Referrer stripping: why some AI traffic arrives as direct

The mechanism

When you click a link, the browser normally tells the destination which page you came from. That is the referrer header, and it is what lets analytics say a visit came from a particular site.

A page can instruct the browser to withhold it, using rel="noreferrer" on the link or a referrer policy on the page. The click still works and the visit still happens. The destination simply never learns where it came from.

This is a privacy feature and it works as designed. It is not a bug and it is not something a vendor can configure around, because the information was never transmitted.

Where the visit ends up

With no referrer and no campaign tag, GA4 has nothing to attribute the session to and files it as Direct. Server logs record the same thing — the referring page field contains a dash.

Direct is therefore a mixed bucket. It contains people who typed your address, people who clicked from a desktop email client, people arriving from apps that do not pass a referrer, and AI-referred visits with the referrer removed. Nothing in the data separates them, and the mixing happens before the request reaches you.

The practical consequence is uncomfortable: the assistants most protective of their users are the ones your reports will show as sending nobody.

What survives

A campaign tag survives, because it lives in the URL rather than in a header. That only helps on links you wrote, which excludes the citations assistants generate themselves.

Crawler activity survives completely. Your server logs show which assistants read which pages regardless of how their readers later arrive, and that is often the only AI signal available for a stripping assistant.

Aggregate patterns survive weakly. A rise in Direct traffic concurrent with a rise in crawler activity, landing on deep pages rather than your homepage, is consistent with unattributed AI traffic. It is circumstantial and should be labelled as such.

How to bound the gap without inventing a number

Establish a Direct baseline from a period before AI referrals appeared in your data. Watch how Direct moves relative to that baseline as AI referrals and crawler activity change.

Look at the landing page mix within Direct. Typed-address traffic lands on your homepage. A shift towards deep informational pages is a real signal, because nobody types the URL of your comparison page from memory.

Neither method produces an attribution. Both give you a bounded sense of the size of what you are missing, which is the honest ceiling of what is achievable here. Any vendor offering more than that is modelling, and a model presented as a measurement is the thing to watch for.

What to tell your management

Report the identified figure and state the gap in the same sentence. AI-referred sessions we could attribute, with an unknown additional amount inside Direct, is a complete sentence and a defensible one.

Resist the pressure to produce a single confident total. The pressure is real and the total would be fiction, and the first follow-up question exposes it.

The organisations that handle this well treat the gap as a known limitation with a stated size, in the same way they treat sampling error elsewhere. The ones that handle it badly pick a number and then have to defend it.

Explaining this to someone who has not encountered it

The framing that lands is a physical one. Someone recommends your shop to a friend, the friend walks in and buys something, and nobody mentions who sent them. The sale is real, the recommendation worked, and your record shows a walk-in.

That usually resolves the objection that the data must be wrong somewhere. It is not wrong; it is complete about what was transmitted and silent about what was not, which is a different thing from an error.

The follow-up is always whether a different tool would see it. The answer is no, for anyone, because the information never left the browser. A vendor claiming otherwise is modelling, and a model presented as a measurement is worth being suspicious of.

Then move the conversation to what can be measured: crawler attention, tagged links you control, and the bounded shape of the gap. Those are real and they are enough to make decisions with.

Planning around a gap you cannot close

Treat it as a known limitation with a stated size, in the same way a survey states its margin of error. That framing is familiar to anyone who has read research and it stops the conversation becoming about whether the data is broken.

Build the reporting around what survives. Crawler attention, tagged links, and the bounded shape of the Direct anomaly are all real and all defensible, and together they support decisions even without a complete attribution.

Expect the gap to grow rather than shrink. The direction of travel across the industry is towards sending less information, not more, so a measurement strategy that depends on the referrer becoming reliable again is a strategy built on hope.

Finally, be careful with the vocabulary when reporting this. Missing traffic implies something is broken and invites someone to try to fix it. Unattributable traffic describes the situation accurately and points at the right response, which is to measure what survives rather than to keep looking for the referrer.

The wording sounds like a small thing and it determines where the next month of effort goes.

It also changes how the finding is received. Nobody wants to be told their data is broken; most people accept readily that some information was never sent, because that is a fact about the world rather than a failure of theirs.