Tracking Setup for Startups: GA4, UTMs and Events Done Right

1. Blog
2. Measurement & Budget

By Saroj Jha · October 4, 2026 · 13 min read

Decide which questions your tracking must answer before you add a single tag. Then track a short list of events and tag every link the same way. The six steps below show how, with one example company from start to finish.

Most startups install Google Analytics, leave the defaults and discover six months later that they cannot answer basic questions: which channel produced last quarter’s customers, whether the new landing page converts better, why paid traffic shows up as “unassigned”. Fixing tracking later means losing history.

The setup below takes a day or two and holds up as you grow. It uses Google Analytics 4 (GA4), Google’s current analytics product, and UTM parameters: short tags you add to the end of a link so GA4 knows where a visit came from.

Running case: Example Co. Fictional

Example Co. is a seed-stage B2B SaaS startup whose software automates the month-end close for finance teams at companies with 50 to 500 employees. The controller is the champion and daily user; the CFO or VP Finance signs; IT reviews security. The team of eight, including two founders and one account executive, wants 30 new customers in the next 12 months. Deals take about 45 days to close, so a form fill says little about what works. This quarter it is launching a free month-end close checklist, promoted with LinkedIn ads, a newsletter and a partner webinar. Example Co. and all its numbers are illustrative.

Step 1: Start from your questions, then list the events

Start with the decisions tracking has to support. For most startups they are: which channels bring customers, where people drop out of the funnel, and which pages and campaigns work. Then choose events for each step. An event is one action GA4 records, such as a page view or a form submission.

GA4 collects some events automatically and, with enhanced measurement, others such as form starts and submissions^[4]. Beyond those, use Google’s recommended event names where they fit: Google says they produce more useful reports and work with features it adds later. For lead-based businesses, GA4 recommends a set of lead events that follow a lead from creation to close: generate_lead, qualify_lead, disqualify_lead, working_lead, close_convert_lead and close_unconvert_lead^[5].

In practice, a first tracking plan has about ten events: sign-up or form submission, demo request, trial start, activation (the first valuable action in the product), purchase, and the lead-stage events. Write them down in a tracking plan before anyone adds a tag. The Tracking Plan and UTM Builder gives you the template.

Example Co., step 1 Fictional

The team writes three questions. Which channels produce qualified demos and signed contracts? How many checklist readers go on to ask for a demo? Do LinkedIn ads reach controllers, or only clicks? Those questions lead to a plan of eight events. Five of them follow the buyer from first visit to signed contract, shown below; the other three are the remaining lead stages. Example Co. sells through demos, with no free trial, so it has no trial event.

Do this

Write your three to five questions at the top of the tracking plan, and do not add an event that does not help answer one of them.

What Google’s own documentation shows: why the plan should live outside the tool

A written plan matters because tools change. Google’s help page states: “Google Analytics 4 is our next-generation measurement solution, and it has replaced Universal Analytics.” It sets out what happened to the older product. From July 1, 2023, “Standard Universal Analytics properties stopped processing hits.” From the week of July 1, 2024, users lost access to current and historical Universal Analytics data, and Google warns that unless the data was saved through the methods it describes, “your data will be permanently deleted by Google and won’t be recoverable”^[6].

This is what Google’s documentation says, not an account of how any company handled the change. In my view, the lesson is simple: tags and reports tied to one tool can disappear with it. A team with a written list of its events, names and key events can rebuild them in a new tool in days; a team with only tags has to work out what it was tracking.

Do this

Keep the tracking plan in a shared document or sheet, not only inside GA4 or your tag manager.

Step 2: Name events consistently and mark only a few key events

A key event is “an event that measures an action that’s particularly important to the success of your business”^[7]. Key events used to be called conversions; Google’s API documentation records the change in May 2024^[8]. You mark an event as a key event with the star in Admin, under Data display, Events^[9], and a standard property allows up to 30^[10].

Mark only the events that represent business progress: a demo request, a qualified lead, a purchase. Marking every click as a key event makes the reports meaningless.

Name events consistently, and within GA4’s limits. Event names can be up to 40 characters, each event can carry up to 25 parameters (extra details sent with the event, such as the form’s name), and a standard property allows 50 event-scoped custom dimensions^[10],[11]. Parameters only appear in standard reports once you register them as custom dimensions.

In practice: use lowercase with underscores (demo_request, not Demo Request), reuse Google’s recommended names, name events for the action rather than the page, and record every event and parameter in the tracking plan. GA4’s own rules back this up: names must start with a letter, use only letters, numbers and underscores, and are case sensitive, so demo_request and Demo_Request count as two events^[12].

Example Co., step 2 Fictional

Example Co. marks three key events: demo_request, qualify_lead and close_convert_lead. Checklist downloads are tracked with generate_lead but not marked, because a download shows interest, not progress toward a sale. Its longest event name, close_unconvert_lead, is 20 characters, half the limit. It registers two parameters as custom dimensions: form_id, to tell the checklist form from the demo form, and company_size, because its ideal customer has 50 to 500 employees. All choices are fictional.

Do this

Start with three to five key events. Add one only when someone will make a decision from it.

Step 3: Set a UTM convention that matches GA4’s channel rules

Tag every link you control outside your own website: ads, emails, social posts, partner links. Google says you “should always use utm_source, utm_medium, and utm_campaign”, and that parameter values are case sensitive^[13]. “LinkedIn” and “linkedin” show up as two different sources. GA4 also reads utm_id, utm_term, utm_content and utm_source_platform; utm_creative_format and utm_marketing_tactic are not currently reported^[13].

The values you choose decide which channel GA4 assigns the traffic to. For manually tagged links, GA4 counts traffic as paid social only when the source is a recognized social site (such as linkedin or facebook) and the medium matches a paid pattern: cpc, ppc, retargeting, anything containing cp or anything starting with paid. Paid search works the same way with a search engine as the source, email is recognized when the source or medium is email, and organic social uses mediums such as social^[14]. Medium values outside these rules are why traffic ends up “unassigned”. Google’s own definition: “Unassigned is the value Analytics uses when there are no other channel rules that match the event data”^[14].

A subtler mistake does not show up as unassigned at all. Organic social also includes any visit whose source is a recognized social site, so a LinkedIn ad tagged with a medium such as sponsored, which does not match the paid pattern, is counted as organic social. The paid clicks look free.

A simple convention that fits GA4’s rules:

Google Ads tags its own links: auto-tagging is on by default for new accounts, and GA4 gives it priority over any UTMs on the same link^[15], so you don’t need UTMs there. The Tracking Plan and UTM Builder builds tagged links from your convention and keeps a log.

Example Co., step 3 Fictional

Example Co. adopts the convention above. Before launch, it checks its first draft of links against GA4’s rules and finds two problems: the LinkedIn ads were tagged utm_medium=sponsored, and the newsletter links utm_medium=newsletter. The first would have counted paid clicks as Organic Social; the second would have landed in Unassigned. Both are fixed before a single visit is recorded. The links are fictional; the rules are Google’s.

Do this

Fix your list of allowed mediums in writing (for example paid_social, cpc, email, social, referral) and build every link from it.

Free template

Build every tagged link from one list

The free Tracking Plan and UTM Builder keeps your questions, events, key events and allowed mediums in one sheet, builds tagged links from your convention and logs each one, with Example Co.’s plan filled in.

Step 4: Change four settings on day one

Four settings to change before the first campaign:

• Data retention. Standard properties can keep event data and user-level data for 2 or 14 months. Set both to 14. The setting only affects explorations and funnel reports, but those are the ones you will want^[1].
• Cross-domain measurement, if your site, app and checkout sit on different domains, so one visitor isn’t counted as two^[16].
• BigQuery export. Standard properties can export raw event data to BigQuery, up to 1 million events a day for daily export, and can start in the free BigQuery sandbox^[17], where tables expire after 60 days^[18]. With billing enabled, the export keeps your raw events beyond GA4’s retention limit.
• Internal traffic. Exclude your own team’s visits so they don’t inflate results: mark your office IP addresses as internal traffic, then set the internal-traffic data filter to Active. A filter in Testing removes nothing, and an active one removes data for good^[19].

Example Co., step 4 Fictional

Example Co. changes all four settings in the week before launch. Its product runs on a separate app domain from its website, so cross-domain measurement matters: without it, a prospect who moves from the pricing page to the demo booking page in the app would count as two visitors. It starts BigQuery in the sandbox, where tables expire after 60 days, so it switches billing on and updates the expiry before the first tables reach that age. Fictional choices.

Do this

Open Admin today and set both retention settings to 14 months. Data that has already expired is deleted, so a later change cannot bring it back.

Step 5: Set up consent and plan for lost signals

Set up consent before you launch campaigns. This is orientation, not legal advice.

Google consent mode passes the visitor’s choice to Google tags through four settings: ad_storage, analytics_storage, ad_user_data and ad_personalization. In basic mode, tags wait for consent; in advanced mode, tags send limited data without cookies so Google can model conversions^[20]. GA4 makes those estimates only once a property has at least 1,000 consenting daily users on 7 of the previous 28 days and 1,000 events a day from visitors who declined; below that, declined visits are simply not reported^[2]. Google requires consent for users in the European Economic Area, and since early March 2024, audiences for linked advertising products include only users outside the EEA unless consent signals are sent^[21].

• European Union. The EU’s data protection regulators say tracking pixels and tracking information added to links fall under the ePrivacy rule that requires consent unless an exemption applies^[22], and that scrolling or swiping through a page is not valid consent^[23].
• California. Businesses covered by the CCPA must treat opt-out signals such as Global Privacy Control as a request to opt out of the sale or sharing of personal information. The law covers businesses above certain thresholds, such as annual revenue of $26.625 million or more from January 1, 2025^[24].

Do you need server-side tagging? Not at first. Server-side tagging processes data “on a server you control, rather than in the user’s browser”, which gives more control over what is sent to vendors. Google recommends at least two server instances, each costing about $45 a month^[25],[26]. In practice, consider it once you run significant paid media or need tighter control of data sent to ad platforms.

What Apple’s documentation and Meta’s filings show

Consent rules are one reason your numbers will be incomplete. Platform changes are another. Apple’s developer guidance says: “In iOS 14.5, iPadOS 14.5, and tvOS 14.5 or later, you need to receive the user’s permission through the App Tracking Transparency (ATT) framework in order to track them or access their device’s advertising identifier.” Apple defines tracking as “the act of linking user or device data collected from your app with user or device data collected from other companies’ apps, websites, or offline properties for targeted advertising or advertising measurement purposes”^[27].

Meta, one of the largest sellers of ads, described the effect in its annual reports to the SEC. Its 10-K for 2021 says: “In 2021, Apple made certain changes to its products and data use policies in connection with changes to its iOS operating system that reduce our and other iOS developers’ ability to target and measure advertising.” It adds: “our advertising revenue in the second half of 2021 was negatively impacted by marketer reaction to targeting and measurement challenges associated with iOS changes”^[28]. Its 10-K for 2022, after describing Apple’s changes and its own privacy-related product changes, says: “These developments have limited our ability to target and measure the effectiveness of ads on our platform and negatively impacted our advertising revenue”^[29].

These are what the documents say, not an account of how either company made its choices internally. For a startup, I read them this way: the conversions an ad platform reports will be fewer than the ones that happened, and that gap will not close by itself. The answer is data you own: events collected with consent, and CRM stages you send back yourself (Step 6).

Example Co., step 5 Fictional

Example Co. sells mainly in the US but gets visitors from Europe, so it adds a consent banner connected to consent mode before launch and chooses to honor Global Privacy Control signals. With about 150 visitors a day, it is far below the 1,000 consenting daily users GA4 needs before it estimates anything, so visits from people who decline simply go uncounted. It postpones server-side tagging until paid media is a larger share of its budget. When it compares LinkedIn’s reported conversions with its own CRM, it treats the CRM as the record. Fictional choices; not legal advice.

Do this

Set up consent before the first campaign goes live, and decide now which system is your record of truth for leads and customers. For most B2B startups, that is the CRM.

Step 6: Connect website tracking to your CRM

Two connections let you measure pipeline and revenue by source, not only form fills:

• Capture the source on the form. Store UTM values and the Google click ID in hidden form fields, and save them to the lead record in your CRM. This is common practice, not a Google rule.
• Send CRM stages back. GA4’s Measurement Protocol records “server-to-server and offline interactions” such as a lead becoming qualified; Google says it is meant to augment, not replace, tag-based collection^[30]. For Google Ads, enhanced conversions for leads uses hashed customer data to match later outcomes to ad clicks^[31].

POST /mp/collect?1 measurement_id=G-XXXXXXXXXX &api_secret=API_SECRET HTTP/1.1
Host: www.google-analytics.com
Content-Type: application/json

{
  "client_id": 2 "123456.7654321",
  "events": [
    { "name": 3 "qualify_lead" }
  ]
}

The Lead Management Playbook covers the stages to send.

Example Co., step 6 Fictional

Every demo form stores the UTM values and click ID in the CRM. When the account executive marks a lead qualified, and again when a contract is signed, the CRM sends qualify_lead or close_convert_lead to GA4. After one quarter the team can compare channels by qualified demos and signed contracts, not downloads. Suppose LinkedIn ads bring most checklist downloads but the partner webinar brings more qualified demos per visit: that is the kind of answer form fills alone would hide. The numbers and outcome are illustrative.

Do this

Add hidden UTM fields to every form this week, even if you send nothing back to GA4 yet. Sources you do not capture now cannot be added later.

How do I connect website forms to my CRM, step by step?

To connect a startup website to its CRM so every lead keeps its source, capture each visitor’s source when they land, pass it through hidden form fields into the CRM, then send CRM stage changes back to Google Analytics 4 (GA4).

1. Capture the source on arrival. A small script reads the UTM parameters and the Google click ID (gclid) from the page URL. Store first-touch values once and never overwrite them; overwrite last-touch values on every new tagged visit. Store them only where your consent settings allow (general information, not legal advice).
2. Add hidden fields to every form. Include utm_source, utm_medium, utm_campaign, gclid, landing page, first-touch source and the GA4 client ID. Google’s tag API reads the client ID with the get command, for example gtag('get', 'G-XXXXXXXXXX', 'client_id', callback), and can also return session_id ^[32].
3. Map fields to CRM properties. Create a matching property for each hidden field. Set first-touch properties to write only when empty. Copy the source onto the deal when it is created, so you can report pipeline and revenue by source.
4. Send stage changes back. When a lead is qualified or a deal is won, a CRM workflow or small server function (never browser code) sends a Google-recommended lead event such as qualify_lead or close_convert_lead^[5] to GA4’s Measurement Protocol. Google says “the client_id should match the ID generated by the Google Analytics tag on your website”, the measurement ID goes in the request URL, and the API secret “is used to authenticate your requests”^[3]. Events can be backdated only up to 72 hours^[3], so send each event when the stage changes, not in monthly batches. Google plans no deprecation of the protocol but recommends its Data Manager API for new server-to-server integrations^[3]. Figure 7 shows the request.
5. Check it works. Submit a test form from a tagged link and confirm every field reached the CRM. Test events on Google’s validation server first: the production endpoint “does not return HTTP error codes, even if an event is malformed”, and validation events “don’t show up in reports”^[33].

Common mistakes: overwriting first-touch data, and forms embedded from another tool in an iframe, which cannot read your page’s URL unless you pass the values in. Each month, check the share of new leads with a blank source; if it rises, something broke.

At Seed, the first three of these steps are enough. Add the fourth, sending stages back, once deals close often enough to compare channels.

What changes by stage?

• Pre-seed — GA4 with enhanced measurement, three to five key events, a UTM convention, 14-month retention and a consent banner.
• Seed — A written tracking plan, lead events, UTMs captured in the CRM, BigQuery export and a monthly check that tracking still works.
• Series A–B — CRM stages sent back to GA4 and ad platforms, server-side tagging if paid media is significant, and an owner for data quality.

What mistakes should I avoid?

• Tagging before planning. You end up with events no one uses.
• Mixed-case or invented UTM values. Traffic splits or lands in “unassigned”.
• A non-paid medium on paid ads. Paid clicks are counted as organic social.
• Keeping retention at 2 months. You lose history in explorations and funnel reports.
• Every click as a key event. Reports stop meaning anything.
• No consent setup. Legal risk, and lost audiences in the EEA.
• Stopping at the form fill. Without CRM stages you can’t see which sources bring customers.