6 GA4 Events Every Clinic Site Needs (2 Create Risk)

Key Takeaways

• GA4’s Enhanced Measurement fires page_view automatically and it cannot be turned off, per Google’s own documentation
• The correct conversion event for a clinic enquiry is generate_lead, one of Google’s recommended events, and it never fires without manual setup
• GA4 parameter values are capped at 100 characters by default, except page_location, which allows 1,000 characters of full URL
• The Enhanced Measurement form_submit event can carry the submit button’s visible text in a form_submit_text parameter, a field most clinics never check
• Two OAIC determinations dated 11 June 2026, against Medmate Australia and Monash IVF, are the newest enforcement precedent for tracking mechanisms generally
• A web GA4 property has no limit on the number of distinctly named custom events, but each event is capped at 25 parameters
• Health service providers have been covered by the Privacy Act regardless of annual turnover since the private sector provisions commenced in 2001

Six events decide whether a clinic’s GA4 property actually measures the booking funnel or just counts page loads. Three of them fire the moment you turn Enhanced Measurement on. One needs a developer to build it by hand, or it never fires at all. And two of the six, as at August 2026, can carry a treatment name out of your site inside a tracking parameter nobody thought to check.

This is the practical setup order: what GA4 fires on its own, what you have to build, and where the parameter values quietly turn a conversion event into a health-data leak.

What Google’s Own Documentation Says

Google Analytics Help’s Enhanced Measurement events page lists what a GA4 web data stream collects automatically once Enhanced Measurement is switched on: page_view, scroll, click (for links to external domains), view_search_results, video_start/video_progress/video_complete, file_download, and form_start/form_submit. Every one of those events is toggleable individually in the data stream settings, with one exception. Google’s documentation states plainly that page_view is collected automatically and you cannot turn off collection.

That single sentence sets the shape of everything below it. Whatever URL structure your booking flow uses, the full current address travels with every page load, whether or not you want it to.

Separately, Google Analytics Help’s recommended events page names generate_lead as the standard event for lead-generation conversions. Recommended events are not automatic. Nothing in GA4 fires generate_lead by itself. A clinic gets it only by pushing it through Google Tag Manager or a direct gtag call, typically on a booking confirmation or enquiry thank-you page.

And a third page, GA4 event and parameter limits, sets the ceiling on what any event, automatic or custom, can carry: event names capped at 40 characters, parameter names capped at 40 characters, and most parameter values capped at 100 characters, with named exceptions for page_title (300 characters), page_referrer (420 characters) and page_location (1,000 characters). A web property has no limit on the number of distinctly named events it can send, but each single event tops out at 25 parameters.

What That Means for the Build

Set these up in this order, and the funnel and the risk get handled at the same time rather than one after the other.

Turn on Enhanced Measurement, then audit what it already fires. Under Admin, Data Streams, your web stream, the toggle list controls scroll, click, view_search_results, video events, file_download, and form_start/form_submit. Everything on that list except page_view can be switched off individually. Leave scroll on for content pages, it is cheap engagement signal with no patient data attached. Leave form_start/form_submit on for anything with a booking or enquiry form.

Check the form_submit_text parameter before you trust form_submit. Google’s Enhanced Measurement documentation lists form_submit_text among the parameters a form submission carries, alongside form_id, form_name and form_destination. form_submit_text captures the visible copy on the submit button. A button that reads “Send my Botox enquiry” puts that exact string into the event, sitting next to GA4’s client identifier. Nothing in GA4 strips it. The fix lives in your form markup or a Tag Manager override: keep the button copy generic (“Send enquiry”) or override the parameter value before the tag fires.

Build generate_lead deliberately, because nothing else does it for you. Fire it on the confirmation state of your enquiry or booking form, via a Tag Manager trigger on the thank-you page or a dataLayer.push in your confirmation script. Keep its parameters generic: a lead source and a form category are enough. Do not pass a treatment name as a parameter value here either, the same exposure applies to a custom event as it does to form_submit_text.

Treat any custom “view treatment” event as the highest-risk line in the build. Plenty of clinic sites fire a custom event, commonly named something like view_treatment, on every treatment or procedure page, with the treatment name passed straight in as a parameter value. GA4 places no restriction on what you put in that value beyond the 100-character cap. Google’s own Analytics Terms of Service, section 7, state that you will not pass Google any information Google could use or recognise as personally identifiable information, and while that clause is written around identity generally rather than health specifically, a treatment name tied to a persistent client identifier is exactly the kind of pairing that supports a health inference under Australia’s Privacy Act. Use a generic content category (content_group: injectables) instead of the exact treatment name if you build this event at all.

Leave page_location alone for ordinary content, and override it on treatment URLs. page_view cannot be switched off, and page_location carries up to 1,000 characters of full URL by default. For most of a clinic site that is harmless. For a booking-confirmation path like /book/confirm?treatment=lip-filler, it is the same URL exposure as the custom event above, just running through an event you never chose to enable. Override page_location via a Tag Manager variable on those specific paths, stripping the query string and the treatment slug before the tag fires.

page_location is the outlier by a wide margin, ten times the cap on every other parameter value. That is exactly why it is the field most likely to still be carrying a full URL nobody reviewed.

Watch the 25-parameter ceiling if you stack GTM triggers. A booking-confirmation tag with a treatment category, a form ID, a lead source, a page path and a couple of ecommerce-style fields adds up faster than it looks. Twenty-five is generous for a clinic funnel, but a heavily instrumented custom event can hit it, and GA4 silently drops parameters past the limit rather than warning you.

Six Events, Ranked by What They Do and What They Risk

Three of the six carry no meaningful risk as GA4 ships them. The other three depend entirely on what you name a button, what you pass as a parameter value, and whether anyone checked before the build went live.

A Worked Example

Cosmetic clinic. A two-injector clinic in Fremantle ran Enhanced Measurement on the default settings and had never built generate_lead. Their enquiry form’s submit button read “Book my Botox consult”, captured verbatim in form_submit_text on every submission. Their booking platform link used a plain external URL with no embedded identifier, so the click event was low-risk as-is. The fix took one Tag Manager session: the button copy changed to “Submit enquiry”, a generate_lead trigger was added on the confirmation page with parameters limited to lead_source and form_category, and Realtime confirmed both events firing correctly within the hour.

Cosmetic dental practice. A dental practice offering porcelain veneers alongside general dentistry had a custom view_treatment event firing on every /treatments/* page, passing the exact treatment name (Porcelain Veneers, Teeth Whitening, Dental Implants) as a parameter value, tied to GA4’s own client identifier cookie. Combined with page_view’s unavoidable page_location, the practice was sending the same treatment signal twice on every visit. The rebuild replaced the raw treatment name with a generic content_group value (cosmetic-dentistry, general-dentistry), keeping the engagement signal the marketing team wanted without the exact procedure name attached to a persistent identifier.

Both worked examples land in the same two cells of that map: an automatic event nobody reviewed, and a custom event nobody scoped for what it was allowed to carry.

What to Check on Your Own Site

1. Open Admin, Data Streams, your web stream, and list which Enhanced Measurement toggles are on.
2. Load a booking or treatment page, open your browser’s network tab, and read the page_location value on the GA4 request. Does it carry a treatment name or a query string?
3. Submit your own enquiry form in a test session and check the form_submit_text parameter in GA4 DebugView. Does it echo your button copy verbatim?
4. Search GA4 Admin, Events, for generate_lead. Is it firing, and does it fire only on a genuine conversion step?
5. Search Admin, Events, for any custom event name containing a treatment or procedure name, and open its parameters in DebugView.
6. Count the parameters on your heaviest custom event against the 25-parameter ceiling.

That ordering is a build-priority judgement for a typical clinic funnel, not a scored study: generate_lead and form_submit sit highest because they are the events a booking funnel is actually measured by, and scroll sits lowest because it tells you almost nothing about a conversion.

The Enforcement Anchor

No published OAIC determination names Google Analytics 4 specifically, as at 15 August 2026. The closest available precedent is the pair of determinations against Medmate Australia ([2026] AICmr 41) and Monash IVF ([2026] AICmr 40), both dated 11 June 2026, which applied Australian Privacy Principles 3 and 5 to third-party tracking pixels for the first time. Neither business ran a cosmetic clinic and neither was fined; both were ordered to stop the non-compliant collection within 60 days.

The Commissioner’s reasoning was that a business which commissions a tracking mechanism, controls where it fires, and can configure what it captures is a collector of the resulting data, whether or not the raw data ever touches that business’s own servers. A GA4 property you configure, that fires custom events on pages you control, that sends parameter values you chose, fits the same description; whether that reasoning extends to a specific clinic’s GA4 event setup is a question for your medical defence organisation or your lawyer.

Where This Gets Hard

GA4 has no native setting that reviews a parameter value before it is sent. Google enforces character limits, not content. A clinic can build a perfectly valid, correctly-typed custom event that still passes a treatment name straight into Google’s servers, and nothing in the GA4 interface will flag it. The fix is entirely a build discipline, choosing generic parameter values at the point the tag is written, not a checkbox anywhere in Admin.

The second limit is more mundane. A clinic with no Tag Manager container and no developer relationship cannot build generate_lead, cannot override form_submit_text, and cannot redact page_location on treatment URLs, because every one of those fixes runs through a tag-management layer GA4 itself does not provide. Knowing which six events matter does not close the gap between knowing and shipping for a site with no one able to touch the tag configuration.

Status

GA4’s event architecture is current documented product behaviour, not a legal obligation, and the Privacy Act coverage of health providers regardless of turnover has applied since the private sector provisions commenced in 2001. The Medmate and Monash IVF determinations, both dated 11 June 2026, are the newest enforcement precedent for tracking mechanisms generally, as at 15 August 2026, and no determination has yet named Google Analytics by name.

Frequently Asked Questions

Which GA4 event should a clinic use for a booking or enquiry conversion?

generate_lead, Google’s recommended event for lead-generation conversions. It never fires on its own. Someone has to wire it up through Google Tag Manager or a gtag call on the confirmation step.

Does GA4 automatically track when someone submits a booking form?

Yes, through the Enhanced Measurement form_submit event, which fires without any setup. It also fires form_start on the first field focus, and it can carry the submit button’s visible text in a form_submit_text parameter, which risks echoing a treatment name if the button copy names one.

Can I turn off GA4’s page_view event to stop the URL being sent?

No. Google’s own documentation states page_view is collected automatically and cannot be turned off, so a treatment name sitting in a URL path, such as /book/lip-filler, keeps leaving the site attached to a persistent identifier on every load. The fix has to happen at the URL or parameter level, not the event toggle.

Get Your GA4 Event Setup Checked

RockingWeb can check your GA4 event configuration against the six events above and return a written finding of what fires automatically, what is missing, and which parameters need a second look.

Sources

1. Google Analytics Help, Enhanced Measurement events. Checked 15 August 2026.
2. Google Analytics Help, Recommended events. Checked 15 August 2026.
3. Google Analytics Help, GA4 event and parameter limits. Checked 15 August 2026.
4. Google Analytics Terms of Service, section 7, Privacy. Checked 15 August 2026.
5. OAIC determinations, Commissioner Initiated Investigation into Medmate Australia Pty Ltd (Privacy) [2026] AICmr 41 and Commissioner Initiated Investigation into Monash IVF Pty Ltd (Privacy) [2026] AICmr 40, both dated 11 June 2026, corroborated via Gadens. Checked 15 August 2026.
6. OAIC, Australian Privacy Principles. Checked 15 August 2026.

Last reviewed: 15 August 2026.