By Marc Alexander

If you've outsourced your analytics to an agency or consultant, you expect a setup that is compliant and built around your goals. Marc Alexander, a GA4 consultant, has reviewed plenty that weren't: tracking strategies that didn't just fail to deliver value but put the business at risk.

Below are three real scenarios, anonymised, with the red flags to look for when you review your tracking or an agency's recommendations.

Red flag 1: Ecommerce events used for navigation and forms

Scenario: an agency recommended using GA4 ecommerce events such as add_to_cart, begin_checkout and purchase to track routine interactions:

  • clicks on navigation items ("Contact", "Services", "About Us")
  • form submissions (general enquiries, contact forms, newsletter sign-ups)

Why it's a problem:

  • Ecommerce events describe a buying journey: product views, cart updates, checkouts and purchases.
  • Using them elsewhere distorts reports. GA4's monetisation reports show inflated funnel activity, false purchase counts and meaningless revenue.
  • Ad platforms optimise towards the wrong signals. If Google Ads or Meta think a form submission is a purchase, they spend budget finding the wrong people.
  • It clutters the dataLayer. The purchase schema adds risk and testing overhead for no gain.
  • It breaks trust. Stakeholders question the inflated numbers, then stop using the analytics.

A real consequence: reports showing dozens of purchases a day that were contact form submissions.

Better approach: use GA4's recommended or custom events for non-commerce actions:

  • generate_lead for form submissions
  • select_content for navigation or call-to-action clicks
  • a custom event such as contact_form_submit if you need more detail

GA4 reports on these correctly, and your ecommerce data stays clean.

Red flag 2: Sending user email addresses to GA4

Scenario: a proposal to collect email addresses from web forms, push them into the dataLayer, then send them to GA4 for tracking or audience building.

Why it's a problem:

  • Google's terms explicitly prohibit sending personally identifiable information (PII), such as email addresses, to GA4.
  • It breaches UK GDPR and PECR without explicit consent and a valid legal basis.
  • Even in the dataLayer alone, the risk of it being sent by accident through GTM or another tool is high.

Better approach: PII should never be sent to analytics platforms. Handle email addresses only in secure backend systems or platforms built for identity resolution, and always with clear, explicit consent.

Scenario: an agency suggested firing lightweight "cookieless" pings to analytics tools even when a user declined tracking in the consent banner, on the logic that "we're not setting cookies, so it's fine."

Why it's a problem:

  • Under PECR, analytics needs consent unless it meets the narrow statistics exception in force since February 2026. That exception requires a simple way to object, so tracking someone who has just said no is never covered by it.
  • Whether cookies are set is irrelevant. If data goes to a platform to monitor behaviour, consent is needed.
  • It makes your consent banner and privacy notice untrue, and can lead to investigations, fines and damage to your brand.

Better approach: if a user rejects consent, send no tracking requests to analytics platforms, cookieless or not.

The common thread

All three put data volume ahead of data quality, show a weak grasp of privacy law and platform policy, and focus on what can be tracked rather than what should be. A good analytics partner offers:

  • A tracking plan built around your funnel and goals
  • Lean event design with a reason for every event
  • Privacy decisions grounded in the law, not marketing spin
  • Clear documentation of every tag, trigger and purpose
  • Willingness to push back when something is legally or technically risky

Questions to ask about your own setup

  • Do you know which events fire on your site, and why?
  • Is anything tracked after users decline consent?
  • Is your analytics platform receiving email addresses or other PII?
  • Could you defend the setup if a regulator asked?

If you can't answer all four with confidence, get a second opinion. Marc's 38-point GA4 audit checks your events, consent behaviour and data handling, and tells you what to fix first.

Disclaimer

This article is based on general industry experience and is for educational purposes only. It does not name or refer to any specific company or individual, and it is not legal advice. For compliance questions about your own analytics setup, consult a qualified legal professional.