GA4 setup step by step: 5 settings almost everyone forgets

Most GA4 properties are 80% configured and 20% wrong, and that 20% is always the same five settings. After you create a GA4 property and connect it through Google Tag Manager, GA4 starts collecting data, so it feels done. It isn't. The defaults quietly throw away history, count your own visits, and leave your conversions invisible to Google Ads. This guide walks the five settings almost everyone forgets, why they matter, and exactly how to fix each one.

The five are: data retention, the internal traffic filter, marking key events as conversions, cross-domain and referral settings, and the consent and Google Signals decision for EU traffic. Fix these and your GA4 setup goes from "collecting something" to "collecting the truth."

This assumes you've already got a GA4 property and a working tag. If you're earlier than that, start with what GA4 is and how it works and come back when data is flowing.

Before the five settings: the two-minute basics

Quick sanity check before the real work. A correctly started GA4 setup has a property created, a data stream for your website, and the Google tag firing on every page, usually through GTM. Open Realtime and confirm you see your own visit. If you do, data is flowing and you're ready to configure properly.

If you want the deeper "what is a property, stream, and event" explanation, that's in the GA4 explainer. Everything below lives in the Admin area, so open that now. The five fixes take about twenty minutes total.

Here are the five at a glance before I walk through each one:

Setting	Default	Set it to	Where in GA4
Data retention	2 months	14 months	Admin, Data settings, Data retention
Internal traffic filter	Testing (inactive)	Active	Admin, Data settings, Data filters
Key events	Not marked	Mark real outcomes	Admin, Events / Key events
Cross-domain and referrals	Off, gateways as source	Configured	Admin, data stream, Configure tag settings
Google Signals and consent	Default or guessed	Deliberate, Consent Mode v2	Admin, Data settings plus your CMP

Setting 1: Data retention (change 2 months to 14)

This is the most expensive default in GA4, and it's a single dropdown. By default, GA4 keeps user-level and event-level data for just 2 months. After that, anything you build in Explorations can't reach further back than 8 weeks. Standard reports keep aggregate data longer, but the moment you want a custom analysis of last quarter, the data isn't there.

To fix it, go to Admin, open Data settings, then Data retention, and change the event data retention from 2 months to 14 months. Save. That's it. Google's data retention documentation explains the limits, but there's no real downside to 14 months for most businesses, so set it on day one.

Here's why it stings. Marek, an analyst I worked with, wanted to compare this year's Black Friday cohort against last year's in an Exploration. The property had been live for 14 months, plenty of history on paper. But retention was still on the 2-month default, so 10 months of user-level data had already aged out. The report he needed was impossible, and no fix could bring the data back. A setting he could have changed in five seconds on day one cost him an entire year-over-year analysis.

Setting 2: Internal traffic filter (create it, then actually activate it)

You don't want your own team's visits inflating your numbers. Office staff refreshing the site, you testing the checkout, the agency clicking around: all of it lands in GA4 as real traffic unless you filter it.

Most people get halfway there. They define an internal traffic rule, list their office IP, and assume it's done. It isn't, because GA4 creates the data filter in "Testing" mode by default, where it tags the traffic but doesn't actually exclude it. The filter sits there doing nothing for months.

The fix is two parts. First, in Admin under Data settings and Data filters, set up the internal traffic rule with your office and VPN IP addresses (you can find yours by searching "what is my IP"). Second, and this is the step everyone skips, open the filter and change its state from Testing to Active. Until you do, your own traffic is still in every report. Google's guide on internal traffic filtering covers the IP setup, but the activation step is the one that actually matters.

Setting 3: Mark key events as conversions

This one breaks more ad accounts than any other. In GA4, collecting an event and counting it as a conversion are two separate things. You can fire a perfect purchase or generate_lead event, see it in reports, and still have Google Ads report zero conversions, because you never marked the event as a key event.

In current GA4, you go to Admin, open Events (or Key events), find the event that represents a real business outcome, and toggle it on as a key event. Once it's marked and imported into Google Ads, the platform can finally optimize toward it. Until then, you're running campaigns blind, bidding with no conversion signal at all.

Be selective. A key event should be a genuine outcome: a purchase, a qualified lead, a booking. Marking every pageview and scroll as a conversion is the opposite mistake, and it floods your bidding with noise. Pick the two or three actions that actually represent money, and mark only those.

Not sure your conversions are firing at all? Run a free GTM audit and see exactly which events reach GA4 before you trust the numbers.

Setting 4: Cross-domain measurement and unwanted referrals

If your customer journey touches more than one domain, GA4 splits it by default, and your data lies about where conversions come from. Two cases catch almost everyone.

The first is a separate domain or subdomain in the flow: a main site on one domain and a booking or store on another. Without cross-domain measurement, GA4 starts a new session when the user crosses over, so one journey becomes two and attribution breaks. You fix it in Admin, under your data stream, in the Configure tag settings, by adding both domains to cross-domain measurement.

The second is the payment gateway problem. When a user goes to PayPal, Przelewy24, or Stripe and comes back, GA4 often records the gateway as the traffic source, so your "where conversions come from" report fills up with payment processors instead of real campaigns. The fix is to list those domains under unwanted referrals in the same tag settings, so GA4 ignores them as sources. Skip this and your channel reports quietly credit the wrong source for every checkout.

Setting 5: Consent Mode v2 and Google Signals (the EU decision)

This is the setting that needs a real decision instead of a default, especially in the EU. Two pieces matter.

Consent Mode v2 is not optional for European traffic. Your tags have to respect what users accept or reject in the cookie banner, and GA4 needs the consent signals wired so it can model the conversions you're allowed to model and drop the ones you aren't. A banner that looks fine but isn't wired to GA4 is the most common compliance gap I find. I covered the legal side in is Google Analytics legal in Europe under GDPR.

Google Signals is the deliberate part. Turning it on enables cross-device tracking and demographics, but it adds privacy considerations and can trigger data thresholding that hides rows in your reports. It's a real trade-off, not an obvious yes. Decide on purpose: many EU businesses leave Signals off and rely on Consent Mode modeling instead. The point isn't which choice you make, it's that you make it knowingly rather than inheriting whatever the default was.

After setup: verify before you trust it

Configuring is half the job. The other half is confirming each setting actually took. Run three quick checks: open Realtime with your office IP and confirm your visit is now excluded, fire a test conversion and confirm it shows as a key event, and use DebugView to watch your events arrive cleanly. My guide to GA4 debug mode and DebugView walks the testing step in detail.

For a full health check rather than a spot test, work through the GA4 audit checklist. It covers these five settings plus the next layer of issues that show up once the basics are right.

Conclusion

A GA4 setup that "collects data" and a GA4 setup that collects the truth are separated by these five settings: data retention at 14 months, an internal traffic filter set to Active, key events marked as conversions, cross-domain and unwanted referrals handled, and a deliberate consent and Google Signals decision for the EU. None of them takes long. All of them are wrong by default.

Go change them now while you're thinking about it, then verify. If you'd rather have someone confirm the whole property is configured correctly, that's exactly what a free GTM audit checks, and the deeper GA4 monitoring or an independent GA4 consultant is there when you want the configuration handled and kept accurate for you.

FAQ

How do I configure GA4 correctly?

Create the property, connect the tag (usually through GTM), then fix the five settings almost everyone misses: set data retention to 14 months, activate an internal traffic filter, mark your real conversions as key events, configure cross-domain and unwanted referrals, and make a deliberate consent and Google Signals decision. GA4 collects data on defaults, but those defaults are wrong for most businesses.

What is the GA4 data retention setting and what should it be?

Data retention controls how long GA4 keeps user-level and event-level data for Explorations. The default is 2 months, which is too short for any year-over-year or quarterly analysis. Change it to 14 months in Admin under Data settings and Data retention. There's no real downside for most businesses, and the lost history can't be recovered later.

Why is GA4 not showing conversions in Google Ads?

The most common reason is that the event was never marked as a key event in GA4. Collecting an event and counting it as a conversion are separate steps. Go to Admin, open Events or Key events, toggle your real outcome (like purchase or lead) on as a key event, then import it into Google Ads so the platform can optimize toward it.

How do I stop my own traffic from showing in GA4?

Set up an internal traffic filter in Admin under Data settings and Data filters, listing your office and VPN IP addresses. The step most people miss is changing the filter from "Testing" to "Active." In Testing mode it tags internal traffic but does not exclude it, so your own visits keep inflating reports until you activate it.

Do I need cross-domain tracking in GA4?

You need it if your customer journey touches more than one domain, such as a main site and a separate store or booking domain. Without it, GA4 starts a new session when users cross domains, breaking attribution. You also want unwanted referrals configured so payment gateways like Stripe or Przelewy24 don't show up as your traffic source.

Should I turn on Google Signals in GA4?

It depends, and in the EU you should decide deliberately rather than leave it on by default. Google Signals enables cross-device tracking and demographics but adds privacy considerations and can trigger data thresholding that hides report rows. Many EU businesses leave it off and rely on Consent Mode v2 modeling instead. Make the choice knowingly.