← Back to all articles Server-Side Tracking & CAPI Clients only November 6, 2026 ⏱ 16 min read

A 50-Point Tracking Audit Checklist for Companies at Scale

The deep audit roadmap used to inspect, fix and harden the data infrastructure of advertisers with large budgets.

Random Performance Engineering Paid traffic & server-side tracking specialists

November 6, 2026

A 50-Point Tracking Audit Checklist for Companies at Scale

TECHNICAL DIAGNOSIS · OPERATIONS > BRL 100K/MONTH 16 min read

Operating scenario: Operations that move large volumes of investment often run with silent data leaks, where critical conversions stop being attributed without the team noticing.

Technical root cause: Accumulated legacy scripts in the tag container, incorrect first-party cookie settings, and failures in data normalization before hashing.

Engineering guideline: A methodical audit structured in 5 layers of technical control, covering server infrastructure, network header security, native deduplication and signal integrity.

Preventive Audit of Data Infrastructure

In operations that move substantial amounts through paid traffic, small technical configuration mistakes carry a disproportionate price. An event_id parameter with incorrect formatting, a tag firing twice on thank-you pages or an expired SSL certificate on the server container can distort conversion data for weeks without raising any visible alert in the company dashboard.

An audit structured around 50 inspection points sets up a disciplined check across every layer of data transmission, from the user interface to the destination servers.

Layer 1: Domain Resolution and HTTP Headers (Points 1 to 10)

1. Owned subdomain set up under the same root domain as the site (example: dados.empresa.com.br).
2. Direct resolution via dedicated A and AAAA records to avoid CNAME Cloaking blocks by Safari ITP.
3. Valid TLS 1.3 SSL certificate with automatic renewal configured.
4. HttpOnly directive applied to first-party session cookies for network security.
5. Secure attribute enabled on every server cookie response.
6. SameSite=Lax directive set to ensure legitimate cross-domain navigation.
7. Max-Age parameter set for adequate persistence (minimum 1 year for first-party identifiers).
8. Brotli/Gzip network compression enabled on the server to reduce traffic latency.
9. Tag server response time (TTFB) under 200 milliseconds.
10. CORS (Cross-Origin Resource Sharing) policies strictly scoped to the corporate domain.

Layer 2: Data Normalization and SHA-256 Hashing (Points 11 to 20)

11. Emails trimmed of leading and trailing spaces and converted to lowercase before hashing.
12. Phone numbers formatted with country code (55 for Brazil) and area code, without punctuation or special characters.
13. SHA-256 hash generated exclusively from the normalized strings.
14. fbp and fbc parameters preserved in their original unhashed text format.
15. Client IP address captured directly from the network header (avoiding load balancer IPs).
16. Full User-Agent passed through without truncation.
17. Personal names correctly split into first name (fn) and last name (ln).
18. ZIP code and city formatted to the international standards required by Meta and Google.
19. No personal data sent in open URL parameters in the address bar.
20. Prior sanitization of special characters and accents in registration fields.

Layer 3: Deduplication and Event Integrity (Points 21 to 35)

21. event_id identifier present in every critical conversion fire.
22. event_id strictly identical between the browser tag and the server.
23. Exact match of the event name (event_name) on both sending channels.
24. Synchronous firing, or a lag of under 5 seconds between browser and server.
25. Deduplication rate above 95% confirmed in Events Manager.
26. Purchase event fired only after payment is actually confirmed.
27. Multiple fires on the same transaction prevented through locks by order number (order_id).
28. Currency (BRL) and numeric value with a decimal point and no currency symbols in the payload.
29. Intermediate funnel events (ViewContent, AddToCart, InitiateCheckout) tracked correctly.
30. Custom parameters (content_ids, content_type) compatible with the product catalog.
31. Audit for ghost events fired by legacy tracking tools.
32. Staging and test environments isolated so they do not pollute production data.
33. Real-time error logging with automated alerts for the technical team.
34. Event Match Quality (EMQ) monitored and kept above 8.0 for commercial transactions.
35. No blocking from Content Security Policy (CSP) tools.

Layer 4: Cloud Infrastructure and Resilience (Points 36 to 45)

36. Autoscaling configured on the server container.
37. Minimum number of active instances set to eliminate cold start latency.
38. Load balancer with availability zone redundancy (Multi-AZ).
39. Memory and CPU usage alerts configured in Cloud Monitoring.
40. Daily backup of the server container configuration.
41. Strict version control in GTM with mandatory approvals for publishing.
42. Efficient routing of analytics requests without blocking page load.
43. Fallback routes configured for transient server unavailability.
44. Cloud cost monitoring to avoid surprises in traffic billing.
45. Log retention policy compliant with privacy requirements.

Layer 5: Governance and Sales Integration (Points 46 to 50)

46. Click identifiers (gclid, fbclid) captured in hidden form fields.
47. Source parameters stored securely on the lead record in the CRM.
48. Automated pipeline for sending offline conversions when the sale closes.
49. Periodic reconciliation report between ERP revenue and reported conversions.
50. Sales team trained to log loss reasons and real contract values.

Frequently Asked Questions about Data Audits

How often should I run this checklist?

In corporate operations, a full audit should run every quarter, and always before major seasonal sales peaks (such as Black Friday) or after major changes to the site's code.

What is the first sign that tracking is broken?

Sharp gaps between the orders counted in the financial system and the numbers shown on the ad platforms, along with sudden drops in the EMQ score on Meta Ads.

Want to audit your company's data infrastructure with this protocol?

Random Marketing's senior team runs deep data audits for businesses with high media investment.

I want to hire Random Marketing for my company ↗

RESERVED DOCUMENT · CLIENTS ONLY

Restricted access for advisory clients

The architecture models, verification checklists, integration scripts and operating pipelines in this dossier are restricted to companies advised by Random Marketing.

✓ Audited technical implementation checklist

✓ Architecture and configuration models

✓ Data governance and engineer follow-up

How do I become a client?

Advisory for operations investing BRL 100k or more per month in media.

TECHNICAL RIGOR & PRIMARY SOURCES

Official documentation & engineering references

Architecture guidelines, API specifications and official technical documentation consulted to support this dossier:

IETF Tools RFC 6265bis: HTTP State Management Mechanism Engineering standard for the HttpOnly, SameSite and Secure attributes on first-party cookies.

Meta for Developers Conversions API Verification Guide Compliance tests for payload, deduplication and the integrity of user identifiers.

Indexing keywords: #tracking audit #gtm tag checklist #server-side audit #meta auction inspection #marketing data quality