Key takeaways
- Create a GA4 property and data stream, install via Google Tag Manager, then wire in Consent Mode v2 so UK sites stay PECR and GDPR compliant.
- For UK websites the consent layer is not optional: get consent before analytics cookies fire, and connect Consent Mode v2.
- Use one install method only (GTM recommended) to avoid double-counting, and set the UK time zone and GBP currency on day one.
- Mark your key events, filter internal traffic, link Search Console and Ads, and extend data retention to 14 months.
Before you start
Get five things ready and the setup goes quickly. Skip them and you will be tab-hopping halfway through.
- A Google account you are happy to keep long term (use a business email, not a personal one that might leave with a staff member).
- Access to your website, either the code, the CMS admin, or whoever holds it.
- A Google Tag Manager (GTM) account, which is the install method we recommend below.
- A consent management platform (CMP), or a plan to add one, because UK sites need a proper consent banner.
- A short list of what success looks like: enquiries, calls, bookings, purchases, sign-ups. You will turn these into key events later.
One more thing first. If your site is slow, has crawl problems, or is mid-migration, your analytics will only ever be as trustworthy as the site underneath it. A quick technical SEO audit flags anything that would otherwise muddy your data before you start relying on it.
Step 1: Create your GA4 property and data stream (UK time zone, GBP currency)
Create a property in Google Analytics, set the reporting time zone to the United Kingdom and the currency to British Pound, then add a web data stream to generate your Measurement ID. The time zone and currency choices matter more than they look, so get them right on day one.
- Go to analytics.google.com and open Admin (the gear icon, bottom left).
- In the Property column, click Create property and give it a clear name (your domain is fine).
- Set the reporting time zone to
(GMT+00:00) United Kingdomand the currency toBritish Pound (GBP £). This is the step people leave on the US defaults by accident. - Add your business details and objectives when prompted.
- In the Property column, open Data Streams, click Add stream, and choose Web. Enter your website URL and a stream name.
- Leave Enhanced Measurement on for now. In Stream details, copy the Measurement ID (it starts with
G-). You will need it in the next step.
Why the UK settings matter: the reporting time zone decides where each day starts and ends, so “today” lines up with your trading day rather than California’s, and the currency setting means revenue shows in pounds, not dollars. Google does not backfill either if you change them later, and switching time zone mid-life leaves a visible seam in your data, so it is a get-it-right-first-time decision. Google’s own setup documentation covers the property and stream flow in full if you want to follow along (Google Analytics Help, Set up Analytics for a website and/or app).
Step 2: Install the Google tag (three ways)
There are three ways to get the Google tag on your site: Google Tag Manager, a CMS plugin, or pasting the gtag.js snippet by hand. We recommend Google Tag Manager for almost everyone, because it keeps every tag and your consent setup in one place.
Option A: Google Tag Manager (recommended)
The cleanest way to install GA4 with Google Tag Manager is to create one Google tag in a GTM container and let it handle everything else later.
- Create a GTM account and a web container, and add the container snippet to your site’s
<head>and<body>(most CMS platforms have a field or plugin for this). - In GTM, create a new tag using the Google Tag template and paste in your
G-Measurement ID. - Set the trigger to Initialisation, All Pages so it loads early.
- Use Preview to check it fires, then Submit to publish.
The payoff is that when you later add conversion tracking, remarketing, or a new tool, you do it in GTM without touching site code, and your consent rules apply to all of it at once.
Option B: CMS plugin
If you would rather not use GTM, most platforms have an official route. On WordPress, Google’s own Site Kit plugin connects GA4 in a few clicks. Shopify connects GA4 through its Google sales channel. Wix, Squarespace, and Webflow all have a field for a Measurement ID or a Google tag. The one rule: pick a single method. If a plugin adds the tag and someone also hardcodes it, you will count everything twice.
Option C: gtag.js (paste into the head)
For a simple static site, you can copy the gtag.js snippet from your web stream and paste it into the <head> of every page. It works, but it is the hardest to manage over time, because every future change means editing site code again. Fine for a brochure site, limiting for anything that will grow.
Step 3: Consent Mode v2 (the UK requirement)
For UK websites, you must get consent before non-essential analytics cookies are set, and you should connect Consent Mode v2 so Google’s tags respect that choice. This is the biggest thing separating a compliant GA4 setup from a risky one, and the part most tutorials skip. Treat it as required, not a nice-to-have.
Why UK sites need this: PECR, UK GDPR and the ICO
The Privacy and Electronic Communications Regulations (PECR) require consent before you store or read non-essential information on a user’s device, and analytics cookies count as non-essential. The Data (Use and Access) Act 2025, whose data protection provisions came into force on 5 February 2026, added a narrow exception for “statistical purposes”, and the ICO finalised its guidance on storage and access technologies on 29 April 2026 to explain how it all fits together.
The catch is how narrow that statistical exception really is. Per the ICO, it covers aggregate statistics used to improve your own service, and it does not stretch to user-level tracking, advertising measurement or attribution, profiling or segmentation, or cross-site tracking. GA4 works at user level, so in practice most UK sites still need consent before it runs. You can read the ICO’s position in full in its guidance on the use of storage and access technologies.
Whatever banner you use, valid consent has to be freely given, specific, informed, and unambiguous. That means no pre-ticked boxes, no cookies set before the user chooses, granular options (analytics separate from advertising), and rejecting made as easy as accepting.
Separately, Google requires Consent Mode v2 for traffic from the UK and the EEA, and has done since March 2024, under its EU user consent policy. Without it, your Google Ads and GA4 audiences and conversion data from UK and EEA visitors degrade. The four consent signals Google expects are ad_storage, analytics_storage, ad_user_data, and ad_personalization (Google, EU user consent policy).
Basic versus advanced consent mode
Consent Mode v2 comes in two flavours, and the choice is a genuine trade-off.
- Basic: Google tags stay blocked until the user consents. Nothing fires before opt-in, which is the simplest story to tell under PECR, but you collect nothing at all from people who decline, so your reports show gaps.
- Advanced: tags load with consent defaulted to denied and send cookieless pings when a user has not consented. No cookies and no personal identifiers are stored, and Google uses those signals plus modelling to estimate the gaps, so your data is more complete.
Google leans towards advanced because of the modelling (Google Analytics Help, Consent mode). Many UK teams are comfortable with it because the pre-consent pings are cookieless by design, but this is a legal judgement as much as a technical one, so get sign-off from whoever owns compliance first. If in doubt, start basic and move to advanced later.
How to wire it in with Google Tag Manager
Here is the sequence we use. The exact clicks vary slightly by CMP, but the order does not.
- Choose a Google-certified CMP. It has to be one Google recognises. Common options include Cookiebot, CookieYes, and similar tools; the important bit is the certification, not the brand.
- Configure the banner with granular categories, opt-in behaviour, no cookies before consent, and reject as easy as accept.
- Turn on consent controls in GTM. In your container settings, enable the consent overview so you can see which tags respect consent, then install your CMP’s GTM template.
- Set the default consent state to denied for all four signals (
ad_storage,analytics_storage,ad_user_data,ad_personalization), firing on Consent Initialisation so it runs before any other tag. - Let the CMP update the state when the visitor makes a choice, granting or keeping each signal denied.
- Confirm your Google tag honours consent. The GA4 and Google tags have built-in consent checks and will respect
analytics_storageautomatically once the signals are flowing.
Google’s developer documentation is the reference to keep open while you do this (Google for Developers, Consent mode). Test it properly before you call it done, which is Step 7.
Step 4: Review Enhanced Measurement
Enhanced Measurement is on by default and automatically tracks page views, scrolls, outbound clicks, site search, video engagement, file downloads, and form interactions, with no extra tagging. Open your web stream, click the gear next to Enhanced Measurement, and switch off anything that does not apply. If you have no on-site search, turn off site search so it stops logging noise. Enhanced Measurement respects your consent settings too, so it will not fire ahead of an opt-in when Consent Mode is wired in correctly.
Step 5: Mark key events (your conversions) and add custom definitions
In GA4, “key events” are what used to be called conversions, and marking them is how you tell Analytics which actions matter. Nothing is a conversion until you say so.
- In Admin, open Events, and check the actions you care about are being collected (for example
form_submit,generate_lead,purchase, or a click on a phone number). - Toggle Mark as key event for each one that represents a real business outcome.
- Use Custom definitions (custom dimensions and metrics) to capture extra context you want in reports, such as a form name, a plan type, or a location.
Key events tell you what is happening on the website. To connect that to your ad spend and see which campaigns actually drive enquiries and sales, you then need to set up conversion tracking in Google Ads and GA4 together. That is a job of its own, and worth doing properly, because a mis-fired conversion quietly wastes budget for months.
Step 6: Filter internal traffic, link Search Console and Ads, extend retention
Three quick configuration jobs turn a raw install into something you can trust: filter out your own traffic, connect your other Google tools, and extend how long GA4 keeps your data.
Filter internal traffic (a Leicester office example)
Filtering internal traffic stops your own team’s visits inflating the numbers. Picture a small Leicester agency where everyone works from one office on the same broadband connection. Every time the team checks the site, GA4 logs it, and those repeat visits quietly pump up sessions while wrecking engagement and conversion rates. (This is a composite example, but it is one of the most common distortions we find.) Filtering it out is straightforward:
- In Admin, open your web data stream, then Configure tag settings and Show all.
- Choose Define internal traffic and create a rule that sets
traffic_typetointernalfor your office IP address or ranges. - Back in Admin, open Data filters. GA4 creates an Internal Traffic filter but leaves it in Testing by default. Switch it to Active, or it does nothing.
That last line is the gotcha. Plenty of sites define the rule, feel done, and never activate the filter, so the office traffic keeps flowing in.
Link Google Search Console and Google Ads
In Admin, open Product links and connect Search Console and Google Ads. Search Console brings your organic search queries and landing-page data into GA4, and the Ads link lets you share audiences and conversions between the two. Both take a couple of minutes and both are easy to forget.
Extend data retention to 14 months
GA4 keeps event and user data for just 2 months by default, which is the setting that surprises people when their year-on-year exploration comes up empty. In Admin, under data collection and modification, open Data retention and change Event data retention to 14 months, the maximum on the free version. This affects explorations and funnels rather than the standard aggregated reports, but you want the history, so change it now (Google Analytics Help, Data retention).
Step 7: Verify it works (DebugView and Realtime)
Never trust a tag you have not tested. Before you rely on a single number, confirm data is flowing and consent is behaving.
- GTM Preview and Tag Assistant: load your site through Preview and check the Google tag fires and the consent state reads as expected.
- DebugView: in Admin, open DebugView to watch events arrive in real time as you click around.
- Realtime report: visit your own site and confirm you appear (before your internal filter is active, or from a different network).
- Test consent directly: reject cookies on your banner and confirm GA4 does not set analytics cookies. On advanced consent mode, confirm cookieless pings are sent instead.
- Give it 24 to 48 hours: standard reports take a day or so to populate fully, so do not panic at empty tables on day one.
If you would rather not sit in DebugView yourself, this whole build is exactly what our analytics and measurement setup work covers, consent layer included.
Common mistakes we see
Most GA4 setups we are asked to fix share the same handful of errors. None are exotic. They are just the things that get missed when setup is rushed.
- Double counting. A plugin, a GTM tag, and a hardcoded snippet all firing at once, so every session is counted two or three times and every metric is wrong.
- No consent gate. The banner is decorative and GA4 fires before anyone opts in, which is a PECR problem, not a cosmetic one.
- The internal filter left in Testing. The rule exists, the filter is defined, but it was never switched to Active, so office traffic keeps skewing the data.
- US defaults left in place. Reporting time zone on Pacific time and currency in dollars, so “yesterday” is wrong and revenue is in the wrong denomination.
- Retention left at 2 months. Six months later, there is no history to explore.
- No key events marked. GA4 is collecting data but reporting zero conversions, because nothing was ever flagged as one.
- Consent Mode v2 missing entirely. UK and EEA audiences and conversion data degrade in Google Ads, and no one notices until performance dips.
- Cross-domain tracking not set. Visitors who move between a main site and a booking or checkout subdomain get counted as two people on two sessions.
These are not edge cases. They are the norm, which is the whole reason we lead with consent and verification rather than tacking them on at the end.
Get your GA4 set up properly, once
A clean GA4 install is the foundation for everything else: knowing which channels bring enquiries, which pages convert, and where your budget is working. Done right, with the consent layer in place, it is the thing that lets you turn data into growth instead of guessing.
If you would rather have it built and checked for you, we are a Leicester-based creative and growth agency and we do this for UK businesses week in, week out, consent and all. Book a free growth review and we will look at your current setup, flag what is off, and tell you exactly what to fix.