When you look at GA4 reports today, you might feel like you are missing pieces of the story. More visits are labeled as direct or show up with the (not set) tag. These gaps are not simply tracking errors or messy tagging. A big part of this change is tied to how people browse the internet today.
Enhanced Privacy Online
People are increasingly aware of how much they are tracked online. Ads that seem to follow them everywhere feel intrusive. Headlines about data leaks and privacy scandals have made many cautious. To stop this, they turn to private browsing modes, privacy-focused search engines, and VPN services. For instance, someone using Microsoft Edge might even look for the best VPN for Edge to keep their activity and location private, no matter where they go online. These tools are effective for protecting people, but they make tracking in GA4 significantly more challenging for marketers and website owners.
How Private Browsing Changes the Picture
Private browsing options, such as Incognito mode in Chrome and Private Browsing in Safari, prevent browsers from storing cookies and other session data after the window closes. For the average user, this might seem like a way to keep browsing history private from others at home or at work.
On the tracking side, this means GA4 treats each visit as brand new. Without cookies, there is no way to link the session to a previous visit, and referral information often disappears. The visit ultimately falls into the direct category because GA4 does not know how else to categorize it.
Browsers Focused On Privacy
Safari and Firefox have introduced built-in tracking prevention. Safari’s Intelligent Tracking Prevention and Firefox’s Enhanced Tracking Protection block third-party cookies by default and restrict cross-site tracking.
GA4 relies on first-party cookies; however, these protections still make it more challenging to collect and connect data across different sessions. When cookies are shortened or blocked entirely, it breaks the connection between visits, making it harder to measure repeat behavior.
VPNs & GA4
Virtual private networks (VPNs) hide a user’s IP address and encrypt their online activity. When someone uses a VPN, GA4 may perceive them as coming from a different country or city, and each session may appear to be from an entirely new user.
This creates confusion in geographic reports and can inflate new user counts. Additionally, it can impact targeting strategies and mislead teams about the actual location of their audience.
Search Engines & Privacy
Privacy-focused search engines, such as DuckDuckGo and Brave Search, have gained popularity among individuals who want to minimize data collection and tracking. These engines do not store search histories or share personal information with advertisers.
When someone clicks through from one of these engines, GA4 generally still logs it as organic search traffic. Unlike private browsing or VPNs, these search engines do not completely hide the source. However, they do limit some details and strip tracking parameters, which can make it challenging to understand who is coming to your website from these search engines.
More Direct & (not set) Traffic in GA Reports
In the past, direct traffic mostly meant someone typed your URL into their browser or used a saved bookmark or maybe they clicked on an untagged email link. Now, it serves as a fallback category for any visit where GA4 cannot determine the user’s source.
The (not set) tag appears when GA4 lacks sufficient data to populate certain details, such as a campaign name, page path, or device type. Sometimes this is caused by technical issues, but today it is often a result of privacy tools that intentionally block this information.
Attribution Challenges in GA4
When source data is missing, it becomes significantly harder to determine which marketing efforts are actually effective. If visits from paid ads or email campaigns are labeled as direct traffic, marketers might think those channels are underperforming.
This can lead to wasted money and poor decision-making. Attribution models rely on knowing the actual source of each visit, and when that information is missing, reports lose accuracy and value.
First-Party Data Becomes Essential for Brands
Many businesses are turning to first-party data, which is information that customers give directly through sign-ups, purchases, or surveys. This data is usually more accurate because it comes straight from the source.
Building trust is key. People want clear explanations about why their data is needed and how it will be used. Simple privacy policies and honest messaging make it more likely that people will share their information. When they feel confident, they are more likely to sign up, create accounts, and engage with content.
GA4 Is Still a Must-Have Tool
Even with more privacy tools in use, GA4 remains an essential part of understanding overall trends. It helps track which pages are most popular, where visitors drop off, and how people interact with different parts of a website.
While GA4 might not reveal every detail about a visitor’s journey, it still offers enough insight to guide content and design decisions. Some businesses attempt to use server-side tracking to recover lost data, but this also requires strict adherence to privacy compliance and clear user consent.
Preparing for a Privacy-Focused Future
Privacy tools will continue to evolve and become more common. Instead of resisting, businesses can focus on building trust and providing value. Strong content, helpful resources, and good user experiences encourage people to engage more willingly.
When people feel respected, they are more likely to share their data directly and become loyal customers. Earning this trust is more powerful than any hidden tracking script.
