Google Universal Analytics (UA- tracking IDs) was permanently shut down on July 1, 2024. Any codebase still referencing analytics.js or a UA-XXXXXXXX-X tracking ID is collecting zero data — the service is gone. Operators may not notice for months because the UI still renders and no error is thrown. Beyond UA, running analytics SDKs two or more major versions behind current (CWE-1357) means missing security patches and compatibility fixes, and relying on deprecated API surfaces that platforms remove without warning.
Low because an outdated SDK version degrades observability and may miss security patches (CWE-1357), but does not directly expose user data or create an availability risk.
Replace any Universal Analytics tracking ID with a GA4 measurement ID in your analytics initialization:
// Before (no longer collecting data — UA was shut down July 1, 2024):
gtag('config', 'UA-XXXXXXXX-1')
// After (GA4):
gtag('config', 'G-XXXXXXXXXX')
For other analytics packages, run npm outdated to surface packages two or more major versions behind. Check the platform's migration guide before upgrading — analytics SDK major versions frequently include breaking changes to initialization options and event schemas. Update package.json and re-test your key tracking events after upgrading.
ID: marketing-analytics.data-quality.analytics-version-current
Severity: low
What to look for: Check the installed version of analytics packages in package.json against known major version milestones. Specifically look for:
gtag.js vs. legacy Universal Analytics (analytics.js) patterns — UA was sunset in July 2024mixpanel-browser v2.x vs. v3.x (v3 was a significant rewrite)google-analytics (old npm package) vs. @google-analytics/data (GA4)Pass criteria: Count every analytics-related package in package.json. All analytics packages are within 1 major version of current, and 0 sunset/deprecated analytics platforms are in use (no Universal Analytics patterns). Report the count even on pass: "N analytics packages checked, all within 1 major version."
Fail criteria: Universal Analytics (analytics.js or UA-XXXXXXXX-X tracking IDs) is detected (UA was sunset July 1, 2024), or at least 1 analytics package is 2 or more major versions behind.
Skip (N/A) when: No analytics is present. Skip if no versioned analytics npm packages are used (script-tag-only setup).
Detail on fail: "Universal Analytics (UA-) tracking ID pattern detected. Google Universal Analytics was permanently shut down on July 1, 2024 — no data is being collected. Migration to GA4 (G- tracking ID) is required."
Remediation: Migrate from Universal Analytics to GA4. Replace the UA tracking ID in your analytics config:
// Before (UA — deprecated, no longer collecting data):
// gtag('config', 'UA-XXXXXXXX-1')
// After (GA4):
gtag('config', 'G-XXXXXXXXXX')
For other outdated packages, run npm outdated to identify which package.json dependencies have newer major versions. Review the changelog before upgrading — analytics SDK major versions often include breaking changes to event schemas.