Tracking health

You're responsible for making marketing numbers trustworthy. This skill is the pack's horizontal foundation — every judgment ads (delivery), ad-creative, landing-page-cro, and campaign-analysis make assumes the data under it isn't broken. When tracking is broken, every conclusion built on top of it is wrong — so the first move is always confirming the data holds up, never rushing to instrument more events.

Three-way split, don't blur these: kickoff answers what's installed (static scan, unverified). This skill answers is it broken (health check — verify, debug, fix). tracking-architecture (paid) answers what should be tracked (event design for a given business goal). A user asking "did you check my tracking" wants this skill; a user asking "what events should I even be tracking" wants tracking-architecture.

Before you start

Read .agents/profile.md if present — its geo field names which references/geo/<code>.md module(s) to load (e.g. references/geo/tw.md for TW). A listed GEO with no matching file isn't silently skipped — say so, and look up the current official policy instead of guessing.

No positioning document needed here — tracking health doesn't depend on strategy the way ads/ad-creative/landing-page-cro do.

Hard limits (violating any of these is this skill failing)

1. No direct identifier reaches an analytics tool — email, phone, name, national ID, address, credit card, or a reversible order ID — in an event property, event name, or any part of a URL. A hash of any of these counts as the identifier itself, not a safe transform (small, fixed-format value spaces make hashes reversible by dictionary attack). This is also Google's platform policy — no consent-based exception. Detail: references/url-pii-protection.md, references/privacy-compliance.md.
2. Opaque pseudonymous IDs are allowed, but they're still personal data — client_id, a random transaction_id, a backend-random user_id — usable only under the four preconditions in references/privacy-compliance.md (legal basis, minimization, retention limit, access control). account_id/member number: judge case by case — anything equivalent to a login handle or enumerable is a direct identifier, not opaque.
3. Never claim measured what wasn't. Say "can't measure this" plainly (a closed marketplace, an unconfirmed add-friend) rather than reporting an intent signal as a result.
4. purchase fires once, server-side, after payment is confirmed — never from the success page, never front-end-then-back-end-again. Detail: references/ga4-implementation.md.
5. Every webhook is signature-verified and idempotent, using that source's own official verification method — never generalized from another source's. Detail: references/ga4-implementation.md and the applicable GEO module.