GA4 setup for a new website: tag, key events and consent, 2026

Introduction

To set up GA4 on a new website, create a property and web data stream, install the Google tag once on every page, set consent defaults before any measurement call, mark a few key events, and check the result in Tag Assistant. The order matters more than the tools. Most broken setups fire measurement before consent is set, or count the same page view twice.

This guide is for founders and engineering leads launching a site, whether it cost what a website costs in 2026 or far less. It covers the property and stream, the tag, consent mode v2, key events and verification. Facts below are from Google's documentation as of October 2026.

Create the property and web data stream

In Google Analytics, open Admin and create an account, then a property. Google's setup guide asks for a property name, reporting time zone, currency, industry category, business size and intended uses. Pick the time zone and currency you will report in, because they shape every later report.

Next, add the stream. Under Data collection and modification, open Data streams, choose Add stream, then Web, and enter your site URL and a stream name. Copy the Measurement ID from the stream details. It starts with "G-".

Settings worth a minute

Turn on enhanced measurement when you create the stream. Google says it collects page views and other events automatically, and you can disable individual events later. That gives you a baseline without custom code.

Check data retention too. For standard properties, event data retention is either 2 months or 14 months. You change it under Admin, Data Settings, Data Retention, and you need the Editor role. If you plan to compare year over year in explorations, the longer option is the one to pick.

Install the Google tag once

Paste the Google tag immediately after the opening head tag on every page, or add it through Google Tag Manager, or use your CMS field for the Measurement ID. Pick one method. Installing the tag in the page and again in a Tag Manager container is a common way to double count.

Keep the tag light and make sure it loads on every template, including 404 pages and checkout or booking flows. If you track script weight, count it against your performance budgets.

Set consent defaults before anything measures

Consent mode tells Google's tags what the visitor has agreed to. Version 2 uses four parameters, per Google's consent guide: ad_storage and analytics_storage, plus the two newer ones, ad_user_data and ad_personalization.

Order and wait_for_update

Google puts it plainly: "The order of the code here is vital. If your consent code is called out of order, consent defaults won't work." The default consent command must run on every page before any command that sends measurement data, such as config or event.

A typical default with an asynchronous banner looks like this:

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'analytics_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'wait_for_update': 500
});

The wait_for_update value is in milliseconds. In Google's example, 500 gives the consent tool 500 ms to call the update command before tags fire. When the visitor accepts, call gtag('consent', 'update', {...}) with the granted values, and persist the choice so later pages set the right state.

The denied values above are placeholders. Your defaults should match your own policy and the rules where your visitors live.

Not legal advice

Whether you need a banner, and what the default must be in a given region, is a legal question. This article covers how the tags behave, not what the law requires. Ask counsel before you launch to visitors in regulated regions.

What consent mode does to your numbers

Visitors who decline consent leave gaps in your data. Google can fill some of them with behavioral modeling, but a new site usually will not qualify at first. The documented thresholds are:

• At least 1,000 events per day with analytics_storage='denied' for at least 7 days.
• At least 1,000 daily users sending events with analytics_storage='granted' on at least 7 of the previous 28 days.
• Consent mode on all pages, with tags that load before the consent dialog appears.

Google also says meeting these does not guarantee eligibility. So plan for gaps in the first months. Don't compare a consent-gated new site against an old one without that caveat.

Pick a few key events

A key event is an event you mark as important. In Google's words, you create or identify an event that measures the action, then mark it as a key event. A Google Ads conversion can then be created from it.

Choose by what the site exists to do:

Mark few. If everything is a key event, nothing is.

To send a custom event with gtag.js, use the event command:

gtag('event', 'signup_newsletter', {
  'method': 'web'
});

One rule from Google's events documentation: Google will not process events placed above the Google tag snippet. Put your event code after the tag.

Mistakes that skew a new property

Most problems on a fresh GA4 property come from the build, not from Google. These are the common ones:

• Two tags on one page. A theme plugin adds the Measurement ID and a developer adds the snippet by hand. Page views double. Search the rendered HTML for your G- ID and confirm it appears once.
• Consent code loaded late. A banner script that sits at the bottom of the page can run after the first config call. Move the default command to the top of the head, above the tag.
• Events above the tag. A form handler that fires on load before the snippet exists sends nothing Google will process.
• Staging data in production. If a staging site reuses the production Measurement ID, test submissions show up as real key events. Give staging its own stream, or no tag at all.
• Everything marked as a key event. Scroll depth and page views are useful for diagnosis but poor measures of whether the site works.

Write the setup down in the repository: the Measurement ID, where the tag lives, which events are key events and why. A new teammate should be able to answer "what do we count?" without opening Admin.

Verify before you trust the numbers

Open Tag Assistant, enter your URL and accept all on your banner. Google's verification steps say to select the earliest Consent event in the Summary and confirm the API call includes all four parameters, with the On-page Default showing Denied. Then select the most recent Consent event and confirm the On-page Update shows Granted. The Tags tab shows whether each tag fired or was blocked.

Then open the Realtime report. Data can take up to 30 minutes to appear. Once the basics work, you can measure SEO results with GA4 and Search Console with numbers you can defend.

Conclusion

Build in this order: property and stream, one tag, consent defaults, a short list of key events, verification. Fixing the order later means re-testing every page. If you want a second pair of eyes on a launch, we do this kind of check at Kallos Labs; you can reach us through our contact page.

Frequently asked questions

How long until GA4 shows data on a new site?

Google says data can take up to 30 minutes to appear. The Realtime report is the quick check.

Do I need consent mode v2 for a small site?

If you use Google advertising features, Google's guidance asks for the four consent parameters. Whether you need a banner at all depends on your visitors' location and your lawyer's advice, not on this article.

Will behavioral modeling fill in the gaps on a new site?

Probably not at first. It needs 1,000 events a day with analytics storage denied for 7 days, and 1,000 daily consented users on 7 of the previous 28 days.

How many key events should I mark?

Few. Mark the actions that mean a visitor did what the site exists for, such as a form submission or a purchase.