How Should a Small Business Set Up Website Analytics?

By Bill Stilwell · Last reviewed October 16, 2026

The short answer

Write a short measurement plan first: the few questions your data must answer, like “How many quote requests came from Google this month?” Then set up analytics to track useful visits by source and the actions that matter, disclose it in your privacy policy, keep personal information out of it, and make sure the business, not a vendor, owns the account and can export the data.

What this means

Analytics tools count visits and actions on your website. Google Analytics 4 (GA4) is a common free option, but the tool matters less than the plan.

A made-up window cleaning company, ClearView Window Washing, writes a one-page plan:

Question	What to measure	Where
Where do our visitors come from?	Visits by source: search, Google Business Profile (GBP), ads, social, email, referrals	Analytics
Which pages bring in quote requests?	Form submissions and calls by page	Analytics and call tracking
Which sources bring in paying jobs?	Leads by source, matched to jobs and revenue	Customer records

This page also covers four related outline lines: 13.7.2 (traffic tracking), 13.7.7 (privacy controls), 13.7.8 (data ownership), and 13.2.9 (configuring only necessary, disclosed analytics).

Why it matters

Data with no question becomes noise. Without a plan, people set up dashboards they never look at.
Visits alone don’t pay bills. Traffic only matters if it leads to calls, forms, and jobs (see 13.7.5 Appointment and Sales Tracking).
Privacy rules apply to tracking. California’s privacy policy law requires commercial sites that collect personal information from California residents to describe their online tracking practices in their privacy policy. Other states have their own laws.
Google bans personal information in Analytics. Google’s policy says no data may be sent to Google Analytics that Google could use or recognize as personally identifiable information, such as email addresses or phone numbers. Form tools that put an email address in the page address can break this rule without you knowing.
Vendor-owned accounts walk away with your history. If a web designer or agency owns the account, you can lose years of data when you part ways.

Who this applies to

Every business with a website. Even a simple one-page site should know where visitors come from and whether they call or fill out the form.

If you run ads, this is required before you spend (see 20.1 Pre-Spend Checklist).

How to do it

Write three to five business questions. Keep them tied to money and decisions. “Is our GBP sending quote requests?” is better than “How many page views do we get?”
List what to measure for each. Visits by source, key actions like form submissions, calls, and bookings, and the outcomes in your customer records.
Create the account with a business-owned login. Use a business email you control, not a personal account or a vendor’s (see 12.1.2 Email Accounts and Shared Inboxes). Add a second business-controlled admin (see 8.4.6 Two Business-Controlled Administrators).
Give vendors their own access. Add your web designer or agency as a user with only the access they need, and remove them when the work ends (see 11.7.6 Least Privilege Access and 11.7.7 Removing Access When People Leave).
Install only what you need. Add the analytics tag and nothing extra. Every added tool is more data to disclose and protect.
Track visits by source. Analytics sorts visits by channel on its own. Tag your own links in emails, ads, and your GBP website button with Urchin Tracking Module (UTM) parameters so they’re labeled correctly.
Mark your key actions. In GA4, important actions are called key events. Google allows up to 30 key events in a standard property. Mark form submissions, booking confirmations, and tap-to-call clicks (see 13.7.3 Form Tracking).
Keep personal information out. Don’t send names, emails, or phone numbers into analytics. Check that form confirmation page addresses don’t contain them. Google offers data redaction settings that can help.
Set data retention. GA4 standard properties let you keep user-level and event data for 2 months or 14 months. This setting affects explorations and funnel reports, not the standard reports. Pick the shortest period that answers your questions, and match it to your privacy policy.
Disclose it. Update your privacy policy to name your analytics and tracking tools and what they collect (see 13.4.7 Policy Pages). Ask an attorney whether you need a cookie banner or consent tool based on where your visitors live.
Plan for export. Know how to get your data out. GA4 standard properties can export raw events to Google BigQuery, a data warehouse, with a daily limit of 1 million events. BigQuery storage and processing may cost money beyond the free sandbox limits.
Record everything. Save the plan, the account owner, the admins, the retention setting, and the date in your Master Business Record (see 5 Master Business Record).

What proof to keep

The written measurement plan with its date
A screenshot of the analytics account access list
A screenshot of the data retention setting
The privacy policy version that discloses analytics
A list of every tracking tool installed on the site

Store these in your website records folder.

Common mistakes

The agency owns the account. Ask for ownership or admin transfer in writing before work starts.
Tracking everything and answering nothing. Start with the questions.
Emails in page addresses. Some form tools add the visitor’s email to the thank-you page address, which sends it to analytics.
Duplicate tags. Two copies of the analytics tag double-count visits. Check with your tool’s test mode before launch.
Forgetting the privacy policy. Adding tracking without updating the policy means the policy no longer matches what you do.
Counting your own visits. Filter out internal traffic so your team’s visits don’t inflate the numbers.
Never looking. Put a monthly review on the calendar (see 28.2 Monthly Review Checklist).

When to get help from a pro

An analytics specialist: if you run ads or have several sites or tools to connect. Ask:

Is my tracking counting each form and call once, and only once?
Is any personal information being sent to analytics?
Who owns this account, and can I export my data?

An attorney: about privacy disclosures and whether you need a consent banner for your visitors.

Bill’s note

[Bill: add a short story or lesson here. For example, a client who lost years of data when an old agency kept the analytics account, or the three questions you chose for SiteSmarty’s measurement plan.]

If you’d rather have this done for you, SiteSmarty sets up analytics and tracking for local businesses.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: the questions in SiteSmarty’s measurement plan, the tool I chose, and the key events I marked]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the measurement plan, the account access list, and the retention setting]
[Result so far:]

Questions people ask

What should I track on my small business website? Visits by source, form submissions, calls, and bookings. Then connect those leads to jobs and revenue in your customer records.

What is a measurement plan? A short list of business questions your data must answer, what you’ll measure for each, and where that data lives.

Do I need to mention analytics in my privacy policy? Yes. Analytics collects data about visitors. California law requires commercial sites that collect personal information from California residents to describe tracking practices, and other states have their own rules.

How long does Google Analytics keep my data? GA4 standard properties offer 2 or 14 months for user-level and event data in explorations and funnel reports. Standard reports aren’t affected by that setting.

Who should own my analytics account? Your business, using a business email you control. Vendors should get their own user access, not ownership.

Audit check

Question: Is there a written measurement plan, and is analytics owned by the business, limited to needed tools, free of personal information, and disclosed in the privacy policy?
Pass looks like: A dated plan with business questions. A business-owned account with two business admins and limited vendor access. Visits tracked by source with tagged links. Key events marked. No personal information sent. A chosen retention period. Tracking disclosed in the privacy policy. A known export method.
Fail looks like: No plan. A vendor owns the account. Duplicate tags. Emails in page addresses. Tracking not disclosed. Nobody knows how to export the data.
Evidence to collect: The plan, access list screenshot, retention setting screenshot, the privacy policy version, and the list of tracking tools.

Where this fits

Do this first: 13.3.1 Website Objective and Audience, 13.3.5 Conversion Paths, 13.4.7 Policy Pages

Do this next: 13.7.3 Form Tracking

Sources

Google Analytics Help, "Data retention" (checked October 16, 2026)
Google Analytics Help, "Mark events as key events" (checked October 16, 2026)
Google Analytics Help, "Best practices to avoid sending Personally Identifiable Information (PII)" (checked October 16, 2026)
Google Analytics Help, "BigQuery Export" (checked October 16, 2026)
Google Analytics Help, "URL builders: Collect campaign data with custom URLs" (checked October 16, 2026)
State of California Department of Justice, Office of the Attorney General, "Privacy Laws" (checked October 16, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.