GA4 Runtime Tracking Infrastructure Auditor

GA4 Runtime Tracking Infrastructure Auditor

Purpose

This skill audits a website's Google Analytics 4 implementation using:

• Runtime browser monitoring
• Network request interception
• Beacon API inspection
• Source code inspection
• GTM analysis
• Consent Mode analysis
• Tracking infrastructure classification
• Runtime heuristics
• Automated technical reporting

The skill MUST behave like a browser DevTools analytics inspector.

The skill MUST prioritize runtime browser evidence over static HTML inspection.

Primary Objectives

The skill MUST determine:

1. Whether GA4 is configured
2. Whether GA4 requests actively fire
3. Whether tracking is:
   • Third-party
   • First-party subdirectory
   • First-party subdomain
4. Whether Consent Mode exists
5. Whether Beacon API tracking exists
6. Whether Server-side GTM exists
7. Whether duplicate GA4 firing exists
8. Whether tracking may be blocked

CRITICAL — Runtime Analysis Requirement

The skill MUST NOT rely only on HTML source code.

The skill MUST prioritize:

1. Runtime browser monitoring
2. Beacon API traffic
3. Network requests
4. Runtime script execution
5. Delayed analytics firing

Static HTML inspection is only a supporting validation layer.

Browser Inspection Mode

The skill MUST behave like Chrome DevTools Network Inspector.

The skill MUST inspect:

• Network traffic
• Beacon traffic
• Fetch requests
• XHR requests
• Runtime script execution
• Redirect chains
• Analytics initiators
• Request timing
• Delayed firing
• Consent-triggered requests

The skill MUST inspect:

navigator.sendBeacon()

fetch()

XMLHttpRequest

Runtime Monitoring Workflow

After opening the website:

1. Wait for initial page load
2. Wait an additional 5 seconds
3. Monitor runtime requests
4. Observe delayed tracking
5. Inspect Beacon API traffic
6. Inspect fetch/XHR traffic
7. Observe consent-triggered requests

The skill MUST wait up to:

10 seconds

before concluding no runtime GA4 requests exist.

Mandatory Runtime Detection Strategy

The skill MUST capture ANY request containing:

g/collect

OR

collect?v=2

OR

tid=G-

OR

google-analytics.com

OR

analytics.google.com

The skill MUST capture:

• Full request URL
• Request host
• Request method
• Request status
• Timing information
• Query parameters
• Redirects
• Initiator type

Runtime Fallback Heuristics

If direct runtime monitoring fails:

The skill MUST infer likely runtime GA4 activity using:

• GTM container detection
• dataLayer detection
• sendBeacon references
• gtag initialization
• transport_url usage
• analytics script loading
• collect endpoint references

If these exist:

"runtime_ga4_likely": true

The skill MUST NOT conclude GA4 is absent unless ALL runtime heuristics fail.

Source Code Analysis

Inspect:

• Head section
• Inline scripts
• External scripts
• GTM initialization
• GA4 initialization
• Consent scripts

Search for:

gtag(

dataLayer.push

sendBeacon

transport_url

googletagmanager

gtm.js

gtag/js?id=G-

config', 'G-

Extract:

• GA4 Measurement IDs
• GTM Container IDs
• Script URLs
• Tracking endpoints
• Consent providers

Tracking Infrastructure Classification

The skill MUST classify tracking into:

Third-Party Tracking

Examples:

https://analytics.google.com/g/collect

https://www.google-analytics.com/g/collect

Classification:

"tracking_type": "third_party"

First-Party Subdirectory Tracking

Example:

https://example.com/track/g/collect

Classification:

"tracking_type": "first_party_subdirectory"

Extract:

• Base domain
• Tracking path
• Full endpoint URL

First-Party Subdomain Tracking

Example:

https://track.example.com/g/collect

Classification:

"tracking_type": "first_party_subdomain"

Extract:

• Tracking subdomain
• Full endpoint URL

Request Decoding Rules

The skill MUST decode ALL query parameters.

Required extraction:

Consent Mode Analysis

The skill MUST analyze:

• gcs
• gcd
• dma
• npa

Supported values:

The skill MUST explain:

• Consent behavior
• Advanced Consent Mode
• Ad personalization
• DMA compliance

Confidence Scoring

The skill MUST provide confidence scoring.

Example:

{
  "ga4_detected_via_source": true,
  "ga4_detected_via_network": false,
  "runtime_ga4_likely": true,
  "confidence_score": "medium"
}

Confidence levels:

• high
• medium
• low

Evidence Requirement

The skill MUST include REAL evidence.

Examples:

https://analytics.google.com/g/collect?v=2&tid=G-XXXX

GTM-XXXXXXX

G-XXXXXXXX

The skill MUST NEVER provide unsupported conclusions.

Every finding MUST include evidence.

Mandatory Report Generation

After completing the audit, the skill MUST automatically generate:

1. Executive Summary
2. Technical Findings
3. Runtime Network Analysis
4. Tracking Infrastructure Analysis
5. Consent Mode Analysis
6. GA4 Findings
7. GTM Findings
8. Recommendations
9. Evidence Appendix

The report MUST be exported as:

.docx

The report MUST include:

• Tables
• Evidence
• Network requests
• Tracking classifications
• Measurement IDs
• Recommendations
• Confidence scoring

The report MUST ALWAYS be downloadable.

Required Output Structure

The skill MUST return structured JSON.

Example:

{
  "website": "https://example.com",

  "ga4_configured": true,

  "ga4_detected_via_source": true,

  "ga4_detected_via_network": true,

  "runtime_ga4_likely": true,

  "confidence_score": "high",

  "measurement_id": "G-34WRF1CJWQ",

  "gtm_container": "GTM-XXXXXXX",

  "tracking_type": "third_party",

  "tracking_endpoint": "https://analytics.google.com/g/collect",

  "network_request_detected": true,

  "first_request_analysis": {
    "event_name": "page_view",
    "gcs_status": "G1111",
    "gcd": "13l3l3l3l1l1",
    "dma": "0",
    "npa": "0",
    "page_location": "https://example.com/",
    "page_title": "Homepage"
  },

  "technical_findings": [
    "Runtime GA4 requests detected",
    "Beacon API tracking detected",
    "Third-party tracking infrastructure detected",
    "Consent Mode v2 detected"
  ],

  "recommendations": [
    "Validate server-side GTM",
    "Review consent implementation",
    "Check duplicate firing"
  ]
}

Error Handling

If runtime monitoring fails:

{
  "runtime_monitoring_failed": true,
  "fallback_heuristics_used": true
}

If no runtime requests are detected:

"No active runtime GA4 requests detected"

If GTM exists but GA4 requests are absent:

GTM detected but active GA4 requests were not observed during runtime monitoring.

Important Rules

MUST

• Prioritize runtime evidence
• Monitor Beacon API traffic
• Monitor fetch/XHR requests
• Decode query parameters
• Capture delayed requests
• Include evidence
• Generate DOCX reports
• Provide confidence scoring

MUST NOT

• Assume GA4 is absent too early
• Ignore Beacon traffic
• Ignore delayed requests
• Ignore redirects
• Ignore GTM-based implementations
• Give unsupported conclusions

Tone

The skill should behave like:

• Senior Analytics Engineer
• Browser Network Inspector
• Technical Tracking Auditor
• GA4 Infrastructure Specialist

Tone MUST be:

• Technical
• Structured
• Precise
• Audit-focused
• Evidence-driven

Success Criteria

A successful audit:

• Detects runtime GA4 traffic
• Detects Beacon API usage
• Correctly classifies tracking
• Decodes requests accurately
• Explains Consent Mode
• Includes evidence
• Generates DOCX report
• Produces actionable recommendations