Your Attribution Is Lying to You

If a large share of your traffic shows up as “direct” in GA4, treat it as a tracking fault to rule out before you credit it to brand demand. In our XRHealth case study, only about half of all leads could be tied to a known source. In two to three weeks, we raised that to 99.9% by keeping campaign tags intact, giving each lead a persistent ID, and carrying the source into the CRM.

Below is where the data was leaking, the four fixes that closed the gap, and what Google’s June 15, 2026, change to the Google Signals setting means for your own setup.

What does “direct” traffic in GA4 actually mean?

Google Analytics labels a session “(direct) / (none)” when it has no clear referral source. Some of that traffic is genuine: people who type your URL or click a link in a PDF. But Google’s own help page lists causes that have nothing to do with brand demand: links without UTM parameters, redirects that can strip those parameters, URL shorteners, and ad blockers.

That is why a large direct share should worry a performance marketer more than it flatters them. When paid clicks lose their source, your campaigns look weaker than they are. You pull budget, second-guess creative, and optimize against a fiction. You also lose the ability to calculate customer acquisition cost (CAC) and lifetime value (LTV) by channel, so every budget decision becomes a guess.

There is no universal “healthy” percentage for direct traffic. It depends on how well known your brand is, how much of your traffic comes from apps, email, and offline material, and how your links are tagged. The useful test is relative: if direct is far larger than your brand awareness can explain, or it rises whenever paid spend rises, audit your tracking before you trust any channel report.

How we took attribution from 50% to 99.9%

The clearest example we have is documented in our XRHealth attribution case study. In analytics, the direct share was far larger than genuine brand demand could explain. Only about 50% of leads could be connected to a known acquisition source, even though the company was investing heavily in Facebook and Google Ads. The paid campaigns looked weaker than they were, because conversions were losing their source before they reached the lead or customer stage.

The leaks were at the handoffs:

• The Facebook click path. Facebook routes outbound clicks through what it calls the link shim, which screens links for safety and lets the destination site see that a visit came from Facebook, but not the page it came from. That alone cannot tie a visit to a paid campaign; the UTM tags have to do that job. In this funnel, as our case study documents, the link-shim redirects between a paid Facebook click and the landing page were removing or altering those tags, so many paid visits reached the site with no campaign attached.
• Page-to-page handoffs. Source data often disappeared as visitors moved between landing pages, the scheduling tool, and sign-up forms.
• No persistent identifier. Without a unique ID, there was no way to link an original click to the lead record, let alone to the customer’s long-term value.

The fix had four layers:

1. Persistent UTM preservation. Campaign parameters were protected through redirects and page transitions, so source and medium survived from click to visit.
2. Unique user IDs. A persistent ID linked the first website session to the CRM lead and, later, to the customer record, so attribution no longer depended on a single browser cookie surviving the whole journey.
3. Redundant checkpoints. Tracking checks at the landing page, the form submission, and CRM entry meant that if data failed at one point, another checkpoint could reconnect the lead.
4. CRM source mapping. Acquisition data was written into the lead record itself, so attribution was available where the team worked with leads, not only inside an analytics dashboard.

In two to three weeks, lead attribution went from about 50% to 99.9%, and unattributed leads fell to roughly 0.1%. CAC and LTV could finally be calculated by channel, campaign, and individual creative, and leadership could decide which markets to scale and which campaigns to pause based on complete data.

What changed in GA4 on June 15, 2026?

Google announced a change to which setting controls whether the GA4 tag collects Google Ads cookies and IDs for a linked Google Ads account. According to its help page on Analytics data controls, that collection had been controlled by both the Google Signals setting in Google Analytics and your Consent Mode settings, and starting June 15, 2026, Consent Mode would become the single control. Under the change, Google Signals only governs whether Analytics data is associated with signed-in user information for behavioral reporting.

Under the new setup, the signal that decides is Consent Mode’s ad_storage. Google’s Ads documentation says ad_storage controls the use of Google Ads cookies and IDs from the Google Analytics tag and the Firebase SDK in Google Ads, and that when ad_storage is denied, Google Analytics will not read or write Google Ads cookies.

The change is about what reaches Google Ads, not about how your GA4 reports count sessions. Two setups deserve a second look. The first is directly affected. The second was already a problem before June 15, but it matters more now that Consent Mode is the only switch.

• You used the Google Signals toggle as your off switch for ads data. It no longer does that job. If ad_storage defaults to granted on your site, the GA4 tag can now collect Google Ads cookies and IDs that the toggle used to hold back. Check that your defaults match the consent rules that apply to your visitors, as well as your consent policy and privacy notice. If you do not want Google Ads to use these cookies and IDs, Google’s help page says you can set the ad_storage default to denied.
• Your consent banner is installed but never updates Consent Mode. If ad_storage defaults to denied and stays denied after a visitor accepts, GA4 will not read or write Google Ads cookies for that visitor, and your linked Google Ads account gets less from Analytics than your visitors agreed to share.

Google has announced two more changes, with dates still to come. Consent Mode’s ad_personalization signal will become the only control over whether Analytics data is used for ads personalization in Google Ads, and IP addresses collected by the Google tag will be encrypted and sent to linked Google Ads accounts, where Google Ads settings govern them. As of October 23, 2026, Google’s help page says the exact dates will be shared later this year.

How do you check whether your own attribution is broken?

1. Watch the trend, not one number. Compare your direct share month by month against paid spend. Direct traffic that rises with spend can point to paid clicks losing their source. Confirm it with the link and handoff tests below.
2. Test your ad links. Use each ad platform’s preview and URL-testing tools, or open your final URLs with your tracking template and test parameters added, rather than clicking your live ads, which costs money and adds test visits to the data you are auditing. Follow every redirect to the landing page, and confirm that UTM parameters and click IDs arrive intact.
3. Test every handoff. Walk a test lead from the landing page through the scheduler, the form, and the CRM, and check that the source is still attached at each step.
4. Add a persistent ID and a backup checkpoint. No single tag should have to survive the whole journey on its own. Where it matters, also send key conversions server-side, so they do not depend on the browser alone. Set all of this up within the consent your visitors have given, and in regulated sectors such as health, check which identifiers you are allowed to pass to ad platforms.
5. Audit Consent Mode. Confirm your ad_storage defaults, and confirm that your banner actually updates them when a visitor makes a choice.
6. Check automated landing pages. If you run AI Max for Search, its Final URL expansion can send a click to a different page on your site than the one in your ad, and Google advises testing your tracking template with those pages before you turn it on. We cover this in how AI Max Final URL expansion affects your tracking.

Attribution is the foundation, not a technical detail

Attribution often gets treated as a tracking problem for the analytics team to sort out. That framing is how teams end up spending months optimizing campaigns on bad data. Every CAC calculation, LTV model, and budget decision sits on top of it. If the foundation is cracked, none of the work above it is reliable.

If you are hiring outside help for paid media, ask how they will verify conversion tracking before they touch your campaigns. Our guide to choosing a PPC management company covers what a good agency checks in its first 30 days. If you want a second look at your own setup, tracking and attribution are part of our web and analytics work.

The method that took one funnel from 50% to 99.9% is not exotic: keep the tags, add a persistent ID, check at every handoff, and put the source in the CRM. The real question is whether you fix the gap before it shows up in your CAC report or after.

Sources: Google Analytics Help, “Updates to Google Analytics Data Controls” (announces the change starting June 15, 2026; accessed October 23, 2026). Google Ads Help, “About consent mode” and “Consent mode reference” (accessed October 23, 2026). Google Analytics Help, “[GA4] Understand (direct) / (none) traffic” (accessed October 23, 2026). Engineering at Meta, “A faster, better link shim” (September 14, 2012). Google Ads Help, “How AI Max for Search campaigns works” (accessed October 23, 2026). Attribution figures: our XRHealth attribution case study, linked above.

Updated October 23, 2026: we rewrote this post, re-checked its facts, and added sources.