people skip — what your setup cannot see.
Do
Exercise 10.2.1 — Your tracking plan
Write your tracking plan: the events you will track, which are key events, and the exclusions you will configure. If you use a consent-free tool instead of GA4, complete the same plan for it — and say what you give up.
Write these down — in your plan document, or on the worksheet at the end of this lesson.
| What to decide | Guidance |
|---|---|
| Your analytics tool | GA4 · Plausible · Matomo · Cloudflare / other · none yet. "None yet" is workable — use form-level counting, Tomas's method |
| Your events, 4–10 | For each: a name in snake_case (e.g. booking_form_submit) · what user action fires it · whether it is a key event. Keep key events to 5 at most |
| Your exclusions | Internal IPs listed · payment and login referral domains listed · staging domain excluded. Mark an item N/A only with a reason — and never the internal-IP row |
| Your consent dependency | Runs only after consent · consent-free tool · not sure yet. "Not sure yet" is honest — read M11.L3 and resolve it before you finish the Module 10 Project |
| Your known blind spots | 50–150 words: what this setup cannot see — consent refusers, cross-device journeys, dark-funnel arrivals, offline conversions. An empty blind-spot list means you haven't looked |
When the plan is written, map your key events against your M10.L1 KPI tree: flag any KPI without a corresponding event, and query any key event serving no KPI. Then reopen your M1.L6 baseline — each event you've defined should replace one of its ticked estimates with a measurement.
Where this goes: Measurement §2 — Tracking — of your Marketing Plan. The exclusion checklist returns in the Module 10 Project.
Check
Quiz — 4 questions
1. After Ostara's consent banner gets an equal-weight Reject button, GA4 sessions fall by about a third overnight while Shopify's order count is unchanged. The most likely explanation is:
- a) Google penalised the site
- b) Fewer visitors consented, so fewer were measured — reality didn't change, measurement did ✔
- c) The server went down
- d) Seasonality
Why: orders are counted server-side and held steady — the business was fine. Only consent-dependent measurement moved. Annotate the date and report "measured sessions" with a footnote; never let a banner change masquerade as a traffic story, in either direction.
2. In GA4's default reports, the channel credit shown under data-driven attribution is best described as:
- a) An exact record of what caused each sale
- b) A model's estimate, changeable in settings ✔
- c) Last-click truth
- d) First-click truth
Why: attribution in GA4 is a model output presented in the same font as observations. Useful, but never ground truth — the next lesson is about exactly this.
3. "mollie.com" appears as a top purchase channel in an e-commerce GA4 property. What is actually happening?
- a) The payment gateway is sending Ostara customers
- b) A competitor is linking to the store
- c) Buyers returning from the payment page are counted as arriving from it — a self-referral stealing credit from the real source ✔
- d) Affiliate fraud
Why: the buyer's journey ended at the gateway and resumed at the confirmation page; GA4 credits the last "arrival". Declaring payment and login domains as unwanted referrals returns the credit to the channel that earned it.
4. A small site's GA4 report shows nothing for a campaign that definitely sent visitors. The most likely GA4-specific cause is:
- a) Sampling — GA4 approximates all small reports
- b) Thresholding — rows describing too few users are hidden entirely ✔
- c) The visitors were bots
- d) The campaign ran too recently to ever appear
Why: standard GA4 reports are unsampled; the small-site trap is thresholding, which removes rows rather than approximating them. The visitors are real, the row is withheld — absence of evidence, not evidence of absence.
Advance
Two of five. You have a tracking plan, an exclusion list, and — rarer than either — a written account of what your analytics cannot see.
Next: M10.L3 — UTM discipline and attribution. Your tool now counts arrivals honestly. Next question: arrivals from where? Analytics only knows what your links tell it — and every attribution model flatters somebody.
Mark your own work
| Good | Not yet | |
|---|---|---|
| Events are minimal | 4–10 events, each answering a KPI question | Track-everything, or only pageviews |
| Key events mean something | 2–5, matching your KPI tree | Ten "conversions", or none |
| Exclusions done | Internal IPs and payment/login referrals listed | "We'll clean the data later" |
| Consent position stated | Behind consent, or consent-free tool — chosen on purpose | "Not sure yet" left unresolved |
| Blind spots written down | Names who your setup cannot see | Claims the setup sees everything |
Worksheet
THE SCHOOL OF NET MARKETING
Lesson 10.2 — Your tracking plan
MY TOOL: ☐ GA4 (behind consent) ☐ Plausible / Matomo /
Cloudflare (consent-free) ☐ Form-level counts only
EVENTS (4–10, snake_case; tick the 2–5 that are KEY events)
event_name what fires it KEY?
________________________ ________________________ ☐
________________________ ________________________ ☐
________________________ ________________________ ☐
________________________ ________________________ ☐
________________________ ________________________ ☐
EXCLUSIONS — the two classic self-inflicted lies
☐ Internal / office IPs: ______________________
☐ Payment & login referral domains: ______________
☐ Staging / test domain: ______________________
THE THREE TRAPS (can I explain each in one sentence?)
☐ Self-referrals — the gateway steals the credit
☐ Consent changes — measured users move, reality doesn't
☐ Thresholding — small rows vanish, they aren't approximated
WHAT MY SETUP CANNOT SEE (50–150 words)
_____________________________________________________
_____________________________________________________
RULE: measured is not the same as true. Annotate every
change to banner, tags or definitions — dated, on the chart.
Next: Lesson 10.3 — UTM discipline & attribution.
theschoolofnetmarketing.com/learn/utm-discipline-and-attribution