--- title: "Dark Traffic and Attribution" description: "What dark traffic is, why direct traffic in GA4 overstates genuine direct visits, and how AI referrals add a new layer of attribution loss." tldr: "Dark traffic is real human traffic that arrives at your site but whose source GA4 cannot identify, so it defaults to (direct)/(none). Sources include untagged links, HTTPS-to-HTTP referral stripping, in-app browsers (WhatsApp, Instagram, Gmail, LinkedIn), and private social shares. AI referrals add a smaller source: Perplexity and Gemini app visits often lose the referrer, and ChatGPT visits rely on a UTM tag it adds to most links, landing in direct when the tag is missing. The useful reframe: AI citations compound into branded search and direct traffic, making some dark traffic an indirect SEO outcome worth tracking." publishDate: 2026-05-31 updatedDate: 2026-10-16 author: "Liam Hayward" --- Dark traffic is visits from real people whose source is lost before it reaches your analytics, which is why so much of it sits in GA4's (direct)/(none) channel. A user typing your URL directly into a browser produces a direct session. So does a user clicking a link from a native mobile app, a user who followed a link in a private message, a user who clicked an email link without UTM parameters, and, increasingly, a user who arrived from an AI-generated answer on Perplexity or ChatGPT's mobile app. GA4 has no way to distinguish these. All of them become (direct)/(none). ## What is dark traffic? Dark traffic is specifically the intersection of genuine human traffic with lost attribution data. The visit happened; GA4 just cannot tell you from where. GA4 reads a session's source from the campaign (UTM) parameters in the landing page URL, then from click identifiers such as gclid, then from the HTTP referrer. Google's documentation says a session is processed as direct "when no information about the referral source is available, or when the referring source or search term has been configured to be ignored".[^2] That session is dark traffic. Dark traffic is distinct from simply having high direct traffic. Some direct sessions are genuinely direct: users who have bookmarked the site or type the URL from memory. The problem is that GA4 cannot distinguish those from the dark traffic mixed in with them. ## What are the main sources of dark traffic? **In-app browsers** are a large source for any site with a social or email audience. When a user clicks a link inside WhatsApp, Instagram, Facebook, LinkedIn, Gmail, or most native mobile apps, the link opens in the app's built-in browser. These in-app browsers frequently do not pass referrer information to the destination site. The visit arrives with no source, so GA4 assigns it to direct. For sites with active social audiences or email lists, in-app browser traffic is often a large source of unexplained direct traffic. **HTTPS-to-HTTP referral stripping** occurs when a user on a secure (HTTPS) page follows a link to a non-secure (HTTP) page. The browser does not pass the referrer header in this case, to prevent potentially sensitive referrer data from being exposed over an insecure connection. Any traffic from HTTPS sources landing on HTTP pages appears as direct. Modern sites are almost entirely HTTPS, but legacy redirect chains that pass through HTTP can create this problem. **Untagged links** in email campaigns, PDFs, press releases, and internal dashboards are a common source of dark traffic for B2B and media sites. An email newsletter without UTM parameters sends its click traffic to direct. A press release PDF with a bare URL sends its traffic to direct. **Google Business Profile.** Every click on the website link in a Google Business Profile listing is high-intent traffic. Without UTM parameters on that URL, GA4 has nothing to separate that click from any other visit arriving from Google's surfaces, and a click from the Maps app can arrive with no referrer at all, landing in direct. Since June 2026 GA4 has also imported website clicks and six other profile metrics directly through its Google Business Profile integration, which reports the profile's own count of clicks alongside whatever the sessions were attributed to. ## How do AI search referrals contribute to dark traffic? AI referral traffic is a new source of dark traffic, though a smaller one than the label suggests: Seer Interactive's tracking guide argues that AI-sourced traffic "may actually be more trackable than traditional dark traffic sources".[^3] What gets lost is lost at the edges: - **Perplexity** passes referrer data in desktop browsers, but visits from Perplexity's mobile app often arrive with no referrer, registering as direct. - **ChatGPT** tags the links it cites with `utm_source=chatgpt.com`, but most of its clicks arrive with no referrer, so the tag is what identifies the visit; when a bug stripped the tag from 8 to 15 October 2026, those visits were counted as direct.[^4] - **Google Gemini** traffic is captured by GA4's AI Assistant channel group where the referrer is passed, but some Gemini mobile app visits are also lost to direct.[^1] Two mechanics decide how much of this survives. ChatGPT appends `utm_source=chatgpt.com` to most of the links it presents as sources, and a UTM parameter rides in the URL, so it survives an in-app browser that strips the referrer; Seer's testing found the parameter on citation links "usually" and on search-result links not at all, with Perplexity, Gemini and Claude passing a referrer only.[^3] And GA4's AI Assistant channel is referrer-matched: Google's release note assigns the `ai-assistant` medium "when the referrer matches a recognized AI Assistant",[^1] so a visit that arrives without one cannot reach the channel, and the channel total is a floor on AI traffic rather than a count of it. The volume of AI-originated dark traffic is growing as AI platforms scale. For sites where AI citation rate is rising, a corresponding increase in unexplained direct traffic is the expected pattern. ## How do you diagnose dark traffic in GA4? A practical rule of thumb: direct traffic above 25% of total sessions warrants investigation rather than being accepted as genuine direct. **Check the landing page distribution for direct sessions.** Genuine direct traffic typically lands on the homepage, primary product or service pages, or the login page: pages a returning user would navigate to intentionally. Direct sessions landing on deep interior pages (specific blog posts, long-tail product pages) are unlikely to be genuine typed-URL visits and are more likely dark traffic from social shares, AI citations, or untagged links. **Compare direct traffic volume to email campaign send dates.** If direct traffic spikes immediately after a newsletter send, email without UTM parameters is a likely source. **Review UTM parameter coverage across outbound links.** Audit email campaigns, social media profiles, press materials, and Google Business Profile links for missing UTM parameters. Each untagged link sends its traffic to direct. **Cross-reference with AI citation activity.** If AI visibility tracking shows rising citation rates for specific content pieces while unexplained direct traffic to those pages rises in parallel, AI-originated dark traffic is the probable cause. ## What is the dark SEO funnel? The standard narrative about dark traffic treats it as a measurement problem to solve. There is a complementary way to read it. AI citations, social shares, and brand mentions that produce dark traffic are also compounding brand equity. A user who encounters your brand in a Perplexity answer, does not click the citation link, but later searches your brand name directly has been influenced by that citation. That subsequent branded organic search is attributable to the initial AI citation, but only if you are tracking branded search trends alongside AI citation rate. This is the dark SEO funnel: AI visibility and content reach produce brand awareness that surfaces later as branded search, direct traffic, and word-of-mouth referrals. None of it appears in standard organic session attribution, but all of it can be tracked directionally by monitoring branded GSC impressions in parallel with AI citation data. For branded search tracking methodology, see [branded vs. non-branded traffic analysis](/seo-analytics/branded-vs-non-branded/). For AI citation rate measurement tools and methodology, see [AI visibility measurement](/ai-search/ai-visibility-measurement/). [^1]: [What's new in Google Analytics: AI Assistant channel — Google Analytics](https://support.google.com/analytics/answer/9164320#05132026) [^2]: [Campaigns and traffic sources — Google Analytics Help](https://support.google.com/analytics/answer/11242841) [^3]: [Your AI traffic is hiding: a practical guide to tracking ChatGPT, Claude, and more — Seer Interactive](https://www.seerinteractive.com/insights/are-ai-sites-like-chatgpt-sending-your-website-traffic), updated 22 June 2026. [^4]: [Cedric Huesler on the ChatGPT tagging fix, LinkedIn](https://www.linkedin.com/posts/cedrichuesler_relieved-it-was-a-bug-chatgpt-is-tagging-share-7516558430854152192-vTAO/), 15 October 2026, citing Adobe telemetry across thousands of domains.