A B2B portal had zero GA4 data. One line of code revealed why

A global ingredients company's B2B customer portal, built on the Salesforce Experience Cloud and protected by single sign-on, was sending no data to GA4. Multiple teams were involved in the debugging process. Two AI-generated diagnoses pointed to the site's Content Security Policy as the problem. The actual issue was much simpler: the Tag Manager container had been installed incorrectly.

• The portal generated 0 GA4 hits despite the Salesforce team confirming that tags were firing.
• The Tag Manager container was installed as a bare script instead of the standard snippet.
• No gtm.js event entered the dataLayer, leaving the All Pages triggers inactive.
• The single-page application pushed no navigation events, limiting measurement even if the container worked.
• Two AI-generated reports incorrectly blamed the Content Security Policy and recommended a security rebuild.

• Identify exactly where data stopped reaching GA4.
• Separate the actual tracking issue from incorrect security-policy assumptions.
• Restore a reliable measurement path for portal page views and key events.
• Give the development team a clear, testable implementation path.

• Reproduced the issue on production using the client's authenticated portal access, observing approximately 62 requests per page load with none reaching GA4.
• Sent a raw test event to GA4 Realtime to confirm that the GA4 property, filters, consent, and network transport were functioning.
• Inspected the container installation and identified the missing gtm.js event caused by the bare script implementation.
• Verified that the Content Security Policy already allowed the required inline scripts and Google domains, ruling out the proposed nonce-based security fix.
• Identified the second measurement gap: the portal's app was not pushing navigation events into the dataLayer.
• Created a developer instruction document with acceptance checks covering the standard snippet, dataLayer navigation events, and key-event tracking.

• 0 GA4 hits were reaching the property from production despite approximately 62 requests per page load.
• 4 suspected causes were cleared through live testing: GA4 configuration, consent, Content Security Policy, and network transport.
• 2 AI-generated diagnoses were refuted using evidence from the live environment.
• 1 production debugging session was enough to prove the root cause.
• 2 concrete fixes were handed to the portal development team: replace the bare container tag and add navigation events to the dataLayer.
• No security rebuild was required; the existing policy was already sufficient.