No. Never, in any scope, under any circumstances. That's the shortest answer in this entire help center - but since worrying about configuration safety is the most common reason people hesitate before connecting their account, let's explain exactly why you can be sure.
Three levels of guarantee
1. The technical level - the strongest one.
We only request read-only permission scopes (analytics.readonly and analytics.manage.users.readonly). Google enforces these scopes on its side: any write, edit or delete request sent with such a token is rejected by Google's servers before it reaches your data. We have no technical ability to modify anything - regardless of intent, a software bug, or the actions of a third party.
2. The product architecture level.
GA4audit simply contains no write functionality toward GA4. The report gives you fix instructions ("go to Admin → Attribution → change the lookback window…"), but executing the change always stays on your side, in your GA4 panel, with your own hands. That's a deliberate design decision: an auditor who fixes the system it examines stops being an auditor.
3. The legal level.
The commitment not to modify data is written into our Privacy Policy and follows from the Google API Services User Data Policy, compliance with which is a condition of our API access.
"What about the scan of my website?"
The live scan is fully passive too. The scanner visits the publicly available pages of your website like a regular user: it doesn't log in, doesn't fill out forms, doesn't click transactional buttons, doesn't submit or store anything on your site's side. The only "interaction" is simulating a decision in the consent banner - exactly the one every visitor makes - needed to verify how Consent Mode behaves.
"Can the audit skew my data, e.g. artificially inflate traffic?"
The scanner's visit is a single, short-lived page visit - statistically invisible at the scale of GA4 data. The scanner sends no events of its own to GA4 - it only triggers what your site already sends on every visit, so it adds roughly as much to your data as a single visitor.
Related articles: