Conversion tracking (GA4 + Google Ads)

Goal: every conversion that matters reaches GA4 once, with the real amount and a stable transaction id, attributed to the ad click that caused it, and nothing personal leaves the page. Then Ads imports it and bids on it.

1. One loader, two destinations

Load gtag once (with the GA4 id if there is one) and config each destination. Template: ${CLAUDE_PLUGIN_ROOT}/templates/gtag-snippet.html. The parts that are easy to get wrong:

gtag('set', 'url_passthrough', true);          // keep gclid across internal links (no cookies needed)

// Keep ONLY ad-attribution params. Stripping the whole query string (a common
// "privacy" fix) also strips gclid → GA4 cannot tie the session to the ad click →
// the purchase imported into Ads is not credited to the campaign. Silent failure.
var keep = /^(gclid|gbraid|wbraid|dclid|utm_(source|medium|campaign|term|content|id))$/;
var q = new URLSearchParams();
new URLSearchParams(location.search).forEach(function (v, k) { if (keep.test(k)) q.set(k, v); });
var pageLocation = location.origin + location.pathname + (q.toString() ? '?' + q : '');
var pageReferrer = '';
try { var u = new URL(document.referrer); pageReferrer = u.origin + u.pathname; } catch (e) {}

gtag('config', 'G-XXXXXXX',   { page_location: pageLocation, page_referrer: pageReferrer, page_title: SAFE_TITLE });
gtag('config', 'AW-XXXXXXXXX',{ page_location: pageLocation, page_referrer: pageReferrer, page_title: SAFE_TITLE });

page_title leaks PII by default. GA4 records document.title. Titles like "Account of John Smith" or "Reading for <name>" put real names into Analytics, which Google's policy forbids (property can be purged/suspended). Rule that scales: pages that are noindex (private) send a generic title — strip everything after " of " / " — ". Do it server-side so the name never appears in the gtag block at all, and add a test that renders a private page with a known fake name and asserts the name is absent from the gtag script.

allow_google_signals: false and allow_ad_personalization_signals: false are fine for conversion counting; they do prevent building remarketing audiences. Make it a conscious choice and tell the user.

2. Conversion events come from the server

Don't scrape values from the DOM ("Amount: 160.000đ" → regex in GTM). It breaks the day someone edits the page copy, and it can be spoofed. Emit the event from the backend at the moment the order is confirmed paid:

gtag('event', 'purchase', {
  transaction_id: 'order-<id>',   // GA4 and Ads both de-duplicate on this: reloads count once
  value: 160000, currency: 'VND',
  items: [{ item_id: 'sku', item_name: 'name', price: 160000, quantity: 1 }]
});
gtag('event', 'sign_up', { method: 'google' });  // new accounts only

Delivery pattern:

• The event happens in a request that renders a page (payment return page): print it on that page ("flash now").
• The event happens in a JSON/XHR request followed by a JS redirect (OAuth sign-in): store it in the session and print it on the next page ("flash"). Otherwise it is lost.
• Only for genuinely new events: a returning user signing in is not a sign_up.

Optionally also fire an Ads-native conversion (send_to: 'AW-…/label') with the same transaction_id, but if GA4 is imported into Ads, one source is enough — two primary actions for the same thing double-count.

3. GA4 settings

• Admin → Events → mark purchase as a key event (star). sign_up can only be starred after the first one arrives — GA4 lists recent events only. Put it on the follow-up list.
• Admin → Product links → Google Ads links: link the Ads account (Personalized advertising on if they want audiences).
• Admin → Product links → Search Console links: link the Domain property to the web stream.
• Check "Pages and screens" and "Session source/medium" for leaks (names in titles, internal test traffic such as localhost:xxxx / referral).

4. Google Ads conversion actions

• Primary, drives bidding: the GA4-imported purchase (Goals → Conversions → New → Import → Google Analytics 4). Value: use the value from the event.
• Secondary or softer primary: a page load conversion on a deep-funnel URL (e.g. "URL starts with example.com/result") — cheap signal that needs no code, uses the account's Google tag. Choose a page only real users reach.
• Newly created actions sit in "Pending / Lượt chuyển đổi đang chờ" for up to 48 h. That is normal. "Needs attention / Cần chú ý" on a goal right after creation is also normal. Re-check after 48 h; if still pending, the tag on the site is not this account's.
• Verify the AW- id on the site belongs to this Ads account (Data manager / Google tag). A tag from another account compiles, loads, and records nothing here.

5. Verify (don't trust, check)

Run ${CLAUDE_PLUGIN_ROOT}/scripts/audit_site.py https://example.com for the static checks, then in a real browser open https://example.com/?gclid=TEST&utm_source=google&secret=x and run ${CLAUDE_PLUGIN_ROOT}/scripts/check_gtag.js in the console. Expect: one config per destination, gclid and utm_source kept, secret dropped, no personal title. Finally make a real (or sandbox) purchase and watch GA4 Realtime.