Case study: Shopify tracking audit — GTM, GA4, Stape, UTMs

In short: a US hardware store on Shopify was spending on Google, Meta and Microsoft Ads, but the ad platforms, GA4 and Shopify never agreed. Over three weeks in October 2026 we took every tracking layer apart and found the GTM container loading three times per page, events reporting a pixel sandbox URL, Safari capping server-side cookies at seven days, and a link between discount codes and orders with no source. The client received a report in English and Ukrainian, a ready GTM release with a step-by-step publishing guide, a UTM standard and a plan for each acceptance criterion.

The client and the brief

The client is a US hardware retailer on Shopify (we will name it once the client approves). Traffic comes from Google Ads, Meta, Microsoft Ads, Klaviyo e-mail and organic search; almost half of all orders are placed by phone.

The brief came with clear acceptance criteria:

#	Criterion	Target
1	GA4 paid sessions vs Google Ads clicks	±15%
2	Shopify sessions without attribution parameters	under 20%
3	Online orders without customer journey data	under 15%
4	GA4 sessions in named channels	over 95%
5	A test order from a real ad click	correct in Ads, GA4 and Shopify

Constraints

Read-only access. We changed nothing in the live store without approval; every fix is checked in GTM Preview first.
Disappearing data. The Shopify API only returns the last 60 days of orders, and the GA4 export to BigQuery only started on 18 September 2026.
Campaigns keep running. Any tag change had to be safe for live ads and reversible in a minute.
Some criteria depend on people, not settings. Direct visits and organic search never carry UTMs, so criteria 2 and 3 also depend on how customers behave.

How we ran the audit

Saved the data. We exported 254 orders from the baseline period (12 August – 10 September 2026) with their journey data while the API still returned it.
Mapped the architecture. The code of three Shopify custom pixels, six versions of the GTM web container, the server-side GTM setup on Stape, and the Google, Meta and Microsoft apps.
Compared six theme versions from July to September: the tracking code had not changed, which ruled out “the theme broke it”.
Walked the customer journey “click → product → cart → checkout” with test UTMs and click IDs, recording every request to GA4, Ads, Meta and Bing in Chrome, Safari (WebKit) and emulated Instagram and Facebook in-app browsers. We scripted these checks so they can be repeated after every change.
Analysed orders without a source by week, payment method, locale, time of day and discount code.

What we found

Finding	Evidence	Impact
The GTM container loads three times per page: from the theme and from two custom pixels	Measured 22 Oct 2026 on home, collection and product pages: Google Ads Config, Conversion Linker and Microsoft Clarity fire 3 times, GA4 page_view once	Polluted remarketing audiences and Clarity recordings
Cart and checkout events report the pixel sandbox URL	page_location like /web-pixels@…/sandbox/… on add_to_cart, begin_checkout and purchase	Wrong page reports and funnels
40.7% of online orders have no customer journey data	57 of 140 in the baseline period; the weekly share rose from 19% to 56%	Criterion 3 failing
Server-side cookies last 7 days in Safari	The server GTM subdomain resolves to a different IP than the store; in Chrome the same cookies last 400 and 90 days	A Safari shopper returning after a week counts as new and the first click is lost
Click IDs and UTMs survive	gclid, fbclid, msclkid and UTMs pass every redirect and reach checkout; GA4 client_id and session_id stay stable	Redirects are not the problem

We also explained why the numbers can never match one to one: Google Ads counts clicks (about 14,900), GA4 counts sessions (28,755) and Shopify counts its own sessions with different filtering. Google Ads Purchase conversions come from the Google & YouTube app rather than GTM, so Ads and GA4 record purchases through different mechanisms.

The key correlation: discount codes

Orders with a discount code were about twice as likely to lack journey data. From 26 August to 10 September: 49% (44 of 90) with a code against 24% (4 of 17) without. The rise coincided with a Labor Day promotion: customers with codes more often arrived by a path Shopify does not record as a visit. The next step is matching those orders to GA4 purchases in BigQuery by order number.

The solution

A GTM release with one-click rollback

A new initialization trigger that excludes pixel sandboxes for Google Ads Config; Clarity and Conversion Linker moved to a trigger with the same exclusion.
The sandbox exclusion no longer depends on specific pixel IDs, so it survives if a pixel is re-created.
The real page_location and page_referrer are passed from the pixels into every GA4 event.
Imported into a new workspace: 3 tags and 2 triggers modified, 4 variables added and 1 modified, nothing deleted. A test plan for GTM Preview.
A step-by-step publishing guide of about 15 minutes and a one-click rollback to the previous version.

A UTM standard

A separate document sets the rules for Google Ads, Meta, Microsoft Ads, Klaviyo, organic social, partners and QR codes. It fixes the inconsistencies we found: two different mediums for the same Meta campaigns, campaign names broken by URL encoding, unfilled macros, Klaviyo links without a campaign name and mixed-case sources. Most changes are one-off settings in the ad platforms and do not touch the site.

A plan for the acceptance criteria

For each criterion: the current value, how to reach the target, who does what and which access is needed — the server container, Stape for a same-origin setup for Safari, Microsoft Ads, and the GA4 report for the baseline period. Phase two adds call attribution through Aircall so that phone orders (44%) get a source too.

Challenges and how we solved them

Three tracking layers at once. GTM with a server container, native Shopify apps and Shopify’s own attribution. We put who counts what into a single table so the team stopped comparing apples with oranges.
Data that expires after 60 days. We saved orders on day one; without that the baseline could no longer be calculated.
Honesty about the criteria. We stated in writing which criteria depend on setup and which on traffic behaviour, and proposed agreeing the exact formulas before sign-off.
A safe release. Without the new pixels the GTM changes break nothing, and rolling back takes a minute.

Results

The causes of the discrepancies are documented, and the fix for duplicate tags and page URLs was handed over for publishing on 22 October 2026 together with a test plan.
Shopify sessions without UTMs: 60.4% in the baseline, 23.9% from 11 September to 8 October. The drop coincided with account-level UTM tagging in Google Ads set up by the media team, which we noted in the report.
Newer data (orders up to 21 October) shows the share of online orders without a source falling in October, but the sample is small — 7 to 21 orders a week — and the cause still needs confirming.
The client’s team has documentation of what is set up, where and why, and how to check it after every change.

What you can apply to your business

Check how many times GTM loads. Shopify custom pixels often load the same container again.
Save raw data now. Many APIs only keep history for a limited time.
Compare like with like: clicks against paid sessions from the same campaigns, not against all sessions.
One UTM standard across channels, lowercase and with campaign IDs.
Test Safari separately if your server-side GTM sits on its own subdomain.

If your tracking setup is part of a bigger rebuild, our guide to what a website really costs shows where analytics fits into the budget.

Shopify tracking and attribution audit: duplicate tags removed, missing order sources traced