GA4 Attribution Reports: Direct Inflation, Model Selection, and Finding the Real Source

When you look at the source column in purchase reports and the (direct)/(none) share is above 40%, your data is probably not wrong: there are gaps in your measurement infrastructure. You’re allocating budget to Google Ads and Meta, clicks are coming in, sales are happening, but you can’t be certain how well GA4 is attributing those sales to their ad sources. This translates to an inflated direct share in reports and attribution data of questionable reliability.

In this post, I’ll cover how GA4’s attribution models work, the root causes of direct inflation and source misattribution, and how to audit your current setup. The solution isn’t a single magic switch: it requires addressing multiple layers together, from referral exclusion and UTM discipline to enhanced conversions and first-party cookie source tagging.

How Attribution Works in GA4

GA4, unlike Universal Analytics, uses an event-based measurement architecture rather than session-based. Every interaction is an event, and every event enters the attribution calculation as one or more touchpoints¹.

3 Attribution Models

GA4 has 3 attribution models¹:

Model	How it works	When to use
Data-driven attribution (DDA)	Uses machine learning to compare converting and non-converting journeys, distributing proportional credit to each touchpoint	Default and most accurate model when sufficient data is available
Paid and organic last click	Gives all credit to the last click before conversion (excluding direct)	Simple reporting, low-traffic properties
Google paid channels last click	Assigns credit only to Google Ads clicks; uses last-click for all other channels	Google Ads-focused optimization

In all three models, direct visits don’t receive attribution credit unless the entire journey consists only of direct visits¹.

Scope Difference: Event, Session, User

The same source/medium data in GA4 reports looks different at different scopes:

Scope	Example dimension	What it shows
Event	Source, Medium, Campaign	Credit distributed according to the attribution model
Session	Session source, Session medium	Last-click source that started the session
User	First user source, First user medium	The source from the user’s first visit

Attribution model changes only affect event scope dimensions. Dimensions like Session source and First user source are not affected by model changes³.

Lookback Window

GA4 uses two different default lookback windows³:

• Acquisition key events: 30 days
• Engagement key events: 90 days

For businesses with sales cycles longer than 30 days (B2B, high-ticket products), the default acquisition window systematically ignores the contribution of upper-funnel campaigns³.

Key Events and Conversions

In 2024, GA4 separated the conversion and key event concepts⁴:

• Key event: Any event that matters to the business. Visible in GA4 reports.
• Conversion: An event used for Google Ads campaign optimization and reporting. Ensures consistent measurement between Google Ads and GA4.

This distinction matters because depending on which event type you select in attribution reports, you’ll see different data. The Attribution analysis report works on conversions, while key event reports distribute credit across all channels (paid, organic, direct)⁵.

6 Root Causes of Direct Inflation

Direct inflation doesn’t come from a single cause. Six different root causes typically stack on top of each other, leading to attribution loss on purchase events.

1. Payment Redirects

Payment providers like PayTR, iyzico, and Stripe redirect users to their own domains. When the payment is complete, the user returns to the site, but GA4 may treat this return as a new session. The source of that new session: the payment provider’s domain or direct.

Detection: If you see sources like iyzico.com / referral or paytr.com / referral in the GA4 Session source/medium report, this issue is worth investigating more closely.

Fix: Add payment domains to the referral exclusion list (see the Auditing Your Current Setup section).

2. iOS / Safari ITP

Safari’s Intelligent Tracking Prevention (ITP) policy limits JavaScript-set cookies to 7 days and cookies based on ad-click URL parameters to 24 hours⁶. If a user clicks a Google Ads link today and makes a purchase 3 days later, Safari can’t tie that visit back to the original ad source.

The iOS usage rate in Turkey (StatCounter, March 2026) is around 30% across all devices including desktop⁷. In e-commerce, this rate varies between 25–45% depending on the product category.

Detection: Filter purchase events in GA4 with the Device category and Operating system dimensions. If the direct rate for iOS/Safari is noticeably higher than Android/Chrome, a deeper investigation into ITP impact is warranted.

3. Cross-Device Journeys

A user sees an ad on mobile, then purchases on desktop. GA4 uses Google Signals and User-ID to link users across devices, but both conditions must be met: the user must be signed into their Google account, and the site must have a User-ID implementation. Without both, each device counts as a separate user².

Detection: Check the Cross-device report in GA4. If the User-ID coverage rate is low, cross-device attribution warrants closer investigation.

4. Missing UTM Parameters

Sharing campaign URLs without UTM parameters prevents GA4 from attributing traffic to the correct sources. Meta ads in particular auto-tag URLs with fbclid, but without explicitly setting utm_source, utm_medium, and utm_campaign parameters, GA4 may classify this traffic inconsistently.

Detection: Check the share of purchase events where the Campaign dimension shows (not set). A high rate here is a signal to look more closely at UTM parameter coverage.

5. Missing Referral Exclusion

If the payment provider’s domain isn’t in GA4’s “unwanted referrals” list, a user returning after payment starts a new session as paytr.com / referral. This session overwrites the original ad source.

Detection: Look for payment domains in the Session source/medium report.

Fix: GA4 Admin > Data Streams > Configure tag settings > List unwanted referrals.

6. In-App Browsers

Users who click Facebook and Instagram ads open the link in the app’s built-in browser (in-app browser). This browser doesn’t share cookies with the device’s default browser. When the user later visits the site from Chrome or Safari, GA4 treats them as a new user and a new session.

Detection: In GA4, check the session share for browsers containing “Facebook” or “Instagram” in the Browser dimension. If those sessions have a near-zero conversion rate while direct conversions are high in the same period, the in-app browser effect is active.

Root cause	Estimated impact	Detection time	Fix complexity
Payment redirects	High	5 min	Low (referral exclusion)
Safari ITP	Medium-High	15 min	Medium (server-side tracking)
Cross-device	Medium	10 min	High (User-ID implementation)
Missing UTMs	Variable	5 min	Low (URL discipline)
Missing referral exclusion	High	5 min	Low (admin setting)
In-app browsers	Medium	10 min	High (limited solutions)

Auditing Your Current Setup

The first step to reducing direct inflation is identifying gaps in your existing infrastructure. The three checks below can be completed in 30–45 minutes.

GA4 Admin Check

Referral exclusion list:

1. GA4 Admin > Data Streams > Select your web stream
2. Configure tag settings > Show more > List unwanted referrals
3. Add payment domains: iyzico.com, paytr.com, stripe.com, param.com.tr, and any other payment providers you use

Attribution settings:

1. GA4 Admin > Events > Attribution settings
2. Reporting attribution model: Check that DDA is selected
3. Lookback window: Check whether it matches your sales cycle
4. Channels that can receive credit: “Paid and organic channels” should be selected

GTM Tag Audit

Open your purchase tag in GTM and verify:

• Is the transaction_id parameter being sent?
• Are the currency and value parameters correct?
• Is the tag’s trigger connected to the correct purchase event?
• Is Enhanced conversions active?

A missing transaction_id can cause GA4 to count the same purchase as duplicate events arriving from different sessions.

URL Parameters Live Testing

Test URLs from your ad platforms in a real browser:

1. Google Ads: Is the gclid parameter in the URL?
2. Meta Ads: Is fbclid in the URL? Are utm_source, utm_medium, utm_campaign being added?
3. Email campaigns: Are UTM parameters in the correct format?

# Google Ads (auto-tagging)
https://example.com/?gclid=Cj0KCQjw...

# Meta Ads (UTM + fbclid)
https://example.com/?utm_source=facebook&utm_medium=paid_social&utm_campaign=TR_retargeting&fbclid=Ab12...

# Email
https://example.com/?utm_source=newsletter&utm_medium=email&utm_campaign=april_campaign

Reading Attribution Reports Correctly

GA4’s attribution reports are in the Advertising section. Two core report types answer different questions.

Attribution Analysis: Last Click

The Last Click report offers two key metrics⁸:

• Assists: The number of interactions before the last click in the conversion journey
• All conversions: Total conversions and the selected channel’s share

If a channel has a high assist count but a low last touch conversion count, that channel is effective in the upper funnel but not getting credit at the final step. This pattern is common for display and social campaigns.

Attribution Analysis: Data-Driven (DDA)

The DDA report breaks touchpoints into 4 categories based on their position in the journey⁹:

Metric	Description
Single touchpoint	DDA credit for single-interaction journeys
Early touchpoint	Credit in the first 25% of multi-touch journeys
Mid touchpoint	Credit in the middle of the journey
Late touchpoint	Credit in the final 25% of the journey

This report shows which channels are effective at which stage of the journey. If Google Ads has high early touchpoint credit but low late credit, users are discovering you through ads but converting through a different channel at the final step.

Conversion Paths

In the Advertising > Attribution > Attribution paths report, you can see the full journeys to conversion. What to watch for:

• Direct concentration: If the majority of journeys follow a “Direct > Direct > Purchase” pattern, the root causes above are active
• Channel transitions: If “Organic Search > Direct > Purchase” journeys are high, there may be a referral exclusion or session timeout issue

Explore with Custom Dimensions

GA4’s standard reports can fall short for diagnosing the details of direct inflation. Using custom dimensions in Explore reports enables deeper analysis. For example, you can compare the first-party source information added to the purchase event against the source/medium that GA4 sees.

Solution Approaches

There’s no single method that solves direct inflation on its own. Each solution targets a different root cause, and when applied together they create a cumulative effect.

Quick Wins (30 Minutes)

• Referral exclusion: Add payment domains
• UTM discipline: Add UTM parameters to all campaign URLs
• Attribution settings: Verify DDA is active and lookback window matches your sales cycle

Medium-Term Solutions

• Enhanced conversions: Cross-device and cross-session matching using hashed email or phone¹⁰
• User-ID implementation: Cross-device linking for logged-in users
• First-party cookie source tagging: Write UTM/gclid/fbclid data to a cookie on landing, send it to GA4 as a custom dimension on purchase

Long-Term Solutions

• Server-side tracking: Minimize client-side data loss with sGTM or Cloudflare Zaraz. Collecting events at the edge, enriching them in a server-side layer, and distributing them to multiple destinations (Meta CAPI, GA4 Measurement Protocol, Google Ads) significantly reduces attribution loss. This is the approach we apply with Scout at dnomia.
• Marketing Mix Modeling: Model the gaps that attribution can’t measure at the aggregate level

Critical Rules

Two important constraints should always be kept in mind when implementing solutions:

1. Custom dimensions do not affect the attribution model. Parameters like first_touch_source sent via first-party cookie go to GA4 as event-scope custom dimensions. They are not included in GA4’s DDA or last-click calculations: they can only be used as secondary dimensions in reports.

2. Do not set cookies without consent. The first-party cookie solution requires the user to have granted analytics_storage permission. In a KVKK and GDPR compliant consent setup, cookies must not be written without permission. Add analytics_storage: granted as a trigger condition in GTM.

Footnotes

1. Google Analytics Help, Get started with attribution ↩ ↩² ↩³
2. Google Analytics Help, Attribution analysis report Data-driven model ↩ ↩²
3. Google Analytics Help, Select attribution settings ↩ ↩² ↩³
4. Google Analytics Help, Conversions vs. key events in Google Analytics ↩
5. Google Analytics Help, Cross-channel conversion reporting in Analytics ↩
6. WebKit Blog, Full Third-Party Cookie Blocking and More ↩
7. StatCounter Global Stats, Mobile Operating System Market Share Turkey ↩
8. Google Analytics Help, Attribution analysis report Last Click model ↩
9. Google Analytics Help, Attribution analysis report Data-driven model ↩
10. Google Ads Help, About enhanced conversions ↩

Key Takeaways

• 01 GA4 has 3 attribution models: DDA requires a minimum of 400 key events, below that threshold it silently falls back to last-click
• 02 6 root causes of direct inflation: payment redirects, Safari ITP, cross-device journeys, missing UTMs, missing referral exclusion, in-app browsers
• 03 Referral exclusion and UTM audits are quick wins you can complete in 30 minutes, but they don't fully solve the problem
• 04 First-party cookie source tagging adds the real acquisition source as a custom dimension on the purchase event, without touching GA4 attribution
• 05 Attribution alone isn't enough: combined with MMM, user-level and aggregate-level measurement complement each other

Frequently Asked Questions (FAQ)

+ What should the (direct)/(none) rate be in GA4?

It varies by industry and traffic mix, but in e-commerce a direct rate above 20% on purchase events generally signals a measurement problem. Especially when traffic from Google Ads and Meta is heavy, a low direct rate on purchases is the expected baseline.

+ Does the data-driven attribution (DDA) model work in every GA4 property?

No. DDA requires at least 400 key events in the property and 20,000 total key events within the lookback window. Below that threshold, GA4 silently falls back to last-click without notifying the user.

+ What does referral exclusion do and how do you set it up?

If your payment provider's domain (iyzico.com, paytr.com, stripe.com) isn't in the referral exclusion list, a user returning after payment starts a new session and the original source information is lost. Add them via GA4 Admin > Data Streams > Configure tag settings > List unwanted referrals.

+ Does the first-party cookie solution affect the GA4 attribution model?

No. The source information written to the cookie is sent to GA4 as an event-scope custom dimension. It is not included in attribution calculations: it can only be used as a secondary dimension in reports.

+ How does Safari ITP affect gclid and fbclid?

Safari ITP limits JavaScript-set cookies to 7 days and cookies based on URL parameters from ad clicks (gclid, fbclid) to a 24-hour lifetime. If a user clicks a Google Ads link today and converts 3 days later, Safari cannot tie that visit back to the ad source.