By Marc Alexander

  • 6 monthsApril to October 2026
  • 14workstreams led in parallel
  • 236 tagsin the container he audited
  • 40reports, specifications and decision papers delivered

The brief.

Halfords runs GA4 360 on a large Salesforce Commerce Cloud site, with a tag container built up over years by many hands and a new customer data platform on the way. Nobody owned the whole picture. Marc's job was to find out what the tracking was actually doing, fix what could be fixed quickly, and design the rest properly for the platforms Halfords was moving to.

  1. April to June

    Find and size.

    Stakeholder interviews, a full container audit, dataLayer audits of four key journeys, a GA4 measurement plan, and the business case for server-side tagging.

  2. July and August

    Contain and design.

    Quick fixes in the container, commercially sensitive data taken out of the browser, the customer identity design, a new consent banner and the attribution model.

  3. September and October

    Assess and hand over.

    A six-month assessment, the server-side cutover plan, and a handover naming an owner for every open decision.

What Marc uncovered.

  • 18.5%of checkout page views were being double counted. Marc found both causes and specified the fixes
  • 15.5%of search page views were overstated, caused by an extra page view fired just before the redirect to results
  • 2hidden faults breaking customer matching with the ad platforms and the customer data platform. Nothing errored, so it looked like poor coverage
  • 6destinations, the customer data platform among them, all fed from the browser rather than from the system of record
  • 24 of 46tags on the order confirmation page would count the same order again if the page was refreshed. Only 4 were protected
  • × quantityitem revenue on every multi-item line, because the price field carried the line total rather than the unit price

What Marc led.

Tag governance

A 236-tag container audited line by line, and a plan to rebuild it for the new headless site.

  • A container audit with 30 ranked findings, a register of 20 custom code defects, and a six-month follow-up assessment.
  • Reviews of Google Ads and Floodlight, the Meta, TikTok and Reddit server integrations, site search, Contentsquare and page performance.
  • A four-stage plan to rebuild the container for the headless site: contain, specify, build, cut over.
  • Tag governance, a dataLayer request process and QA standards for releases, written as Halfords documents.

Server-side tagging

From a business case to a tested cutover plan.

  • A business case, and a cost model comparing server-side tagging with GA4 360 hit costs.
  • 13 dedicated server-side data tags built to one standard, replacing a workaround that used GA4 as the transport.
  • The endpoint strategy covering hosting, routing and naming, and a nine-step cutover plan with 25 tests, ready for the agency to take live.

Customer identity

The identity design for Halfords' new customer data platform.

  • Three identifiers, all minted in the ecommerce platform. Together they connect a customer across GA4, the ecommerce platform and the new customer platform without personal data passing through the browser.
  • Covers signed-in customers, guest checkout and newsletter sign-ups. It includes a hashing standard that fixes silent match failures at source.
  • Four requirements for the new data model, set out for the consultancy building it. The DPO backed deferring wider remediation on condition that this design is built in.

Privacy and consent

Privacy decisions made with the DPO, and a consent banner built to the European standard.

  • A PII removal strategy, commercially sensitive values taken out of the browser, and every privacy decision taken to the DPO with the options and remaining risk written down.
  • An audit of storage and access across 132 cookies against PECR, UK GDPR and the ICO's April 2026 guidance, and a provisional rewrite of the cookie policy.
  • A new consent banner and preference centre with a working prototype, one panel for both the UK and EU, and the regulatory reasoning behind it.

Measurement and data

A GA4 model on Databricks, plus the dataLayer for the next site.

  • A page and product attribution model: six rule-based models across 221 columns, refreshed weekly behind twelve quality checks, feeding Power BI and documented for developers and stakeholders.
  • A custom channel grouping that follows GA4's own evaluation order, a bot traffic report, and a sitewide scan that catches duplicate page views anywhere.
  • Ten dataLayer changes for the headless build, written as developer user stories, including a redesign of the MOT booking journey from 48 dataLayer pushes to 12, plus a GA4 event reference covering every tag.

Experimentation and search

Evidence for decisions that would otherwise have been guesses.

  • Recommended against reconnecting the experimentation platform to GA4 at 360 volumes, and set out an alternative that adds no GA4 cost.
  • Showed that a switch-off test was confounded by four events in six days, and recommended a proper holdout test instead.
  • Found the root cause of a spike in site search data, with four container-only fixes, set out for Halfords, the agency and the search vendor.

How Marc worked.

  • Decisions, not just findings. Every recommendation went to a named owner in data protection, technology, product or platform, as a short decision paper with the technical detail behind it.
  • Risk first. Findings were ranked by the risk to customers and the business, and the cheap container-only fixes were separated from work that needed development.
  • Built to hand over. A 31-slide handover set out where all 14 workstreams stood, who owned each decision, the first five actions and the exit checklist.

Results.

  • Full visibility of the estate. Halfords knows what every tag does, what it sends, what consent it relies on and what to fix first.
  • The size of the reporting errors is now known. Double counting in search and checkout was measured and explained, and the fixes were specified, along with a way to correct past data.
  • Privacy risks ranked and taken to the DPO, with the remaining risk documented and an owner for each decision.
  • Server-side tagging built, and handed to the agency with a nine-step cutover plan and 25 tests.
  • An identity design for the new customer data platform, put to the consultancy building it before the data model was finalised.
  • Attribution reporting on Databricks that answers questions the GA4 interface can't.