The STACK Audit: 5 Tracking Layers I Check Before Touching a Bid

Quick Take

A Shopify brand handed me an inherited Google Ads account in Q1 2026. $40K/mo, six months under the prior agency, tracking “fine.” Two hours in I had seven findings, all of them feeding Smart Bidding the wrong number. This is the named audit I run before I touch a single bid: the STACK Audit. Five layers, in order. Source emission, Tag triggers, Attribution spine, Conversion values, Klaviyo identity loop. Each layer maps to a section of The Tracking Stack and each catches one specific class of leak. Run it before you let Smart Bidding optimize against numbers you haven’t verified.

The receipt

An inherited Shopify home brand, $40K/mo in Google Ads, six months with the prior agency. The reporting deck said 4.2 ROAS. The P&L said the brand was barely breakeven on paid acquisition. Both couldn’t be true.

Two hours into the audit:

1. The dataLayer.purchase event was emitting total_price (which includes shipping and tax) instead of subtotal minus discounts. Smart Bidding had been chasing inflated revenue for the full six months.
2. The Bing UET tag was firing with the literal string YOUR_VALUE_HERE on three conversion goals. I have written about that one before.
3. The Click Text trigger on the contact form had been killed three months earlier when marketing changed the button copy. Form-fill conversions had quietly dropped to zero in Google Ads and nobody had noticed because the monthly report still showed plenty of purchase conversions.
4. GA4 was importing every conversion type as “primary.” Eleven of them.
5. Enhanced conversions were “enabled” but the hashed-email field was being dropped server-side, so Google was receiving the wrapper without the payload.
6. The Meta CAPI server events weren’t sharing event_id with the browser pixel. Every purchase was getting double-counted.
7. The Klaviyo customer list hadn’t synced to Google customer match in four months. The audience the prior agency was “retargeting” was stale.

Each finding by itself looks like a small thing. Stacked, they were the difference between an account that read 4.2 ROAS and one that was actually doing 1.6 contribution-margin ROAS. Six months of Smart Bidding had compounded against bad signals.

This is why I don’t move a budget dollar until the stack is verified. The audit has a name and a shape so I don’t skip steps when the account looks fine on the surface.

The STACK Audit

Five layers. Each one maps to a specific class of leak. Each one takes me 20-45 minutes on a typical Shopify account.

S. Source emission

What it checks: the storefront is emitting clean order data into the dataLayer before any tag fires.

This is the layer almost every audit skips. The agency walks in, opens GTM, starts checking tags. But if the dataLayer is wrong, every downstream tag inherits the wrong number. The fix later in the spine can’t recover what the source never emitted.

Specifically:

• Shopify Customer Events pixel is sandboxed (no third-party tags piggybacking on it)
• The purchase event in the dataLayer carries subtotal_price minus total_discounts, not total_price
• Order data exposed post-purchase includes line items, customer email, customer phone (the Google tag normalizes and hashes these itself; only API or offline uploads need you to SHA-256 them first)
• Refunds and cancellations are sent back as conversion adjustments (retractions or restatements) so Smart Bidding sees the real cohort

Most common drift: shipping and tax getting baked into the conversion value. Full diagnostic here.

T. Tag triggers

What it checks: GTM tags fire once, on real server confirmations, gated against the conditions that fingerprint the event.

The most common anti-pattern I see is conversions wired to Click Text matched against specific button copy. Every CTA change kills the data, silently. The second most common is purchase events firing on cart pages because somebody used a URL contains match. Both look fine in the monthly report until you check the Tag Assistant Preview.

The trigger pass:

• One web container, owned by the founder, not the agency
• Triggers gated on server confirmations (Shopify checkout-completed pixel event) or post-purchase page presence, not URL substring matches
• Tags versioned, with a working Preview before every publish
• A trigger conditions exception report (any tag firing more than once per session is on the list)

The audit of my own container walks the trigger-trap class in full.

A. Attribution spine

What it checks: events flow Shopify, web container, server container, ad platforms, with no double-fire and no client-side gaps.

Server-side isn’t optional in 2026. iOS strips client-side cookies, ad blockers eat client beacons, conversion APIs prefer server signals anyway. If you aren’t running a server container, you’re losing conversions the browser never reports and giving Smart Bidding a partial picture.

The spine pass:

• GTM server container on a custom subdomain (like metrics.yourbrand.com)
• Web container forwards purchase events to the server container, server fans out to Google Ads, Meta CAPI, GA4
• The server is the primary source for Google Ads conversion imports (not GA4 imports, which lag and can drop conversions)
• A dedup contract is documented somewhere a human can read it: which platform owns the canonical event_id, which signals are server-only, which are browser-only

If you don’t have the dedup contract written down, you don’t have it. Build it before you audit anything else.

Having a server container isn’t the same as having a spine. On Emma Grace Home the server stack was all there on paper and received zero ecommerce events, because one data-layer checkbox in a Shopify app was unchecked. That diagnosis is written up here.

C. Conversion values

What it checks: Google Ads sees the right number, the right cohort, and the right primary-vs-secondary mapping.

The conversion-value layer is where most agencies fail without knowing. Every conversion type imported as “primary.” Conversion value set to total_price including shipping. Enhanced conversions “enabled” but the hashed-email field empty. Each one looks fine in the Google Ads UI and each one corrupts Smart Bidding.

The value pass:

• One primary purchase conversion. Everything else (newsletter signups, add-to-cart, search) set to secondary.
• Conversion value = gross revenue minus discounts and shipping. Not order total. Not GA4 revenue.
• Enhanced conversions on every action, with hashed email and phone transmitting (not just enabled).
• Refunds flow back as conversion adjustments (retractions or restatements) against the original conversion action.

If Smart Bidding has been running for more than 60 days on the wrong value model, expect a 4-6 week recovery period after the fix. The bidder has to relearn the new cohort.

K. Klaviyo identity loop

What it checks: first-party identity (email, phone) from Klaviyo or Postscript is flowing back into Google customer match, Meta CAPI, and Microsoft customer match on a weekly cadence.

This is the layer I see least often and that has the biggest compounding effect. Klaviyo and Postscript are the cleanest first-party identity graph most Shopify brands have. The identity sitting in there should be feeding hashed PII back to the ad platforms continuously so customer-match audiences, lookalike seeds, and enhanced conversions all run on fresh data.

Most accounts: synced once, six months ago, never refreshed.

The identity pass:

• Klaviyo connected to Shopify (you have this)
• Klaviyo segments synced to Meta Custom Audiences and Google Customer Match (you probably don’t)
• Sync frequency weekly minimum, not “as needed”
• Hashed identity from Klaviyo feeding enhanced conversions and CAPI on every purchase, not just every email send

This is the lift that turns a clean stack into a compounding one. Without it, you’re running a fresh-only attribution model and ignoring the lifetime cohort entirely.

What this audit is not

It isn’t a media-buying audit. It doesn’t look at campaign structure, ad creative, bid strategy, or budget allocation. Those audits are downstream of this one and pointless without it. If the tracking is leaking, every conclusion the media-buying audit reaches is built on the wrong number.

It isn’t a one-pass-and-done audit. The stack drifts. New plugins get installed, the dev team ships a checkout extensibility update, the agency adds a tag for a new platform without telling anyone. I re-run the STACK Audit at the start of every quarter and any time something material changes (theme update, replatform, new ad channel).

It isn’t the Lead Quality Stack audit. That one is the parallel framework for service businesses where the conversion event is a lead, not a purchase. Different layers, same shape.

The receipts

On that one inherited account: stack fixed in two weeks, then Smart Bidding rebid for 28 days. Reported ROAS fell once the inflated value came out, and contribution-margin ROAS rose. That’s the trade I want from a stack fix: a smaller number in the platform and a better one in the P&L.

The STACK Audit checklist itself is part of the 25-page Setup Checklist PDF. It walks the five layers with the actual GTM Preview, GA4 DebugView, and Google Ads Conversion Diagnostics views I check. No email gate. Page 23 has the only ask.

Keep going

Read next:

• The Bing pixel that said YOUR_VALUE_HERE. Eleven findings inside a six-month-old Shopify Stape stack. The long-form version of the audit shape.
• The Click Text Trigger Trap. The most common GTM trigger anti-pattern, on my own container, fixed in May 2026.
• The Furniture Brand Whose Revenue Showed Up as Unassigned. The attribution-spine layer failing on Emma Grace Home: a server stack with zero events and two GA4 installs on one property.

Two of the five layers have a straight-answer version if you want the narrow question instead of the whole pass: enhanced conversions in Google Ads and Shopify conversion tracking that reports nothing.

Free PDF: The 25-page Google Ads Setup Checklist. The STACK Audit checklist, expanded with screenshots and the Microsoft Ads equivalent.

If the dashboard ROAS doesn’t match what the P&L says, the STACK Audit is the diagnostic. If you’d rather I run it, send me read-only access for the free ads audit. It’s back in writing within 24 hours. No call.

See how I fix conversion tracking.