Dark social: why your analytics can't see word-of-mouth

I spend most of my time on infrastructure, not on marketing dashboards. So when I started working on attribution, the question I kept coming back to was a naive one: why is the biggest line in most acquisition reports labelled “Direct”?

The standard answer is that those are people who typed the address, or used a bookmark. Loyal customers. Nothing to manage there.

That answer is wrong, and it is wrong in a way that hides the channel we are all trying to build.

What “direct traffic” actually contains

Direct traffic is not a channel. It is what your analytics tool writes down when a visit arrives with no referrer attached. Type-ins and bookmarks land there, but so does every link pasted into WhatsApp, Slack, a DM, an email, or an app that strips referrer data on the way out.

That last category has a name: dark social. It is the recommendation your customer made in a private conversation, arriving on your site with its origin erased.

The distinction matters because the two things behave in opposite ways. Bookmarks are a retention signal. Dark social is an acquisition signal. Merged into one bucket, they cancel each other out and the bucket becomes unreadable.

How much of it is really “direct”?

In April 2023, SparkToro and Really Good Data ran a controlled experiment: 16 dedicated URLs on a clean subdomain, one per network and per sharing method, then a panel of roughly 100 people driving 1,113 real visits over 10 days. Because each network had its own landing URL, they knew the true source of every visit and could compare it against what Google Analytics reported.

Sharing method	Visits reported as “direct”
TikTok, Slack, Discord, Mastodon, WhatsApp	100 %
Facebook Messenger	75 %
Instagram DMs	30 %
LinkedIn (public posts)	14 %
Pinterest (public posts)	12 %
YouTube, public Facebook posts, tweets	mostly attributed correctly

Source: SparkToro, “Dark Social Falsely Attributes Significant Percentages of Web Traffic as Direct”, April 2023.

Every single visit sent through WhatsApp, Slack, Discord, TikTok, or Mastodon arrived with no source at all. Not most of them. All of them. SparkToro notes that its own analytics attributes about 95 % of its traffic to “Direct”, which the team knows is not true.

The detail that changes the reading

You could still argue that the direct bucket is mostly regulars. The academic data says otherwise, and this is the part that made me take the problem seriously.

A peer-reviewed study by Marjan, Graham, Bruce and Mitchell, published in the Journal of Digital & Social Media Marketing (2020, vol. 8, no. 3, pp. 261 to 276), tracked five websites over eight consecutive quarters, around three million hits in total. Two findings stand out:

1. The direct channel carried 37 % of all observed visitors on average, more than total search. It reached 44 % on loyalty and promotion sites, 26 % on transactional ones.
2. Direct traffic repeated far less often than the site average, with a repeat deficit of 29 % on transactional sites and 42 % on promotional ones.

Read the second one again. If direct traffic were bookmarks and type-ins, it would repeat more than average, because those are by definition people who already know you. It repeats considerably less. These are new visitors arriving through a door the dashboard cannot name.

The authors estimate the dark social component at around 17 % to 18 % of total site visits. That is roughly one visitor in six arriving on a recommendation, filed as anonymous.

Why it keeps getting worse

Three things are compounding, and none of them are going to reverse.

Sharing moved into closed apps. The share that used to happen on a public timeline now happens in a group chat. Private messaging overtook open sharing years ago, and messaging apps are the default surface for “look at this” between two people who trust each other.

The cookie fix never arrived. Safari, Firefox and Brave have blocked third-party cookies by default for years. Chrome was supposed to follow, then reversed course in April 2025 and kept them behind a user-choice model, and Google retired most of the Privacy Sandbox APIs in October 2025. So the industry got the worst of both: coverage that is already broken on a large share of browsers, and no standardised replacement to migrate to.

A new referrer-stripping layer arrived. Assistants and AI search surfaces send traffic that frequently lands without a referrer too. It is the same failure mode as dark social, from a new direction, and it inflates the same bucket.

So the “Direct” line grows every year, and every year it is interpreted as brand strength. It is partly that. It is also your recommendation channel, unlabelled.

Why this is an engineering problem, not a reporting problem

Here is the part I care about as a CTO, and the reason no amount of dashboard configuration fixes this.

You cannot recover attribution at click time. By the time the visit reaches your server, the information is already destroyed. The browser did not send a referrer. There is nothing to parse, infer, or clean up. Every tool that promises to “reveal” dark social after the fact is guessing, usually with probabilistic modelling that cannot be audited.

The only place the information still exists is at share time, on the sending side, in the moment your customer decides to recommend you. If you do not capture identity there, it is gone permanently.

That reframes the whole problem. It is not a measurement question, it is an architecture question: can you issue a link that carries its own origin, survives being pasted into any app, and resolves back to a person without a third-party cookie?

Doing that properly means four things:

1. Identity assigned at the moment of sharing, not inferred from the arriving visit.
2. The identifier lives in the link itself, because the link is the only thing that survives a copy and paste into WhatsApp.
3. Resolution happens first-party and server-side, so it does not depend on browser storage that gets cleared, blocked, or partitioned.
4. The chain holds across devices. A recommendation sent on mobile and opened on a laptop is the normal case, not the edge case.

None of that is exotic. It is just work that has to be designed in from the start, and it is the reason most referral tooling quietly under-reports: it was built on the click-time assumption.

What we built, and what it actually cost

At Frak this was not a feature, it was the foundation. The share link is the unit of account: it carries a signed token in its own query string, and attribution fires backend-side when the link is opened, whatever app it was pasted into. We never learn which app the user picked, and it does not matter, because the identity travelled inside the URL rather than in a header the messaging app was free to drop.

I will be honest about the cost, because build-versus-buy posts usually are not. The attribution parameters have to behave identically on web, Android and iOS, which in our case means the same merge rules and precedence logic implemented three times over, in TypeScript, Kotlin and Swift. Getting the small things right (case-insensitive lookups, never re-encoding a merchant’s URL, deciding what survives a device restore and what must not) took far longer than a cookie-based approach would have. If your recommendation volume is small, buying something imperfect is a defensible decision.

What you get in exchange is the thing the direct bucket can never give you: a real cost per acquisition on the channel, and the ability to pay the people generating it. You cannot reward a recommendation you cannot see. Every referral programme that pays out on a self-declared code is working around this exact blind spot, which is one reason so many of them stall.

If you are not going to rebuild your stack

Most teams reading this will not re-architect attribution this quarter. Three things still help, in order of effort:

• Stop reading “Direct” as loyalty. Split it. Visitors landing on a deep product URL with no referrer are almost certainly shared links, not bookmarks. Nobody bookmarks a product page eleven levels deep.
• Give people a share button that tags the link. It will not capture the copy-paste crowd, which is the majority, but a tagged WhatsApp or Messenger share is a tracked one, and it costs an afternoon.
• Ask at checkout. A single “how did you hear about us” field, stored alongside the order, is unfashionable and surprisingly accurate. Compare it against your analytics and the gap will tell you the size of your blind spot.

That comparison is usually the moment the conversation changes. When self-reported recommendation sits at 30 % and your dashboard attributes 2 % to referral, the argument about whether word-of-mouth is worth managing is over.

Frequently asked questions

What is dark social? Dark social is web traffic from links shared in private channels such as WhatsApp, Slack, DMs, and email. Because those apps send no referrer, analytics tools cannot identify the source and file the visit under “Direct”. It is typically recommendation traffic, recorded as anonymous.

Why is my direct traffic so high? Usually because it is not really direct. Controlled testing shows that visits from TikTok, Slack, Discord, WhatsApp, and Mastodon arrive with no referrer 100 % of the time, and Facebook Messenger about 75 % of the time. Cookie deprecation and referrer-stripping AI surfaces push the same bucket higher.

Can Google Analytics track word-of-mouth? Not on its own. GA4 reports what the browser sends it, and private shares send nothing. UTM tags only work when the sharer uses your tagged button, which most people bypass by copying the URL. Measuring recommendation requires capturing identity when the link is created, not when it is clicked.

Is dark social traffic worth anything? It is generally the opposite of low quality. The peer-reviewed data shows direct traffic repeating 29 % to 42 % less often than the site average, which means it is dominated by new visitors rather than returning ones, and it arrives carrying a personal recommendation.

---

I’m Quentin Nivelais, co-founder and CTO of Frak Labs, where we build the infrastructure that makes recommendation a measurable, payable acquisition channel. I write about the engineering behind it, from account abstraction to self-hosted CI, at nivelais.com.