How to Audit Your Tracking Setup (Checklist for E-Commerce)

Why you need a tracking audit

A tracking audit compares what your ad platforms report with what actually happened in your store. If there's a gap — and there almost always is — you're making budget decisions on incomplete data.

Most e-commerce brands set up tracking once and never verify it again. But tracking breaks silently. Site redesigns, CMS updates, new plugins, GTM container changes, and ad platform policy updates can all introduce issues that go unnoticed for months.

The result: campaigns that look unprofitable are actually your best performers, and you're cutting them based on wrong numbers. A quarterly tracking audit catches these problems before they cost you real money.

---

Before you start: tools you need

Time required: 2-3 hours for a thorough audit of a standard e-commerce setup.

---

The 20-point tracking audit checklist

Section 1: Pixel health (Points 1-5)

1. Pixel fires on every page

What to check: Open your site in an incognito window with Meta Pixel Helper enabled. Navigate through the full customer journey: homepage, product page, collection page, cart, checkout, and purchase confirmation.

Pass criteria: The pixel fires a PageView event on every page load without errors.

Common failures:

• Pixel loads on some pages but not others (common after theme changes)
• Multiple pixel IDs firing on the same page (double-counting)
• Pixel fires but reports errors in the Pixel Helper console

Severity: Critical — if the pixel doesn't fire, conversions are invisible.

2. Standard events fire correctly

What to check: Complete a test purchase and verify that each standard event fires at the correct step.

Pass criteria: Each event fires exactly once at the correct step, with correct parameters.

Common failures:

• Events fire on page load instead of user action (premature firing)
• Purchase fires on every checkout page load, not just successful orders
• Events missing value and currency parameters

Severity: Critical — incorrect events corrupt your ad optimization.

3. Event parameters are complete

What to check: Click into each event in Facebook Events Manager and verify the parameters are populated.

Required parameters for Purchase:

• value (order total, not including tax/shipping unless consistent)
• currency (USD, EUR, etc.)
• content_ids or contents (product IDs)
• content_type (product)
• num_items (quantity)

Pass criteria: All required parameters are present and contain correct values.

Common failures:

• value is 0 or undefined
• currency is missing (Facebook defaults to USD, causing issues for non-US stores)
• content_ids empty (breaks dynamic product ads)

Severity: High — missing parameters degrade ad optimization and prevent dynamic remarketing.

4. No duplicate pixel installations

What to check: Open browser DevTools (F12), go to the Network tab, and filter by facebook.com/tr. Count how many unique pixel IDs fire per page load.

Pass criteria: Only one pixel ID fires per ad account on each page.

Common failures:

• Both Shopify's native pixel and a GTM-installed pixel fire simultaneously
• Multiple pixel IDs from different ad accounts fire on the same page
• A pixel from a previous agency or developer is still active

Severity: Critical — duplicate pixels cause double-counted conversions and inflated reporting.

5. Google Tags and GA4 configuration

What to check: Use Google Tag Assistant to verify your Google tag fires correctly. Check GA4 DebugView for real-time event validation.

Verify:

• Google tag loads on all pages
• GA4 enhanced measurement is enabled (page views, scrolls)
• E-commerce events (view_item, add_to_cart, begin_checkout, purchase) fire with correct parameters
• GA4 is linked to Google Ads for conversion import

Severity: High — broken Google tracking means Google Ads can't optimize your campaigns.

---

Section 2: Server-side event delivery (Points 6-10)

6. Server events appear in Events Manager

What to check: In Facebook Events Manager, filter events by "Server" connection method. Verify that server-side events appear alongside browser events.

Pass criteria: You see events marked as "Server" with recent activity.

If you don't see server events: Your server-side tracking (CAPI) is not set up or not delivering. This means you're relying entirely on the browser pixel, and you're missing 15-30% of conversions. Read our server-side tracking guide to understand why this matters.

Severity: Critical — no server events means maximum data loss.

7. Server events have complete parameters

What to check: Click into a server-side event in Events Manager and verify the match keys are present.

Key match parameters:

• em (hashed email)
• ph (hashed phone number)
• fn (hashed first name)
• ln (hashed last name)
• ct (hashed city)
• st (hashed state)
• zp (hashed zip code)
• country (hashed country code)
• fbc (Facebook click ID)
• fbp (Facebook browser ID)

Pass criteria: At minimum, em and fbc/fbp are present on most events. More match keys = higher EMQ.

Severity: High — missing match keys reduce your Event Match Quality score, which directly impacts ad targeting.

8. Event delivery latency

What to check: Compare the timestamp of a server event in Events Manager with when the conversion actually happened in your backend.

Pass criteria: Server events arrive within 1-5 minutes of the conversion.

Warning signs:

• Events delayed by more than 1 hour (reduces attribution accuracy)
• Events delayed by more than 24 hours (may fall outside attribution windows)
• Batch processing causing all events to arrive at once instead of real-time

Severity: Medium — delayed events still count but may miss attribution windows.

9. Server-side tracking covers all platforms

What to check: Verify that server events are flowing to every ad platform you use.

Pass criteria: Each platform shows recent server-side events.

Severity: High — if you're only sending server events to Meta but not Google, you're losing Google Ads optimization data.

10. Custom domain / first-party tracking

What to check: Verify that your server-side tracking runs through a subdomain on your own domain (e.g., data.yourstore.com) rather than a third-party domain.

Why it matters: First-party tracking domains:

• Are not blocked by ad blockers
• Set first-party cookies that last longer
• Improve data collection reliability

Pass criteria: Your tracking endpoint resolves to a subdomain of your store's domain.

Severity: High — third-party tracking domains are blocked by many browsers and ad blockers.

---

Section 3: Event deduplication (Points 11-13)

11. Deduplication is active

What to check: In Facebook Events Manager, look at the deduplication status for events that arrive from both browser and server.

Pass criteria: Events manager shows "Deduplicated" status, and the combined event count roughly matches your backend orders (not double).

How to test: Complete a test purchase and check if you see one Purchase event with both "Browser" and "Server" connection methods, or two separate events. If you see two separate events that aren't deduplicated, you're double-counting.

Common failures:

• No event_id parameter on browser or server events
• Mismatched event_id values between browser and server
• event_name doesn't match exactly between browser and server (Purchase vs purchase)

Severity: Critical — double-counted conversions inflate your reported numbers and mislead ad optimization.

Read our detailed guide: Event Deduplication: Why It Matters.

12. Revenue values match

What to check: Compare the total revenue reported by the browser pixel with the total revenue from server events. They should be close to identical for deduplicated events.

Pass criteria: Revenue values for the same order match between browser and server events (within currency rounding).

Common failures:

• Browser pixel reports subtotal, server reports total including tax/shipping
• Different currency handling between sources
• Server event reports revenue as 0 due to a data mapping error

Severity: High — mismatched revenue means your ROAS calculations are wrong in both directions.

13. No over-counting in ad platform

What to check: Compare total conversions in Facebook Ads Manager for a given period with total orders in your backend for the same period.

Pass criteria: Facebook conversions should be close to or slightly below your backend orders attributed to Facebook (accounting for attribution model differences). If Facebook shows more conversions than your backend, you have a duplication problem.

Severity: Critical — over-counting means you're over-valuing campaigns and overspending.

---

Section 4: Event Match Quality and data quality (Points 14-17)

14. EMQ scores above 7

What to check: In Facebook Events Manager, check the Event Match Quality score for each conversion event (Purchase, Lead, InitiateCheckout, etc.).

Pass criteria: All conversion events score 7 or above.

How to improve: Read our comprehensive EMQ guide.

Severity: High — EMQ directly affects how well Facebook can match your events to real users, which directly impacts your ad costs.

15. Bot traffic percentage

What to check: If your tracking platform provides bot filtering data, check what percentage of events are identified as bots.

Typical ranges:

• 5-10% bot traffic: Normal for most sites
• 10-20% bot traffic: Above average, review your traffic sources
• 20%+ bot traffic: Investigate — possible ad fraud or crawler issues

If your platform doesn't filter bots: You may be sending crawler, scraper, and bot events to your ad platforms, which pollutes your optimization data. Learn more about how bot traffic wastes ad spend.

Severity: Medium — bot traffic degrades ad optimization over time but isn't an immediate crisis.

16. Consent Mode v2 compliance

What to check: Verify that your consent management platform (CMP) correctly signals consent state to Google and Meta.

Required consent signals for Google:

• ad_storage
• analytics_storage
• ad_user_data
• ad_personalization

Pass criteria: When a user declines consent, Google receives denied signals and uses conversion modeling. When a user accepts, full tracking activates.

Severity: High for EU traffic — non-compliance risks both legal issues and data quality problems. Read our Consent Mode v2 guide.

17. UTM parameters preserved

What to check: Click a test ad and verify that UTM parameters (utm_source, utm_medium, utm_campaign) and click IDs (fbclid, gclid, ttclid) arrive intact on your landing page and persist through to conversion.

Common failures:

• Redirect chains strip UTM parameters
• JavaScript-based routing loses query string parameters
• Click IDs are blocked by consent banners before they can be captured
• Cross-domain tracking loses parameters when visitors move between subdomains

Severity: Medium — lost UTM parameters reduce attribution accuracy but don't prevent event delivery.

---

Section 5: Revenue reconciliation (Points 18-20)

18. Weekly conversion comparison

What to do: Every week, compare conversions reported by each ad platform with your actual backend data.

Template:

Pass criteria: The gap should be consistent and explainable. A 10-15% underreport from ad platforms is normal (attribution model differences). A sudden change in the gap signals a tracking issue.

Severity: High — this is the single most important check for catching tracking problems early.

19. Revenue accuracy verification

What to check: Take 5-10 random orders from your backend and verify the revenue values match what was reported to ad platforms.

Pass criteria: Revenue values match within currency rounding tolerance.

Common failures:

• Tax included in one source but not the other
• Shipping costs handled differently
• Refunds processed in backend but not sent to ad platforms
• Currency conversion errors for international stores

Severity: High — incorrect revenue means your ROAS and revenue attribution are wrong.

20. Attribution window alignment

What to check: Ensure your attribution window settings match across platforms and align with your business model.

Pass criteria: All platforms use consistent attribution windows, and you understand how window settings affect reported numbers.

Severity: Medium — misaligned windows cause confusion rather than data loss.

---

Audit schedule and maintenance

Set calendar reminders. Tracking breaks silently — the only way to catch issues is through systematic monitoring.

---

What to do when you find issues

Priority framework

Most common fixes

1. Missing server events: Set up server-side tracking (CAPI + Enhanced Conversions)
2. Low EMQ scores: Enrich events with hashed email and phone via server-side delivery
3. Duplicate events: Implement event_id based deduplication
4. Revenue mismatches: Standardize how you calculate order value (with/without tax, shipping)
5. Bot pollution: Enable bot filtering before events reach ad platforms

---

FAQ

How often should I audit my tracking?

Run the weekly checks (conversion comparison, revenue spot-check) every Monday. Do a full 20-point audit quarterly or after any major site change.

Can I automate any of this?

Yes. Tools like SignalBridge provide automatic tracking health monitoring with alerts when event volumes drop, EMQ scores change, or delivery issues occur — catching many of these problems automatically.

What's the most common issue you see?

The conversion gap between ad platform reporting and backend data (Point 18). Almost every store has a 15-30% gap they don't know about. It's also the most impactful issue because it directly affects every budget decision.

Do I need a developer for this audit?

No. All 20 checks can be performed using free browser tools (Events Manager, GA4 DebugView, DevTools, Pixel Helper) and your e-commerce admin panel. No code changes needed for the audit itself — only for fixing issues you discover.

What if my tracking looks fine but conversions are still off?

Check your attribution model settings. A common issue is comparing 7-day click conversions in Ads Manager with total orders in your backend without filtering for Facebook-attributed traffic. The gap might be an attribution model difference, not a tracking failure.