Dark Traffic and Attribution
Last updated
Direct traffic in GA4 is not what it appears to be. A user typing your URL directly into a browser produces a direct session. So does a user clicking a link from a native mobile app, a user who followed a link in a private message, a user who clicked an email link without UTM parameters, and — increasingly — a user who arrived from an AI-generated answer on Perplexity or ChatGPT’s mobile app. GA4 has no way to distinguish these. All of them become (direct)/(none).
Dark traffic is the label for this category: real human traffic from real sources where the source information is missing, so attribution is lost before it reaches your analytics.
What is dark traffic?
Dark traffic is specifically the intersection of genuine human traffic with lost attribution data. The visit happened; GA4 just cannot tell you from where.
GA4 determines a session’s source by checking UTM parameters, the Google Click Identifier (gclid), the HTTP referrer header, and session-level cookie data. When all four return nothing, GA4 defaults to (direct)/(none). That session is dark traffic.
Dark traffic is distinct from simply having high direct traffic. Some direct sessions are genuinely direct — users who have bookmarked the site or type the URL from memory. The problem is that GA4 cannot distinguish those from the dark traffic mixed in with them.
What are the main sources of dark traffic?
In-app browsers are the largest single source for most sites in 2025. When a user clicks a link inside WhatsApp, Instagram, Facebook, LinkedIn, Gmail, or most native mobile apps, the link opens in the app’s built-in browser. These in-app browsers frequently do not pass referrer information to the destination site. The visit arrives with no source, so GA4 assigns it to direct. For sites with active social audiences or email lists, in-app browser traffic is often one of the largest single sources of unexplained direct traffic.
HTTPS-to-HTTP referral stripping occurs when a user on a secure (HTTPS) page follows a link to a non-secure (HTTP) page. The browser does not pass the referrer header in this case, to prevent potentially sensitive referrer data from being exposed over an insecure connection. Any traffic from HTTPS sources landing on HTTP pages appears as direct. Modern sites are almost entirely HTTPS, but legacy redirect chains that pass through HTTP can create this problem.
Untagged links in email campaigns, PDFs, press releases, and internal dashboards are a common source of dark traffic for B2B and media sites. An email newsletter without UTM parameters sends its click traffic to direct. A press release PDF with a bare URL sends its traffic to direct.
Google Business Profile — every click on the website link in a Google Business Profile listing is high-intent traffic from Google Maps. Without UTM parameters on that URL, GA4 receives no referrer and assigns the session to direct.
How do AI search referrals contribute to dark traffic?
AI referral traffic is the fastest-growing new source of dark traffic. AI platforms do not pass referrer information consistently:
- Perplexity passes referrer data in desktop browsers, but visits from Perplexity’s mobile app often arrive with no referrer, registering as direct.
- ChatGPT passes referrer data for some links in some contexts, but ChatGPT mobile app visits frequently arrive as direct.
- Google Gemini traffic is captured by GA4’s AI Assistant channel group where the referrer is passed, but some Gemini mobile app visits are also lost to direct.1
The volume of AI-originated dark traffic is growing as AI platforms scale. For sites where AI citation rate is rising, a corresponding increase in unexplained direct traffic is the expected pattern.
How do you diagnose dark traffic in GA4?
A practical rule of thumb: direct traffic above 25% of total sessions warrants investigation rather than being accepted as genuine direct.
Check the landing page distribution for direct sessions. Genuine direct traffic typically lands on the homepage, primary product or service pages, or the login page — pages a returning user would navigate to intentionally. Direct sessions landing on deep interior pages (specific blog posts, long-tail product pages) are unlikely to be genuine typed-URL visits and are more likely dark traffic from social shares, AI citations, or untagged links.
Compare direct traffic volume to email campaign send dates. If direct traffic spikes immediately after a newsletter send, email without UTM parameters is a likely source.
Review UTM parameter coverage across outbound links. Audit email campaigns, social media profiles, press materials, and Google Business Profile links for missing UTM parameters. Each untagged link sends its traffic to direct.
Cross-reference with AI citation activity. If AI visibility tracking shows rising citation rates for specific content pieces while unexplained direct traffic to those pages rises in parallel, AI-originated dark traffic is the probable cause.
What is the dark SEO funnel?
The standard narrative about dark traffic treats it as a measurement problem to solve. There is a complementary way to read it.
AI citations, social shares, and brand mentions that produce dark traffic are also compounding brand equity. A user who encounters your brand in a Perplexity answer, does not click the citation link, but later searches your brand name directly has been influenced by that citation. That subsequent branded organic search is attributable to the initial AI citation — but only if you are tracking branded search trends alongside AI citation rate.
This is the dark SEO funnel: AI visibility and content reach produce brand awareness that surfaces later as branded search, direct traffic, and word-of-mouth referrals. None of it appears in standard organic session attribution, but all of it can be tracked directionally by monitoring branded GSC impressions in parallel with AI citation data.
For branded search tracking methodology, see branded vs. non-branded traffic analysis. For AI citation rate measurement tools and methodology, see AI visibility measurement.