The 21 things every agency must track per client (the master checklist)
Every digital agency tracks tracking. Most do it in a Google Sheet that goes stale by week three. This is the 21-item checklist we use as the per-client minimum — what each item is, why it matters, and how to verify it.
TL;DR
Twenty-one things every digital marketing agency client should have documented, owned, and health-checked: 4 analytics nodes (GA4 property, GA4 data stream, GA4 custom dimensions, GA4 audiences), 2 tag-management nodes (GTM web container, server-side container if applicable), 8 ad-platform nodes (Google Ads account + conversion actions, Meta dataset + pixel + CAPI, TikTok pixel + events API, LinkedIn Insight tag, Microsoft UET), 3 commerce/email nodes (Shopify/Klaviyo/email platform), and 4 governance items (cookie consent, attribution model, audience syncs, conversion-action audit cadence). Below: each item with a one-paragraph definition, why agencies miss it, and how to verify it's working.
Most agencies "track tracking" in a Google Sheet that gets created in week one of a new engagement and is materially out of date by week three. The sheet has columns for tag IDs, owners, and "is it working?" — but the sheet itself doesn't know whether anything's actually firing. The list of things that should be in that sheet is also under-specified at most agencies: every team has a slightly different definition of "the things we track per client."
This is our 21-item checklist. We use it as the minimum every client gets documented within the first week and re-verified monthly. It's the input to whatever you put in your operations record (spreadsheet, tracking infrastructure map, wiki page) — but the checklist itself is what determines whether you're tracking everything you should be.
The 21 items
Analytics layer (4)
1. GA4 property. The container for every event the client cares about. Should have: property ID documented, billing-relationship documented (who pays Google, who has admin), data retention setting verified (default is 2 months — almost always wrong; set to 14 months minimum). Most agencies don't track property-level access lists; they should — every off-boarded contractor with admin is a security gap.
2. GA4 data stream(s). Each property has at least one data stream (web). If the client has a mobile app, there's a Firebase data stream too. Document: measurement ID per stream, internal-traffic exclusion rules (your office IPs, the client's office IPs, your testing tools), enhanced-measurement settings (which auto-events are on).
3. GA4 custom dimensions + metrics. Most agencies set up GA4 with default events only and never add custom dimensions. That works for "how much traffic" but breaks for "how much traffic from our weekly newsletter sequence" or "what's the LTV of a high-AOV cohort." Document every custom dimension + metric registered, what it maps to, and which reports use it.
4. GA4 audiences. Audiences feed downstream into Google Ads (for retargeting), Meta (via GA4-to-Ads sync if configured), and any other downstream platform. Document each audience's definition + which downstream platform consumes it. Audiences with no downstream consumer are dead — audit them quarterly.
Tag management layer (2)
5. GTM web container. Container ID, install method (gtm.js + dataLayer correctly placed in <head>), publish history (when was the last meaningful change, by whom). Per the GTM container audit checklist — most inherited containers have 30%+ dead tags by line count.
6. Server-side GTM container (if applicable). Not every client has one and many shouldn't (see server-side tracking: when to bother). When it does exist, document: container ID, hosting (Stape, Cloud Run, custom), domain it's served from (metrics.client.com or similar), which tags fan out from it.
Paid media layer (8)
7. Google Ads account. Account ID, MCC parent (if you manage multiple agency-side), billing relationship, current account-level spend cap (if any), account currency. The currency item matters more than agencies remember — a USD client whose Google Ads account is set to CAD generates conversion values that are 35% off in dashboards.
8. Google Ads conversion actions. This is where the most silent damage happens. Document EACH conversion action: name, source (imported from GA4 vs. tag-fired vs. offline upload), counting setting (one vs. every), attribution model, lookback window, primary vs. secondary. Per GA4 vs Google Ads conversions — mismatches across these dimensions are why dashboard numbers don't match.
9. Meta Business Manager + ad accounts. Business ID, all ad accounts under it, billing relationship, Meta business verification status (pre-verified accounts get higher iOS attribution windows). Document the Page-Pixel-AdAccount triangle for each property (Meta requires all three to be linked correctly for ads to fire against pixel events).
10. Meta dataset (formerly "pixel"). Dataset ID, install method (GTM tag vs. direct script), match-quality score (above 7 is healthy; below 5 needs investigation), event list (Purchase, Lead, AddToCart, etc.) with which firing path each uses (Pixel only, CAPI only, both with deduplication).
11. Meta CAPI endpoint. When dataset has CAPI: document the server endpoint, authentication mechanism (access token rotation cadence), event ID generation strategy (must match Pixel side per Meta Pixel + CAPI without double-counting), test_event_code for verification.
12. TikTok Ads account + pixel. Ad account ID, pixel ID, Events API status (V2 of TikTok Ads expects Events API alongside the Pixel for iOS attribution to work; pixel-only setups are increasingly broken). Match quality score where available.
13. LinkedIn Insight Tag. Tag ID, install method, conversion-action mapping. LinkedIn is the easiest paid platform to forget — "just put the tag in GTM" is what most agencies do, then never check that conversions are firing. Insight tag conversions in LinkedIn's UI lag actual events by 24-72h, so the dashboard often looks empty when it isn't.
14. Microsoft UET tag. Bing/Microsoft Ads' equivalent of the Google Ads tag. UET ID, install method, conversion goals defined. Microsoft Ads is the underrated channel for B2B + healthcare; the UET tag is also the underrated tag — easy to miss in audits because Microsoft generates a tiny fraction of total spend for most agencies.
Commerce + email layer (3)
15. Shopify pixel + integrations. If the client is Shopify, the storefront pixel is the canonical event source. Document: store URL, plan (Plus has different pixel capabilities), customer-event integrations (Shopify Customer Events API connections to GA4, Meta, etc.), Shopify analytics opt-in state.
16. Klaviyo (or other ESP) data flow. Email platform data flows are tracking-adjacent — they're how email metrics get back into GA4, how audiences sync to Meta from segments, how flow-triggered conversions get attributed. Document: list IDs, segment-to-audience syncs, integration with Shopify/GA4/Meta.
17. Other ecommerce / commerce integrations. WooCommerce, BigCommerce, custom checkout, Shopify Plus B2B, headless setups all have their own pixel + event quirks. Document the source of truth for each conversion (which system fires the canonical event for a "purchase").
Governance layer (4)
18. Cookie consent / Consent Mode setup. Cookie banner provider (OneTrust, Cookiebot, Iubenda, custom), Consent Mode version (v1, v2, none), regional behavior (does consent UI vary by region — EU vs. US), and which tags actually respect the consent state. We've seen agencies spend $40K/year on a consent platform whose state was never wired through to GTM. See SEO-PLAN.md §11 for why this matters in 2026.
19. Attribution model decisions. Each platform's chosen attribution model (data-driven, last-click, position-based, custom) and lookback windows. Document the agreed model per platform AND when it changes. Attribution-model changes aren't deploys — there's no log entry — so they get forgotten. A surprise attribution-model shift can move a client's reported conversions by 30%+ overnight.
20. Audience syncs (cross-platform). Which audiences flow from GA4 → Google Ads, from Klaviyo → Meta, from Customer Match files → various platforms. Document the source of truth for each audience and the sync cadence. Sync failures are the second-most common silent breakage after parameter mismatches in pixel events.
21. Conversion-action audit cadence. Not a tracking object itself — a process item. Document: who runs the monthly conversion-action review, when, what they check (per the 4-layer verification stack). Without a recurring discipline, all 20 items above decay.
How to actually use the checklist
Three patterns work:
1. The Google Sheet. Twenty-one rows, columns for owner, status (working/broken/missing/unverified), last verified, notes. The cheap version. Decays by month 3.
2. The Notion database. Twenty-one entries with linked relations to projects, owners, last-verified rollups, filtered views per status. Survives longer than the sheet but lacks health-state automation.
3. The typed tracking infrastructure map. Each item is a typed node in a per-client graph; relationships between items (the GTM container fires the Meta pixel which feeds the Meta dataset) are first-class edges; health state and last-verified timestamps are columns; filters across all clients ("show me every Meta dataset with match quality below 5") are one click. This is what we built Phloz to do.
The checklist works in any of the three formats. The discipline is what matters: 21 items, every client, weekly verification, escalation when anything goes red.
What "complete" looks like
A client engagement is properly set up on tracking when:
- All 21 items have an entry (or an explicit "n/a — this client doesn't use TikTok" note)
- Each entry has an owner, a status, and a last-verified timestamp
- The owner is reachable and has admin on the source platform
- There's a recurring monthly review on the calendar
- New campaigns/properties get added to the checklist as they launch
If you can answer "what are we tracking for this client?" in 30 seconds with a single document open, you're set up correctly. If the answer involves logging into 8 different platforms and asking around, you're not.
The takeaway
Twenty-one items. Most agencies have 8-12 of them documented and 5-7 verified at any given time. The gap between "documented" and "verified" is where ROAS quietly bleeds. Run through the checklist on every new client in week one, re-verify monthly, escalate the gaps. The discipline is what keeps tracking honest — not the format.
Try Phloz free if you want the checklist as a typed graph rather than a spreadsheet that goes stale.