GA4 Audit Checklist for Higher Education: 7 Mistakes You're Making (And How to Fix Them)

Is Your GA4 Setup Actually Working for You?

Here's a question nobody in higher ed wants to answer: When was the last time you actually audited your GA4 implementation?

If you're like most colleges and universities I work with, the answer is either "never" or "what do you mean by audit?" And honestly? I get it. Your team migrated from Universal Analytics to GA4 because Google made you, not because anyone had the bandwidth to do it right.

But here's the thing, a broken GA4 setup isn't just an analytics problem. It's a budget problem. When you can't accurately track which marketing campaigns are driving enrollments, which landing pages are converting prospective students, or where your traffic is actually coming from, you're making decisions in the dark.

Let's fix that. Here are the seven most common GA4 mistakes I see in higher education institutions, and more importantly, how to actually fix them.

Mistake #1: Your Tracking Code Is a Hot Mess

Walk me through this: Do you actually know which pages have your GA4 tracking code? All of them? What about that student portal subdomain? The athletics site that marketing doesn't technically control? That scholarship application form built by IT in 2019?

The Problem: Tracking code sprawl is real in higher ed. Between legacy microsites, third-party application platforms, and that one department that "just needed a quick landing page," your GA4 property is probably missing huge chunks of user behavior.

The Fix:

• Document every subdomain and property that should be tracked
• Use Google Tag Manager (seriously, if you're not using GTM yet, stop everything and implement it)
• Run a complete crawl of your domain and subdomains to verify tag presence
• Create a source of truth spreadsheet: which GA4 properties track which websites

This isn't glamorous work, but it's foundational. You can't audit what you're not tracking in the first place.

Mistake #2: Your Self-Referrals Are Inflating Everything

Let me guess, your top traffic source in GA4 is… your own website? Yeah, that's not supposed to happen.

The Problem: When students move from your main website to your application portal, or from your blog to your subdomain, GA4 is treating those as separate "referrals." This creates ghost traffic and makes your acquisition reports completely useless.

The Fix:

• Go to Admin → Data Streams → Configure tag settings → Show more → List unwanted referrals
• Add every subdomain you own: apply.yourschool.edu, portal.yourschool.edu, events.yourschool.edu, etc.
• Test it by clicking through your own student journey and watching the real-time reports

Pro tip: If you're using a third-party CRM or application system (Slate, anyone?), you'll need to exclude those domains too. Otherwise, every time a student returns from checking their application status, GA4 thinks they're a "new" referral from Slate.

Mistake #3: You're Ignoring GDPR and CCPA (And Your Legal Team Will Notice Eventually)

Here's an uncomfortable truth: most higher ed institutions collect data from prospective students across state lines and international borders. That makes you subject to GDPR, CCPA, and a growing list of other privacy regulations. Your current GA4 setup probably isn't compliant.

The Problem: Default GA4 settings don't automatically comply with privacy laws. If you're not collecting consent, providing opt-outs, or respecting data retention requirements, you're building risk.

The Fix:

• Implement a consent management platform (CMP) like OneTrust or CookieYes
• Configure GA4's consent mode to respect user choices
• Set data retention periods (Admin → Data Settings → Data Retention) to 14 months maximum
• Document your privacy policy and make sure it accurately reflects what GA4 collects
• Work with your legal and compliance teams (yes, actually loop them in)

Is this annoying? Absolutely. Is it necessary? Ask USC, Michigan State, or any institution that's dealt with a privacy lawsuit. The answer is yes.

Mistake #4: Double Tracking Is Making Your Data Worthless

Quick test: Open your website, view the page source, and search for "gtag" or "analytics." How many times does it appear? If the answer is more than once, you have a problem.

The Problem: During the Universal Analytics to GA4 migration, many institutions accidentally left their old UA code in place and added GA4 tracking. Or they have both GTM and hardcoded GA4 tags. The result? Every pageview and event gets counted twice (or more). Your traffic looks amazing until you realize it's fantasy.

The Fix:

• Use Google Tag Assistant or similar browser extensions to identify all tags firing
• Remove legacy Universal Analytics code completely (it stopped collecting data in July 2023 anyway)
• Consolidate all tracking through Google Tag Manager: no hardcoded tags
• Run a test week comparing GA4 data to server logs or another analytics platform to verify accuracy

Mistake #5: Your Campaign Tracking Is Non-Existent

Let me paint a picture: Your admissions team just spent $50,000 on a digital advertising campaign targeting prospective graduate students. They want to know which ads drove applications. You open GA4 and… everything is labeled "(direct)" or "(none)." Congratulations, you just wasted $50,000 with zero attribution.

The Problem: Without proper UTM parameters and campaign tracking, GA4 can't tell you which marketing efforts are actually working. For institutions spending six or seven figures on digital marketing, this is inexcusable.

The Fix:

• Create a UTM parameter naming convention (and actually document it)
• Use a URL builder tool for every marketing link: emails, social posts, paid ads, everything
• Set up default channel groupings in GA4 that match your institution's campaigns
• Apply filters to exclude spam referral traffic (you know the ones: semalt, buttons-for-website, etc.)
• Train everyone who creates marketing content on proper campaign tagging

Bonus: Create a shared spreadsheet where all teams log their campaign URLs. This creates an audit trail and prevents the "I don't know who created that link" problem.

Mistake #6: You're Not Collecting Demographic Data (The Actual Useful Kind)

GA4 can tell you age and gender based on Google's data. Cool. But can it tell you if visitors are prospective undergrads vs. graduate students? Parents vs. students? Alumni vs. community members? Probably not, because you haven't configured it to.

The Problem: Higher ed audiences aren't monolithic, but default GA4 treats everyone the same. Without custom dimensions and events tracking the audiences that matter to your institution, your data is generic and unhelpful.

The Fix:

• Enable Google signals and demographic data collection (Admin → Data Settings → Data Collection)
• Create custom dimensions for audience segments that matter: visitor type, program interest, student status
• Implement form tracking to capture what programs users are researching
• Use scroll depth and engagement metrics to identify serious prospects vs. casual browsers
• Build audiences in GA4 based on behavior, not just demographics

The goal isn't just to know who is visiting: it's to understand intent.

Mistake #7: You Set It and Forgot It

Here's the big one: GA4 isn't a "set it and forget it" tool. Your institution changes. Your programs change. Your website changes. Your marketing strategy changes. If your GA4 configuration hasn't been reviewed in six months (or longer), it's stale.

The Problem: Configuration drift is silent and deadly. Tags break. Events stop firing. Filters become outdated. New pages launch without tracking. By the time you notice, you've lost months of data.

The Fix:

• Schedule quarterly GA4 audits: put them on the calendar now
• Validate data against other sources (CRM data, server logs, marketing platform data)
• Monitor engagement metrics and watch for sudden drops or spikes
• Keep a changelog of all GA4 configuration updates
• Test major website updates in a staging environment before they go live
• Review your measurement plan annually and update it based on institutional goals

Think of GA4 maintenance like website updates: if you're not doing it regularly, something's broken and you just don't know it yet.

What's Your Next Step?

Look, I know this list is overwhelming. You're probably thinking, "I don't have time to fix all of this." And you're right: you probably don't have time to fix it all this week.

But here's what you can do: Pick one mistake from this list and fix it this month. Just one.

Start with whichever problem is causing the most pain right now. Is your attribution completely broken? Fix campaign tracking (Mistake #5). Getting nervous emails from legal? Tackle compliance (Mistake #3). Not sure if your data is even accurate? Run a tracking code audit (Mistake #1).

The institutions that have reliable, actionable analytics aren't the ones with perfect setups. They're the ones who consistently chip away at technical debt and treat their GA4 implementation like the strategic asset it is.

Want help prioritizing where to start? Reach out: this is exactly the kind of problem Sanford Consulting solves for higher ed institutions every day.

Because at the end of the day, you can't optimize what you can't measure. And you can't measure what you haven't properly configured.