How long does an audit take and what exactly happens during the scan?

An audit usually takes 1-3 minutes - the exact time depends on the size of the property (number of events, streams, conversions) and how fast your website loads. During this time, two independent examination engines work in parallel. It's worth understanding both, because they answer two different questions.

Engine 1: GA4 configuration analysis (via API)

Answers the question: "is GA4 configured correctly and can the data in it be trusted?"

We connect to your property through Google's official interfaces (the GA4 Admin API and Data API) in read-only mode and work through the areas one by one. The stages you see on the progress screen correspond to the real phases of the examination:

1.Connecting to the GA4 Admin API - establishing an authorized session with your property.

2.Reading the property configuration - administrative settings: currency, time zone, data retention and other parameters whose errors distort every other report.

3.Checking data streams & enhanced measurement - whether streams are active and what enhanced measurement covers.

4.Auditing key events & conversions - whether key events are marked, named correctly and recorded continuously.

5.Checking attribution settings - the attribution model, lookback windows, referral exclusions.

6.Analyzing integrations - connections to Google Ads, Search Console and BigQuery.

7.Running data quality checks - anomalies, bot traffic, duplicated events, tracking gaps.

8.Compiling results - assembling all checkpoints into the report and calculating the Quality score.

Engine 2: the live site scan

Answers the question: "does the on-site implementation actually work the way the configuration suggests?"

The configuration in the GA4 panel can be flawless and the data still wrong - because the tag doesn't load, loads twice, or gets blocked by the consent banner. That's why our scanner visits your website the way a real user in a real browser would, and verifies, among other things:

•whether the GA4 tag actually loads and sends data to the right property,

•whether events are duplicated (the classic mistake: GTM and gtag loaded simultaneously),

•how the implementation behaves with consent - the scanner simulates interacting with the cookie banner and checks the Consent Mode response,

•whether personal data (PII) leaks into GA4, e.g. email addresses in URLs - such a risk is flagged in the report.

The scan covers the publicly accessible pages of the website. The scanner does not log in, does not fill out forms and does not perform transactions - it behaves like an anonymous visitor.

Safety guarantees

•The entire process is read-only. The permission scopes we request (analytics.readonly) make modification technically impossible - it's not a promise, it's a property of the access itself. More: What permissions does GA4audit need and why?

•We don't change anything on your website either - the scan is a passive visit.

•Data read during the audit is used solely to generate your report.

An audit is a snapshot

The report reflects the state at the moment of scanning. If you implement fixes after the audit, the report won't "notice" them - rightly so, because it documents a specific point in time. To see the updated result, run a rescan: a new entry appears in the history and the Quality score trend shows the change. More: I fixed an error - why do I still see it in the report?

What can make the scan take longer

•very large properties (hundreds of events, many streams) - more data to read through the API,

•a slow-loading website - the scanner waits for a full load just like a user,

•temporary Google API throughput limits.

If the scan takes significantly longer than a few minutes or ends with an error, see: My audit failed or got stuck - what should I do?. The most common cause of trouble after a longer break is an expired GA4 connection session (the Google token is valid for about an hour) - simply reconnect: "Your GA4 connection session has expired" - how to fix it?

Related articles:

•What happens to my website's data during the live scan?

•How do rescans and fix verification work?