GA4 Anomaly Detection: How Insights Works and Where It Falls Short

How GA4 anomaly detection works

Anomaly detection lives inside Analytics Intelligence, the feature that powers the Insights cards on the GA4 Home page and Reports snapshot. Google documents the method in reasonable detail:

• For each metric it watches, GA4 fits a Bayesian state-space time series model to the historical data. A state-space model tracks a hidden "level" (and optionally trend and seasonal components) that evolves over time, with observation noise on top.
• The model produces a prediction and a credible interval for the latest data point. If the observed value lands outside that interval, the point is flagged as an anomaly.
• Training windows depend on granularity: 2 weeks for hourly detection, 90 days for daily, and 32 weeks for weekly.
• Separately, GA4 runs a weekly contribution analysis using principal component analysis to surface segments (a country, a device category) that behave anomalously and make up at least 0.05% of users.

This is a sensible design. A Bayesian state-space model handles trend and weekly seasonality more gracefully than a fixed threshold, and it adapts as your traffic grows. For a single property with a few thousand sessions a day, the automated insights are often correct.

Automated insights vs custom insights

GA4 splits the feature into two halves, and the distinction matters for alerting.

• Automated insights are generated by Google with no configuration. They appear on the Home page, in the Reports snapshot, and in the Insights dashboard. They are never emailed. You see them only if you log in.
• Custom insights are conditions you define: a metric, a segment, an evaluation frequency (hourly, daily, weekly, or monthly) and a condition. The condition can be "Has anomaly", which delegates to the same Bayesian model, or an explicit rule such as "% decrease more than 20". Custom insights can email a list of addresses, and you get up to 50 per property.

So the honest summary is: GA4 has anomaly detection, and it has email alerts, but you only get both together by creating a custom insight with the "Has anomaly" condition on each metric you care about, on each property. The step-by-step is in how to get an email when GA4 traffic drops.

Where GA4 anomaly detection falls short

1. No sensitivity control

The credible interval is whatever the model decides. There is no slider, no threshold, no "alert me on smaller deviations". If the model is too quiet on a noisy property, or too chatty on a stable one, your only option is to abandon "Has anomaly" and write fixed percentage rules, which then fire on every quiet Sunday.

2. Detection is a black box

When an insight fires you get the metric, the observed value, and the expected range. You do not get the model state, the components that shifted, or a reason. Debugging "why did this fire on Tuesday but not last Tuesday" is not possible.

3. One property at a time

Insights are scoped to a property. With ten properties you configure ten sets of custom insights and receive ten unrelated emails. There is no view that says "eight properties normal, two dropped", and no way to see that all of them dipped together (which usually means a tracking or platform issue, not ten separate problems).

4. Email only

Custom insights notify by email. There is no Slack, Discord, or webhook delivery, so the alert cannot land where a small team actually talks.

5. No root cause

The weekly contribution analysis can surface anomalous segments, but it is not tied to the alert you received. You still open GA4, add a secondary dimension, and compare periods by hand to find out that the drop was all mobile organic from one country.

6. Metric coverage is opaque

Google does not publish the list of metrics evaluated by automated insights. Custom insights offer a predefined metric list (users, sessions, key events, revenue, event count, views, engagement rate, and a few more), not arbitrary custom metrics.

The modified Z-score / MAD approach, in plain terms

Plask takes a deliberately simpler route, based on robust statistics rather than a fitted time series model. Every day at 06:00 UTC it syncs yesterday's daily totals for eight core metrics and runs this check for each metric on each property:

1. Take the last 28 days of the metric as the baseline. If at least four of those days fall on the same weekday as the day being evaluated, use only those, so Mondays are compared to Mondays.
2. Compute the median of the baseline, and the Median Absolute Deviation (MAD): the median of how far each baseline day is from that median.
3. Compute the modified Z-score: 0.6745 × (today − median) / MAD. The constant makes the score comparable to a standard Z-score when the data happen to be normally distributed.
4. Compare the absolute score against the property's threshold: 4.0 (low sensitivity), 3.0 (default), or 2.0 (high). At or above the threshold is critical; within 0.5 below it is warning; within 1.0 below it is info.

Why median and MAD instead of mean and standard deviation?

• Outliers do not poison the baseline. A Product Hunt launch that tripled traffic for one day barely moves the median and MAD, but it inflates the mean and especially the standard deviation for the next four weeks, which quietly widens the "normal" band and hides the next real drop.
• It works on small numbers. Indie sites with 80 sessions a day are noisy. Plask adds minimum floors (for example, it does not evaluate a property whose median sessions are under 10) so tiny properties do not generate meaningless alerts.
• It is explainable. Every alert carries the observed value, the baseline median, the percentage change, and the score. You can recompute it from the CSV export.

Side by side

When each is the better choice

Use GA4's built-in detection when you have one property, you are in GA4 regularly anyway, you want hourly detection on a web stream, or your traffic has strong multi-month seasonality that a long training window captures well. It is free and requires nothing outside Google.

Use a MAD-based monitor like Plask when you manage several properties, want to decide how sensitive detection is, need alerts in Slack or Discord, or want the alert to arrive with an explanation attached. It is also the better fit for small and noisy properties, where robust statistics and minimum floors keep the alert count sane.

You do not have to choose. Many people keep GA4's automated insights on and add Plask for delivery, tuning, and the portfolio view. The Free tier covers two properties, which is enough to compare both systems on real data before deciding. Full details are on the anomaly alerts feature page, and the head-to-head comparison is at Plask vs GA4 custom alerts.