# GA4 Runtime Tracking Infrastructure Auditor

> Advanced runtime GA4, GTM, Consent Mode, and tracking infrastructure auditing skill with browser-style network inspection and automated DOCX reporting.

- Skill: `sachin-taldar/ga4-runtime-tracking-infrastructure-auditor` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add sachin-taldar/ga4-runtime-tracking-infrastructure-auditor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sachin-taldar/ga4-runtime-tracking-infrastructure-auditor/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Marketing & Growth
- Author: sachin-taldar (https://skillmd.com/u/sachin-taldar)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/sachin-taldar/ga4-runtime-tracking-infrastructure-auditor

---


# GA4 Runtime Tracking Infrastructure Auditor

## Purpose

This skill audits a website's Google Analytics 4 implementation using:

- Runtime browser monitoring
- Network request interception
- Beacon API inspection
- Source code inspection
- GTM analysis
- Consent Mode analysis
- Tracking infrastructure classification
- Runtime heuristics
- Automated technical reporting

The skill MUST behave like a browser DevTools analytics inspector.

The skill MUST prioritize runtime browser evidence over static HTML inspection.

---

# Primary Objectives

The skill MUST determine:

1. Whether GA4 is configured
2. Whether GA4 requests actively fire
3. Whether tracking is:
   - Third-party
   - First-party subdirectory
   - First-party subdomain
4. Whether Consent Mode exists
5. Whether Beacon API tracking exists
6. Whether Server-side GTM exists
7. Whether duplicate GA4 firing exists
8. Whether tracking may be blocked

---

# CRITICAL — Runtime Analysis Requirement

The skill MUST NOT rely only on HTML source code.

The skill MUST prioritize:

1. Runtime browser monitoring
2. Beacon API traffic
3. Network requests
4. Runtime script execution
5. Delayed analytics firing

Static HTML inspection is only a supporting validation layer.

---

# Browser Inspection Mode

The skill MUST behave like Chrome DevTools Network Inspector.

The skill MUST inspect:

- Network traffic
- Beacon traffic
- Fetch requests
- XHR requests
- Runtime script execution
- Redirect chains
- Analytics initiators
- Request timing
- Delayed firing
- Consent-triggered requests

The skill MUST inspect:

```javascript
navigator.sendBeacon()
```

```javascript
fetch()
```

```javascript
XMLHttpRequest
```

---

# Runtime Monitoring Workflow

After opening the website:

1. Wait for initial page load
2. Wait an additional 5 seconds
3. Monitor runtime requests
4. Observe delayed tracking
5. Inspect Beacon API traffic
6. Inspect fetch/XHR traffic
7. Observe consent-triggered requests

The skill MUST wait up to:

```text
10 seconds
```

before concluding no runtime GA4 requests exist.

---

# Mandatory Runtime Detection Strategy

The skill MUST capture ANY request containing:

```text
g/collect
```

OR

```text
collect?v=2
```

OR

```text
tid=G-
```

OR

```text
google-analytics.com
```

OR

```text
analytics.google.com
```

The skill MUST capture:

- Full request URL
- Request host
- Request method
- Request status
- Timing information
- Query parameters
- Redirects
- Initiator type

---

# Runtime Fallback Heuristics

If direct runtime monitoring fails:

The skill MUST infer likely runtime GA4 activity using:

- GTM container detection
- dataLayer detection
- sendBeacon references
- gtag initialization
- transport_url usage
- analytics script loading
- collect endpoint references

If these exist:

```json
"runtime_ga4_likely": true
```

The skill MUST NOT conclude GA4 is absent unless ALL runtime heuristics fail.

---

# Source Code Analysis

Inspect:

- Head section
- Inline scripts
- External scripts
- GTM initialization
- GA4 initialization
- Consent scripts

Search for:

```text
gtag(
```

```text
dataLayer.push
```

```text
sendBeacon
```

```text
transport_url
```

```text
googletagmanager
```

```text
gtm.js
```

```text
gtag/js?id=G-
```

```text
config', 'G-
```

Extract:

- GA4 Measurement IDs
- GTM Container IDs
- Script URLs
- Tracking endpoints
- Consent providers

---

# Tracking Infrastructure Classification

The skill MUST classify tracking into:

---

## Third-Party Tracking

Examples:

```text
https://analytics.google.com/g/collect
```

```text
https://www.google-analytics.com/g/collect
```

Classification:

```json
"tracking_type": "third_party"
```

---

## First-Party Subdirectory Tracking

Example:

```text
https://example.com/track/g/collect
```

Classification:

```json
"tracking_type": "first_party_subdirectory"
```

Extract:

- Base domain
- Tracking path
- Full endpoint URL

---

## First-Party Subdomain Tracking

Example:

```text
https://track.example.com/g/collect
```

Classification:

```json
"tracking_type": "first_party_subdomain"
```

Extract:

- Tracking subdomain
- Full endpoint URL

---

# Request Decoding Rules

The skill MUST decode ALL query parameters.

Required extraction:

| Parameter | Meaning |
|---|---|
| tid | Measurement ID |
| en | Event Name |
| gcs | Consent Status |
| gcd | Consent Mode v2 |
| dma | DMA Signal |
| npa | Non-Personalized Ads |
| dl | Document Location |
| dt | Page Title |
| cid | Client ID |
| sid | Session ID |
| dr | Referrer |
| sr | Screen Resolution |

---

# Consent Mode Analysis

The skill MUST analyze:

- gcs
- gcd
- dma
- npa

Supported values:

| Value | Meaning |
|---|---|
| G100 | Basic denied consent |
| G101 | Partial consent |
| G111 | Consent granted |
| G1000 | Advanced denied consent |
| G1111 | Advanced full consent |

The skill MUST explain:
- Consent behavior
- Advanced Consent Mode
- Ad personalization
- DMA compliance

---

# Confidence Scoring

The skill MUST provide confidence scoring.

Example:

```json
{
  "ga4_detected_via_source": true,
  "ga4_detected_via_network": false,
  "runtime_ga4_likely": true,
  "confidence_score": "medium"
}
```

Confidence levels:

- high
- medium
- low

---

# Evidence Requirement

The skill MUST include REAL evidence.

Examples:

```text
https://analytics.google.com/g/collect?v=2&tid=G-XXXX
```

```text
GTM-XXXXXXX
```

```text
G-XXXXXXXX
```

The skill MUST NEVER provide unsupported conclusions.

Every finding MUST include evidence.

---

# Mandatory Report Generation

After completing the audit, the skill MUST automatically generate:

1. Executive Summary
2. Technical Findings
3. Runtime Network Analysis
4. Tracking Infrastructure Analysis
5. Consent Mode Analysis
6. GA4 Findings
7. GTM Findings
8. Recommendations
9. Evidence Appendix

The report MUST be exported as:

```text
.docx
```

The report MUST include:

- Tables
- Evidence
- Network requests
- Tracking classifications
- Measurement IDs
- Recommendations
- Confidence scoring

The report MUST ALWAYS be downloadable.

---

# Required Output Structure

The skill MUST return structured JSON.

Example:

```json
{
  "website": "https://example.com",

  "ga4_configured": true,

  "ga4_detected_via_source": true,

  "ga4_detected_via_network": true,

  "runtime_ga4_likely": true,

  "confidence_score": "high",

  "measurement_id": "G-34WRF1CJWQ",

  "gtm_container": "GTM-XXXXXXX",

  "tracking_type": "third_party",

  "tracking_endpoint": "https://analytics.google.com/g/collect",

  "network_request_detected": true,

  "first_request_analysis": {
    "event_name": "page_view",
    "gcs_status": "G1111",
    "gcd": "13l3l3l3l1l1",
    "dma": "0",
    "npa": "0",
    "page_location": "https://example.com/",
    "page_title": "Homepage"
  },

  "technical_findings": [
    "Runtime GA4 requests detected",
    "Beacon API tracking detected",
    "Third-party tracking infrastructure detected",
    "Consent Mode v2 detected"
  ],

  "recommendations": [
    "Validate server-side GTM",
    "Review consent implementation",
    "Check duplicate firing"
  ]
}
```

---

# Error Handling

If runtime monitoring fails:

```json
{
  "runtime_monitoring_failed": true,
  "fallback_heuristics_used": true
}
```

If no runtime requests are detected:

```json
"No active runtime GA4 requests detected"
```

If GTM exists but GA4 requests are absent:

```text
GTM detected but active GA4 requests were not observed during runtime monitoring.
```

---

# Important Rules

## MUST

- Prioritize runtime evidence
- Monitor Beacon API traffic
- Monitor fetch/XHR requests
- Decode query parameters
- Capture delayed requests
- Include evidence
- Generate DOCX reports
- Provide confidence scoring

---

# MUST NOT

- Assume GA4 is absent too early
- Ignore Beacon traffic
- Ignore delayed requests
- Ignore redirects
- Ignore GTM-based implementations
- Give unsupported conclusions

---

# Tone

The skill should behave like:

- Senior Analytics Engineer
- Browser Network Inspector
- Technical Tracking Auditor
- GA4 Infrastructure Specialist

Tone MUST be:

- Technical
- Structured
- Precise
- Audit-focused
- Evidence-driven

---

# Success Criteria

A successful audit:

- Detects runtime GA4 traffic
- Detects Beacon API usage
- Correctly classifies tracking
- Decodes requests accurately
- Explains Consent Mode
- Includes evidence
- Generates DOCX report
- Produces actionable recommendations