Check Your Tracking, Free Sign in
DO IT YOURSELF

Accurate conversion tracking, by hand.
Here’s the whole list.

This is everything it takes to track conversions the way CleanClicks does: first-party, server-side, bot-filtered, out-of-market filtered, deduplicated, and consent-aware across every ad platform. You can absolutely do it yourself. Here’s what “yourself” actually looks like.

Check Your Tracking, Free Or Skip the List. Start with CleanClicks.
WHY THIS LIST IS SO LONG

Tracking used to be one snippet of code. It isn’t anymore.

Conversion tracking used to be one snippet of code. It isn’t anymore. Ad blockers, Safari and Firefox privacy, cookie-consent tools, and bot traffic each chip away at browser-based tracking, and every ad platform now wants its own server-side feed with its own click IDs, its own API, and its own dedupe rules.

So the work fractured. What was one tag is now a dozen moving parts per platform, and each part has to be built, verified, and re-checked every time the site or a platform changes. The list below is that reality, written out. It isn’t padded to look scary. Every line is a real decision you’d have to make and a real thing you’d have to maintain.

THE CHECKLIST[SYS::52_ITEMS]

The full list. All 52 items.

What each item involves is its own project. This list is the what, not the how.

Foundation (once per site)

9 ITEMS
Configure first-party DNS so tracking runs on your own domain
Stand up a server-side endpoint to receive and relay events
Replace client-side pixels with a single first-party tag
Capture and persist every ad platform’s click ID
Carry click IDs through to form submissions
Capture and securely hash email for enhanced conversions
Define every conversion trigger across the site
Capture order value and order ID for ecommerce events
Confirm ecommerce purchases server-side, independent of the browser

Bot filtering (repeat the logic for every platform’s feed)

6 ITEMS
Identify and exclude headless-browser crawlers that execute JavaScript and pass as real visitors
Filter data-center and hosting-provider traffic (the offshore noise)
Deduplicate bot sessions before they reach any conversion count
Maintain and update the bot signature list as new patterns appear
Verify bot exclusion separately in each destination, because each ingests independently
Build reporting that proves how much bot traffic was stripped, per platform

Out-of-market / geo filtering (per platform)

4 ITEMS
Set a US-only geo filter at the server, before dispatch
Strip non-US traffic from each platform’s conversion feed individually
Reconcile geo filtering against each platform’s own location reporting
Confirm out-of-market clicks aren’t inflating any platform’s optimization signal

Google Ads

4 ITEMS
Send server-side conversions tied to Google’s click IDs
Configure Enhanced Conversions
Recover click IDs that browser blocking strips out
Correct channel classification so paid traffic isn’t miscredited

Meta

3 ITEMS
Set up and authenticate the Conversions API (CAPI)
Send server-side events with Meta’s click ID and hashed identifiers
Deduplicate browser and server events so each converts once

TikTok

3 ITEMS
Set up the Events API
Send server-side events with TikTok’s click ID and hashed identifiers
Deduplicate against any client-side TikTok pixel

LinkedIn

3 ITEMS
Set up the Conversions API
Send server-side events with LinkedIn’s click ID
Keep Privacy Policy / CCPA references aligned with what’s actually sent

Microsoft Ads

2 ITEMS
Configure server-side conversion upload with click IDs
Apply the same bot and geo filtering to its feed

GA4 (server-side)

4 ITEMS
Provision a dedicated, isolated GA4 property
Send server-side conversions and page views
Rebuild session and channel attribution server-side
Diagnose and fix page-view surplus and duplicate events

Dedupe & reconciliation

4 ITEMS
Give every conversion a stable ID so duplicate sources collapse into one
Set and tune the deduplication window
Reconcile every platform’s count against the client’s true order records
Catch and correct double-counting when a native platform integration shares a measurement ID

Consent, opt-out & privacy (per platform)

7 ITEMS
Detect and honor Global Privacy Control in real time, before transmission
On opt-out: send nothing to Meta, TikTok, LinkedIn, Microsoft, or server-side GA4
On opt-out: strip click IDs so nothing uploads to Google
Strip hashed email, IP, user agent, geo, device, and attribution for every vendor under opt-out
Purge identifier-bearing data from any opted-out reverse map
Keep first-party analytics running after opt-out without feeding ad platforms
Enforce retention windows per data type

Ongoing ops (forever)

3 ITEMS
Monitor the send-vs-receive delta per platform, daily
Audit each feed against server logs to catch drift before it reaches a report
Re-verify all of the above after any site, theme, or platform change
AND HERE’S WHAT GOES WRONG

Every item above is also a place the setup can quietly break.

A few of the common ones:

Three systems, three numbers.

A legacy browser tag under-counts because blockers hide sales. A raw server feed can over-count when a pixel and a webhook both log the same order. The truth sits between them, and finding it takes reconciliation against real order records.

Double-counting from a shared measurement ID.

A store’s own native platform integration can fire to the same ID as your server-side setup, copying events. Nothing looks broken. The number is just wrong.

Silent bot inflation.

Headless crawlers execute JavaScript and slip past browser tags. A single data-center hub can add hundreds of fake sessions in a month, and they’ll train your bidding if they reach the platform.

Attribution that vanishes.

When browser blocking strips click IDs, paid clicks get miscredited to “direct” or “unassigned,” and the campaigns that earned the sale get none of the credit.

Consent gaps.

Get opt-out handling wrong in either direction and you either over-collect or lose legitimate data. Each platform has to be handled on its own terms.

Drift.

Even a correct setup degrades. A theme update, a new checkout flow, or a platform API change can break a feed with no error message. Without a monitor, the report just drifts until someone notices.

THE FRACTURED STATE OF TRACKING

There is no single place to do this well.

The click IDs live in the URL. The events live in the browser. The truth lives in the store’s order records. The delivery lives in six different platform APIs, each with its own rules. Consent law sits on top of all of it. Doing it right means stitching those layers together and keeping them stitched.

That’s the work. Every line on the checklist is a decision, a configuration, and a thing to maintain.

OR

Or you install CleanClicks.

Here’s the honest split. The setup is minutes: one DNS record and one tag. The list above is the part that never ends, and that’s the part CleanClicks owns: bot filtering, out-of-market filtering, per-platform delivery, dedupe, consent handling, and the ongoing monitoring that catches drift before it reaches a report. You don’t work the checklist. We do, continuously.

Check Your Tracking, Free Prefer a Human? Book a 15-min Walkthrough
FAIR QUESTIONS

Fair questions, straight answers.

Isn’t this list padded to make the work look scarier than it is?
No. Every line is a real configuration or a real maintenance task, and each one is a place the numbers can quietly go wrong. The length isn’t a sales tactic, it’s what accurate cross-platform tracking actually requires today. If anything it’s the short version: each item unpacks into its own set of steps once you sit down to do it.
My platform already does this. Doesn’t Shopify, GA4, or Meta handle server-side and consent for me?
Each platform handles its own slice, on its own terms, and only its own slice. Shopify’s native integration talks to Google. Meta’s setup talks to Meta. GA4 handles GA4. None of them filter bots or out-of-market traffic out of another platform’s feed, reconcile counts against your true orders, or dedupe across sources. In practice, those native integrations are often where the double-counting starts, because two systems fire to the same place and nobody’s reconciling them. The native tools are pieces of the list, not the whole list, and they don’t talk to each other.
Can’t a server-side tagging setup do most of this for less?
A server container gives you the plumbing. It doesn’t give you the bot filtering, the out-of-market filtering, the per-platform dedupe logic, the consent handling, or the daily reconciliation, and it still has to be built and maintained by someone who knows all of the above. The pipe is the easy part. The list is everything that has to run through it correctly, and keep running correctly.
If it’s one DNS record and one tag, why is the list so long?
Because installing is not the same as maintaining. Getting the tag on the page is minutes. Keeping every platform’s numbers accurate, filtered, deduplicated, and consent-compliant as browsers, platforms, and your own site keep changing is the list. CleanClicks makes the install trivial and takes the ongoing work off your plate. Doing it by hand means owning both.
I only run Google Ads. Do I need the Meta, TikTok, and LinkedIn parts?
Only the platforms you actually run. But the foundation, the bot filtering, the out-of-market filtering, the consent handling, and the reconciliation apply no matter how many platforms you’re on. Even a single-platform setup is most of this list. Adding platforms just multiplies it.
How do I know the problem is even that big for me?
You don’t have to take our word for it. The free tracking check looks at your actual setup and shows you where data is leaking, before you decide anything. If your tracking is already clean, you’ll know. If it isn’t, you’ll see exactly where.
SEE WHERE YOU STAND

Skip the list. Keep the accuracy.

The free tracking check shows you where your setup stands today. No commitment.

Check Your Tracking, Free See Pricing