53-tracking-setup-global

# Tracking Setup (Global)

Ads without verified tracking is driving blind. **Hard rule: do not launch ads until tracking verifies green.** Every dollar spent before verification is unmeasurable. Set it up correctly the first time — changing events mid-campaign destroys historical comparability.

> Full per-platform install steps and the consent mode parameter reference: read `references/platform-tracking-setup.md`.

## Information gathering

Ask up to 4 questions:

1. **Which ad platforms and objective?** Meta / Google / TikTok / LinkedIn / YouTube — lead (form or message) / purchase / traffic?
2. **What runs the website or landing page?** Shopify / WordPress / Webflow / Framer / custom — and is there access to edit the head tag or install GTM?
3. **Which markets receive traffic?** This decides the consent requirements: EU/UK means GDPR and ePrivacy, California means CCPA/CPRA, other US states have their own opt-out laws.
4. **Where does the sale actually close?** On site (pixel-measurable) or offline via sales calls, demos, or DMs (needs CRM/offline conversion import)?

## Principles

1. **No green, no launch.** Verification comes before spend, every time.
2. **Consent is part of tracking, not a legal afterthought.** In the EU/UK, tags must not fire before consent. Getting this wrong risks fines and, on Google, loss of remarketing audiences.
3. **One installation method only.** GTM plus hardcoded tags equals duplicate events and doubled phantom conversions.
4. **Client-side plus server-side, deduplicated.** Browser-only tracking loses a large share of events to ad blockers, ITP, and iOS ATT. Send the same event from both sides with a shared event ID.
5. **Consistent UTMs.** Define the convention once, before anyone builds a link. GA4 cannot repair inconsistent casing or naming after the fact.
6. **Measure to revenue, not to lead.** If 1,000 leads produce 10 sales, you must be able to tell whether the failure is in ads or in sales. That requires CRM or offline conversion import.
7. **Expect platform numbers to disagree.** Ads managers use different attribution windows and modeled conversions. Pick one source of truth for decisions and use the others as directional.

## Workflow

### 1. Choose the measurement architecture

| Layer | Purpose | Minimum |
|-------|---------|---------|
| Client-side pixel/tag | Fast setup, on-page events | Meta Pixel, Google tag, TikTok Pixel |
| Server-side API | Recovers events lost to blockers and ITP | Meta Conversions API, TikTok Events API, Google Enhanced Conversions |
| Analytics | Cross-channel truth, funnel analysis | GA4 with key events configured |
| Consent layer | Legal gate in front of everything above | CMP plus Google consent mode v2 |
| CRM / offline | Connects leads to actual revenue | CRM with source fields, offline conversion import |

Server-side GTM is the recommended container for anything beyond a simple store: it centralizes event forwarding, improves data quality, and keeps first-party cookie lifetimes usable under ITP.

### 2. Consent management (do this before any tag fires)

This is a first-class requirement, not an optional extra.

**EU / UK — GDPR and ePrivacy:**
- Install a certified consent management platform. Meta requires a CMP for EU traffic; Google requires a Google-certified CMP for EEA/UK traffic to keep personalized advertising and audience features.
- Implement **Google consent mode v2**. The four signals are `ad_storage`, `analytics_storage`, `ad_user_data`, `ad_personalization`. Default them to `denied` for EEA/UK before the banner is answered, then update on consent.
- Non-essential tags must not fire before consent is granted. Consent must be as easy to refuse as to accept, and withdrawable.
- Keep a consent log — which user, which choice, when, which policy version.

**California — CCPA/CPRA (and comparable US state laws):**
- Provide a visible opt-out of sale/sharing of personal information.
- Honor the Global Privacy Control browser signal as a valid opt-out.
- On Meta, apply **Limited Data Use** for California traffic.

**Email and SMS:** CAN-SPAM in the US and GDPR in the EU require documented opt-in for marketing sends and a working unsubscribe. Any list uploaded as a Custom Audience or Customer Match list must have that consent on record — see `14-email-marketing-global`.

Record the decision in the output file: which CMP, which regions gated, who verified.

### 3. Install per platform

Full step-by-step checklists live in `references/platform-tracking-setup.md`. Summary of what must exist:

| Platform | Client-side | Server-side | Verification tool |
|----------|-------------|-------------|-------------------|
| Meta | Pixel with standard events (PageView, ViewContent, AddToCart, Lead, Purchase) | Conversions API with `event_id` deduplication, Event Match Quality >= 6.0 | Meta Pixel Helper, Test Events |
| Google Ads | Google tag / GTM conversion actions | Enhanced Conversions (hashed email/phone), consent mode v2 | Tag Assistant, conversion diagnostics |
| GA4 | GA4 tag, key events marked as conversions | Measurement Protocol or server-side GTM | GA4 DebugView, Realtime |
| TikTok | TikTok Pixel (ViewContent, AddToCart, SubmitForm, CompletePayment) | Events API with deduplication | TikTok Pixel Helper, Events diagnostics |
| LinkedIn | Insight Tag with conversion rules | Conversions API for CRM-side events | LinkedIn Insight Tag Helper |

Only one primary conversion action per objective should be enabled for bidding. Extra enabled conversions inflate counts and confuse smart bidding.

### 4. iOS ATT and attribution windows

Since iOS 14.5, a large share of iOS users opt out of app tracking, so platform-reported conversions are partly modeled rather than observed.

- Meta's post-ATT default is a **7-day click / 1-day view** attribution window. Compare periods on the same window or the trend is meaningless.
- Verify the domain and configure **Aggregated Event Measurement** with a prioritized list of up to