Why Is My Paid Traffic Showing as Direct in GA4?

Paid traffic lands in (direct) / (none) when the session arrives with no source signal at all: no UTM parameters, no click identifier, no usable referrer, and no cookie from an earlier tagged visit.

Direct is not a channel. It is what GA4 writes when everything else failed.

The cause is nearly always upstream: the link shipped untagged, a redirect dropped the query string, or consent blocked the hit before it fired. The triage below finds most of them in five minutes.

TL;DR

• Untagged paid social is the single biggest cause, because nothing on Meta, LinkedIn or TikTok inherits parameters from campaign to ad.
• When a click carries both a click identifier and manual UTMs, GA4 uses the auto-tagged values.
• iOS strips click identifiers, not UTMs, and only in Mail, Messages and Private Browsing by default.
• Consent misconfiguration produces a regional Direct spike that looks exactly like a tagging failure.
• For a known paid campaign, expect under 5 to 10 percent of clicks in Direct. Sitewide, 5 to 20 percent is normal.
• Server-side tagging hardens attribution against cookie expiry. It does not tag your links for you.

The Five-Minute Triage

1. Open a live ad URL in a private window. Copy the destination straight from the ad platform, watch every redirect, and read the address bar once the page settles.

No UTM parameters at all: the link shipped untagged, or a redirect stripped them. Causes 1, 2 and 11.

Parameters that appear then vanish: a client-side router is rewriting the URL. Cause 5.

2. Click the same link with DebugView open. Admin, then Data display, then DebugView. Switch debugging on with the Google Analytics Debugger extension or Tag Assistant, then read the session_start parameters.

Parameters correct in DebugView but Direct in reports: the collection is fine, so look at channel rules, cross-domain settings and consent. Causes 6 and 4.

No event at all: something blocked the hit. Consent, a blocker, or a tag that never fired. Cause 4.

3. For Google Ads, check auto-tagging and the account link. Auto-tagging lives under Admin, Account settings, Tracking, and the box that tags destination URLs must be ticked. Then confirm GA4 is linked to the child account running the ads rather than a parent manager account. Turning personalised advertising on keeps the full data flow.

Auto-tagging off means no click identifier on any click from today forward, and no way to recover yesterday’s.

How GA4 Decides a Session Is Direct

GA4 resolves source and medium once per session, working through the signals in order:

1. Click identifiers. gclid, gbraid and wbraid attribute to Google Ads, dclid to Display and Video 360. When a click carries both a click identifier and manual UTMs, the auto-tagged values win, and your manual values populate the Manual dimensions.
2. UTM parameters on the landing URL.
3. The referrer, mapped through GA4’s source rules: search engines to organic, known social domains to organic social, the rest to referral.
4. Cookie continuation. A returning visitor with no fresh signal inherits their previous non-direct source.
5. (direct) / (none) when nothing else resolved.

Two things worth knowing. GA4 now ships an AI Assistant channel that classifies assistant referrals automatically, but most assistant apps send no referrer, so those clicks still land in Direct and inflate it for reasons that have nothing to do with your tagging.

And session-scoped reports use last non-direct click while event-scoped conversion reports can use data-driven attribution. Two reports disagreeing does not mean one is broken.

The Twelve Causes

#	Cause	Typical signature
1	Untagged paid social or display	Direct spike on a paid lander; no parameters in the ad’s URL field
2	Redirect chain strips the query string	Parameters in the click URL, gone on landing
3	Auto-tagging off or the wrong account linked	Google Ads clicks rise, GA4 paid search flat
4	Consent misconfiguration	Direct spikes in one region after a banner change
5	App router rewrites the URL	Address bar clean moments after landing
6	Cross-domain misconfigured	A hop between domains starts a new Direct session
7	In-app browsers	Mobile Direct far above desktop on the same campaign
8	Cookie lifetime limits	Returning visitors show as Direct
9	iOS stripping click identifiers	Mail and Messages clicks lose click IDs; UTMs survive
10	ESP or shortener rewrites links	Owned-channel links land bare
11	Server-side redirect drops the query string	Vanity URL setups without a preserve flag
12	Idle tabs starting new sessions	Paired sessions on one visitor, second one Direct

The order is roughly how often each one bites. The ones worth explaining follow.

Untagged paid social

A campaign launches, the ad platform reports clicks, and GA4 shows Direct on the landing page. Usually desktop creative got tagged during review and mobile did not.

Nothing inherits on Meta, LinkedIn or TikTok: parameters live on the ad, so every ad needs its own. Check the ad-level URL parameter field against your tagging spec, then filter GA4 by landing page to size the gap.

The durable fix is refusing to launch untagged. Terminus, the marketing taxonomy governance platform, validates the values when the link is built, which scales further than a spot check before every launch.

Redirect chains

The click URL is clean, the landing URL has no query string, and GA4 reads what the browser shows it.

Trace every hop and find the one whose Location header drops ?utm_. Then either point the ad at the final URL, which removes the problem entirely, or make the redirect preserve the query string. In Apache that is the QSA flag; in Nginx, appending ?$args. CDN rule editors usually have a preserve-query toggle that defaults to off.

Consent

A banner change lands, and Direct spikes in the EEA and UK while ad-platform click counts hold steady.

Watch a fresh session’s network tab. If analytics storage stays denied past the first interaction, GA4 is in cookieless mode. Confirm all four consent signals are configured, that defaults are set before any tag fires, and that the Conversion Linker runs on initialisation rather than after a click.

The trap worth naming: banners that deny by default and only grant on click mean a visitor who reads and leaves is invisible. That accounts for a good share of Direct spikes blamed on Apple.

In-app browsers

Mobile sessions from paid social show far more Direct than desktop from the same campaign.

If parameters are present and sessions still land in Direct, the embedded browser is interfering with the tag rather than the link. Server-side tagging is the mitigation, because the events come from your own endpoint rather than the browser reaching Google directly.

Cookie lifetimes

A visitor clicks a paid ad on Monday, returns the following Monday, and arrives as a new user with no source.

Safari caps cookies written by JavaScript at 7 days, and at 24 hours when the landing link carried tracking parameters from a classified tracker. Compare returning-user share by browser: Safari well below Chrome on the same audience means cookies are collapsing.

Setting cookies from your own server extends them, with one condition covered in the server-side section below.

iOS stripping

The cause everyone over-attributes.

What it removes: click identifiers on a community-documented list, most consistently gclid, fbclid and msclkid, with dclid, twclid and mc_eid also widely reported. Apple publishes no list. Reporting on gbraid, wbraid and li_fat_id has been inconsistent across releases.

What survives: every utm_ parameter, because they label a campaign rather than identify a person.

Where it applies: Mail, Messages and Safari Private Browsing by default. The default is a setting, though: Settings, Safari, Advanced, Advanced Tracking and Fingerprinting Protection offers Off, Private Browsing and All Browsing, so a visitor can turn it off entirely or widen it to every Safari session. Whether recent Safari versions moved that default is disputed between testers, and no source on either side cites Apple documentation showing a change.

What it means: if you rely on gclid alone, those clicks land in Direct. Add a Final URL Suffix carrying channel-level UTMs and the channel survives even when the click identifier does not. Full detail in what link tracking protection strips.

The Diagnostic Flow

1. Confirm there is a problem. Filter Traffic acquisition to the paid landing page. More than 5 to 10 percent Direct is worth chasing.
2. Isolate it. Add browser and device as secondary dimensions. Mobile Safari and in-app browsers point at causes 7 and 9. One landing page points at 2 or 11. One campaign points at 1 or 10.
3. Inspect a live ad URL. Missing parameters means cause 1. Disappearing parameters means 2, 5 or 11.
4. Verify what GA4 received in DebugView. A mismatch with the URL means the tag read a different page state.
5. For Google Ads, check auto-tagging and linking first. Those two resolve a large share on their own.
6. Check consent if the pattern is regional.
7. Walk a cross-domain funnel and watch for the _gl linker on each hop.
8. Trace an email link end to end for owned channels.
9. Size the leak by comparing platform clicks to GA4 sessions for the same period and landing page.
10. Move the fix upstream so it does not recur.

Server-Side Fixes, With the Condition

Server-side tagging routes hits through a subdomain you control, which sidesteps blockers matching on Google’s domains and lets cookies come from an HTTP response rather than JavaScript.

One condition matters and is usually omitted. Since Safari 16.4, a server-set cookie is capped at 7 days too when the subdomain is a CNAME to a third-party host or its IP falls outside the range serving your main site, which describes most managed setups. Serve the endpoint from your own infrastructure or the durability you paid for does not arrive.

The Measurement Protocol sends backend events directly, for conversions that should not depend on a browser being open. Pass the original client_id and session_id or the event floats free of the session it belongs to.

First-party tokens replace platform click identifiers in links you control. A parameter you invented is not on anyone’s strip list.

None of this tags an untagged ad. Server-side work is a durability layer over clean tagging, never a substitute.

What Acceptable Looks Like

Where	Healthy	Investigate above
Sitewide Direct share	5 to 20 percent	25 percent
Paid landing page	0 to 5 percent	10 percent
Homepage	15 to 40 percent	50 percent
Deep product page	0 to 10 percent	20 percent
Converting sessions	5 to 15 percent	25 percent

Homepage Direct is mostly legitimate: type-ins, bookmarks, habit. Direct on a deep page nobody would type from memory is a leak.

Monitoring for Drift

Build a weekly exploration of Direct share by landing page and alert when one crosses your threshold. Reconcile ad-platform clicks against GA4 sessions daily for paid landers. Put a redirect tracer in CI that hits every vanity URL with test parameters and fails the build when they do not survive. And govern the vocabulary so malformed values never ship in the first place.

FAQ

Why is Google Ads traffic showing as direct?

Auto-tagging off, a redirect stripping the click identifier, or GA4 linked to a parent manager account rather than the child running the ads. Check auto-tagging first, then trace the click URL.

Why is Meta traffic showing as direct?

Almost always untagged ads. Nothing inherits from campaign or ad set, so each ad needs its own parameters. Meta has been reported to append defaults built from IDs when an ad has none, but that is practitioner reporting rather than documentation, so check a live click.

Does iOS cause paid traffic to show as direct?

Only where you depend on a click identifier alone. Apple’s stripping removes click IDs in Mail, Messages and Private Browsing by default, and leaves UTM parameters intact. Pair click identifiers with channel-level UTMs and the channel survives.

What is the difference between (direct) / (none) and (not set)?

Direct means no source signal existed. (not set) means the event arrived but a particular dimension could not be resolved, often through cardinality limits or late-arriving cost data.

Will server-side tagging fix this?

It helps with cookie expiry, blockers and embedded browsers, subject to the hosting condition above. It does nothing about untagged links or stripped redirects.

Should I turn auto-tagging off and use UTMs instead?

No. That usually makes things worse, since the click identifier is also how cost and impression data reach GA4. Keep it on and add UTMs through the Final URL Suffix. They coexist, with the auto-tagged values winning inside GA4.

How much paid traffic in Direct is normal?

For a known paid campaign, under 5 to 10 percent. Above that, look at the link, the redirect chain and the consent setup in that order.

How do I find which campaigns are losing parameters?

Build an exploration filtered to (direct) / (none), grouped by landing page. The paid landers at the top are your leaks, and comparing their session counts to platform clicks sizes each one.

Can I recover lost attribution retroactively?

No. Once a session is written as Direct, the source is gone. Custom channel groups can re-bucket sessions that did capture a source, which is a different problem.

Why is paid traffic showing as referral instead?

GA4 read a referring domain but no paid medium, usually because a network or affiliate redirect injected itself into the chain without preserving your parameters. Fix the tagging upstream and add the domain to your unwanted referrals list.