Web Analytics Setup: GA4, Tag Manager & Server-Side

Web analytics setup is the work of making the numbers on your site trustworthy: the right events in Google Analytics 4, a tag container someone can change without breaking the rest, and a consent setup that stands up to GDPR. Without that, marketing reports a rise in traffic while sales see no orders, and nobody can tell which figure is wrong.

At CodeWiz we implement GA4, Google Tag Manager and server-side tagging for stores, SaaS products, publishers and campaign sites. We define the events that match how the business actually makes money, keep tags behind a consent signal, and leave you with a container, a measurement plan and a dashboard a founder can read on Monday morning.

This service is for teams whose GA4 property was created and then left on enhanced measurement alone, companies running ads into the EEA who need Consent Mode v2, stores whose purchase count never matches the payment provider, and anyone whose Tag Manager container has become a pile of custom HTML nobody dares to publish.

Setup: Close-up of a laptop screen with a traffic line graph and pie chart

Google Analytics 4 in a Web Analytics Setup

GA4 is an event model. Page views, scrolls, clicks and purchases are events with parameters, not the session-and-hit structure of Universal Analytics. A useful property is small on purpose: a few streams, a naming scheme, and key events that match revenue or leads. A property with eighty events that nobody opens is not a measurement system.

What we configure

One data stream per site (or per platform, when a store and a marketing site are genuinely separate), with the domain list and cross-domain measurement written down.
Enhanced measurement reviewed line by line. Automatic scroll and outbound-click events stay only when someone will use them; duplicate page views from a tag and from enhanced measurement are removed.
Recommended events for commerce and leads: view_item, add_to_cart, begin_checkout, purchase, refund, generate_lead, with item arrays and a stable transaction_id.
Key events marked for the actions you optimize, internal-traffic and developer filters, a data-retention setting you have actually chosen, and a link to Google Search Console and to ads accounts where you use them.

Checking the data before anyone trusts it

We verify events in DebugView and in the realtime report, then against a known order or form submission. Ecommerce item parameters are compared with the order in your store, including currency and value. Where the volume justifies it, we enable the BigQuery export so raw events can be checked outside the GA4 interface. Google’s GA4 collection documentation is the reference for event names and parameters.

Google Tag Manager Without the Spaghetti

Google Tag Manager is how tags get onto the site without a developer release for every pixel. It is also how a site quietly accumulates three analytics tags, two chat widgets and a custom HTML block that reads the URL. We treat the container as production code.

A dataLayer contract: the site pushes named events and parameters; tags listen. Marketing does not scrape the DOM for a price that a theme change will rename.
Consent-aware triggers: a Consent Initialization step runs before other tags, and every Google tag waits for the consent state.
Templates over custom HTML: community and custom templates where they exist. Custom HTML is the exception, reviewed for what it loads, because PCI DSS and a strict Content-Security-Policy both get harder when arbitrary scripts multiply.
Workspaces, environments and versions: changes are previewed against the real site, named, and published by someone who can roll back. Staging and production do not share a careless “latest” publish.
Single-page applications: history changes and virtual page views are explicit, so a Laravel, React or headless store does not record one page view for an entire session.

The purchase event the store pushes looks like this. The tag, not the theme, decides what is forwarded:

window.dataLayer = window.dataLayer || [];
window.dataLayer.push({
  event: 'purchase',
  ecommerce: {
    transaction_id: order.id,
    value: order.total,
    currency: 'EUR',
    items: [{
      item_id: 'SKU-1',
      item_name: 'Widget',
      price: 59.90,
      quantity: 1
    }]
  }
});

Server-Side Tagging

Client-side tags run in the visitor’s browser, where ad blockers, Intelligent Tracking Prevention and short cookie lifetimes drop a growing share of hits. Server-side tagging moves the forwarding step onto infrastructure you control. The browser sends one request to a first-party host such as metrics.yourdomain.com; that server decides what is passed to GA4, Google Ads or a conversion API, and it can strip fields you do not want to leave your network.

What improves, and what does not

Less JavaScript on the page, which helps Core Web Vitals. Google’s target for LCP is still under 2.5 seconds, and a stack of marketing tags is a common reason a fast site misses it. We have written about reaching that bar in our guide to 100/100 page performance.
First-party collection on a subdomain you own, usually fronted by Cloudflare. Our notes on Cloudflare configuration cover DNS, TLS and caching around that kind of hostname.
Control over personal data: email addresses and phone numbers are hashed or removed before a vendor sees them, and you can see exactly which events left the server.
Consent is unchanged. Server-side tagging is not a way to measure people who refused analytics cookies. The server forwards only what the consent state allows.

We run the tag server on Google Cloud Run or on a small VPS when the cloud bill is hard to justify, with a staging container for tests. Deduplication uses a shared event id so a browser hit and a server hit for the same purchase count once. The setup follows Google’s server-side tagging documentation.

Hands holding a tablet with a growth chart during a meeting over coffee

Consent Mode v2 is how Google tags learn what the visitor allowed. Since 2024, ads measurement and remarketing features for traffic in the European Economic Area, the United Kingdom and Switzerland expect four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. The default, before a choice, is denied. A banner that appears after GA4 has already fired has not implemented consent; it has documented a breach.

How we implement it

A consent management platform, or a banner you already have, writes the choice. We connect that choice to Consent Mode and to every non-Google tag that sets a cookie or sends an identifier.
Advanced Consent Mode can send cookieless pings for modeled conversions when the visitor refuses. Basic mode sends nothing until consent. We explain the difference and implement the option your legal position allows. Modeling is Google’s estimate, and we label it that way in reports.
Tags for chat, heatmaps, advertising pixels and A/B tools sit in the same consent map. Analytics is not the only script that needs a legal basis.
The choice is stored so a later page view does not ask again and does not forget. A visitor can reopen the banner and change their mind, and the tags follow.

GDPR applies when you offer goods or services to people in the EU, which includes many companies in Bosnia and Herzegovina and Serbia that sell into the EU, and it applies directly in Croatia. Local privacy statutes still apply at home. We implement the technical controls – consent, minimization, retention, no personal data in URLs or event parameters – and we do not replace a lawyer. The official reference is Google’s Consent Mode guide.

gtag('consent', 'default', {
  ad_storage: 'denied',
  analytics_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  wait_for_update: 500
});

Dashboards and Reporting

A property nobody opens is an unfinished setup. We build a short report around the questions the business asks: where visitors came from, what they did, and whether that turned into revenue or leads. Vanity sessions without a conversion next to them do not make the page.

GA4 explorations for path and funnel questions the standard reports do not answer.
Looker Studio for a weekly view shared with people who should never have to learn the GA4 interface.
Annotations when a release, a campaign or a broken tag changes the curve, so next month’s panic has a date attached.
A reconciliation note: orders in the store, charges at the payment provider and purchase events will not match to the cent. We document the gap from consent refusals, ad blockers and abandoned checkouts, and we treat a collapse in purchase events as a bug.

On-site behavior and search-demand data answer different questions. For the search side, see our article on SEO analytics and competitive intelligence.

Client-Side, Server-Side or a Privacy-First Tool

Google is not the only honest way to measure a site. The choice depends on whether you buy Google Ads, what your visitors consent to, and how much infrastructure you want to run:

Approach	Data you can expect	Privacy posture	Running cost	Best fit
GA4, client-side only	Good on consenting browsers; weaker where blockers and ITP apply	Depends on consent and the tag set	Low	Brochure sites with little paid traffic
GTM, client-side	Same collection, many more tags under one publish button	Only as good as the consent triggers	Low	Sites with several marketing tools
Server-side tagging	Higher match rates for ads and a single first-party collection point	You control what leaves the server; consent still applies	Hosting for the tag server	Stores and advertisers who need reliable conversions
Matomo or Plausible	Cleaner, smaller event set; no Google Ads integration of the same depth	Strong: self-hosted Matomo, or cookieless Plausible	Low to moderate	Teams that do not need Google advertising features

Open-source analytics is a real option we will recommend when Google tags are not pulling their weight. Matomo on your own server keeps the raw data with you. Plausible is the lighter cookieless alternative when you want trends, not user-level journeys.

Common Analytics Mistakes We Fix

A GA4 property with no key events, so every report is traffic without an outcome.
Page views counted twice, once from the gtag snippet and once from Tag Manager.
Email addresses, names or order notes landing in URLs, page titles or event parameters.
The consent banner loading after the analytics tag, or a “reject” button that only hides the banner.
Internal and agency traffic mixed into acquisition reports.
A single-page checkout that never fires purchase because the success view is not a full page load.
No alert when the purchase event drops to zero, so a theme deploy can disable revenue tracking for a week.

What a Web Analytics Setup Costs

Scope follows the number of sites, the state of the existing container and how close the numbers must sit to the store’s orders:

A clean GA4 and GTM setup on one site, with a consent banner already chosen, is a small project.
Ecommerce events, refunds and a checkout that is not a standard theme take more testing.
Server-side tagging adds the tag server, DNS and deduplication with ads platforms.
A container that has grown for years needs an audit before anything new is published.
Looker Studio reports, BigQuery and extra vendors (ads, heatmaps, CRM) each add a defined slice of work.

Tool prices – GA4 and GTM are free at the volumes most sites have, while Matomo, Plausible, a consent platform or Cloud Run are not – stay separate from the implementation estimate. We list them before work starts.

Laptop screen with a green data chart and tables in a dim office

How We Work

Discovery: we list the sites, the decisions the numbers must support, the tags already firing and the consent tool, if there is one.
Plan: we write a measurement plan: events, parameters, key events, consent signals and what “close enough to the store” means.
Build: we configure GA4, the container and, where it is in scope, the server-side tagger, on a staging environment first.
Test: we walk real journeys – consent granted, consent refused, purchase, refund, lead – in DebugView and in the tag server logs.
Launch: we publish a named container version, watch event volume against the previous days and fix gaps in the first week.
Support: we adjust the plan when the site or the campaigns change, and we keep the container from filling up again.

Why CodeWiz

Implementation, not a slide: we ship the property, the container and the checks, and we can change the store or the app when the event has nowhere clean to fire.
Privacy as part of the build: Consent Mode v2, a default of denied, and no personal data in the payload are the baseline.
Open-source when it fits: Matomo or Plausible when you do not need the Google advertising stack.
Fair pricing: premium development without premium prices, from Banja Luka, working with clients locally and internationally.
One team for the whole site: analytics, performance, hosting and the application itself. More about CodeWiz.

Frequently Asked Questions

How much does a web analytics setup cost?

A single-site GA4 and Tag Manager setup with consent wired through is a short engagement. Ecommerce tracking, an audit of an old container, server-side tagging and custom dashboards add scope in that order. You receive an estimate after we see the site and the existing tags.

Should I use GA4 or a privacy-friendly tool?

Use GA4 when you run Google Ads or need the advertising integrations around it. Use Matomo or Plausible when you want simpler, more private measurement and you are not buying that integration. Some sites run both, with the privacy-friendly tool always on and GA4 only after consent. We recommend one primary source of truth so two dashboards do not start an argument.

No. It changes where events are forwarded, not whether you need a legal basis. Consent Mode still defaults to denied, and the tag server must respect that state. What you gain is control, less browser JavaScript and better match rates for the visitors who did agree.

It is Google’s protocol for telling tags which storage and advertising uses the visitor allowed. Version 2 added ad_user_data and ad_personalization next to the older storage flags. For EEA, UK and Swiss traffic it is what Google Ads expects if you want modeled conversions and audience features.

Can you repair an existing Tag Manager container?

Yes. We inventory every tag, trigger and custom HTML block, map them to consent, remove duplicates and leave a version history that explains what was published. We do not wipe a container that other people rely on without a rollback version.

How long does the setup take?

A straightforward site is often done within a couple of weeks, most of that in testing and in waiting for a real campaign or a handful of orders to confirm the numbers. Server-side tagging, several domains or a checkout with unusual steps takes longer because each path has to be walked.

Ready for Numbers You Can Trust?

Tell us which reports you open and whether ads or a consent banner are already in the picture. We will propose a web analytics setup and implement it. Contact us, or browse our services for the rest of what we build.

Web Analytics Setup: GA4, Tag Manager & Server-Side

Contents