One Journey, Two Sessions: How Cross-Domain Tracking Quietly Breaks

The customer journey looks like this: they read a blog post on your marketing site, click through to your checkout on a different domain, and buy.

GA4 reports two visitors. One who read a blog post and left. One who appeared from nowhere and immediately bought. The purchase gets credited to direct, and the campaign that actually produced it shows a cost with no return.

Nothing errored. This is the failure mode: it is completely silent.

The mechanism, and where it fails

GA4 stores its client identifier in a first-party cookie, which by definition cannot be read by a different domain. So the Google tag passes the identity in the URL.

When someone clicks a link to a domain you have listed, the tag appends a _gl parameter carrying the client ID and session context. The tag on the receiving domain reads it and continues the same session.

Every failure is the same failure: _gl did not survive the trip.

• Servers that strip unknown query parameters — a common security hardening rule
• URL rewrite rules that rebuild the URL and drop what they do not recognise
• Single-page app routers that reconstruct the URL on navigation
• Link-decorating scripts that run after the Google tag and overwrite the href
• Redirect chains where one hop discards the query string

When _gl is missing, the second domain has no identity to continue. It mints a new client ID, starts a new session, and — because the referrer is your own other domain, or nothing at all — attributes it to direct or to a self-referral.

This is reported in roughly 60% of ecommerce and SaaS audits. It is closer to the default state than to an edge case.

Testing it takes ten seconds

Click a link from one domain to the other and look at the address bar.

https://checkout.example.com/cart?_gl=1*1abcde*_ga*NTk...
                                  ^^^ this

_gl present means the link was decorated. Missing means it was not, and every journey across that link is splitting. For a second confirmation, run GA4 DebugView on both domains and check the session ID continues.

Setting it up correctly

Two requirements, and the first is the one people get wrong:

1. One data stream, one measurement ID, on every domain. Not one stream per domain. Separate streams cannot share a session by design, so no amount of domain configuration will fix a two-stream setup.

2. List every domain: Admin → Data streams → your stream → Configure tag settings → Configure your domains.

Situation	Cross-domain config needed?
www.example.com → shop.example.com	No — subdomains share cookies
example.com → example-shop.com	Yes
example.com → checkout.stripe.com	No — use the unwanted referrals list
example.com → app.example.io	Yes — different registrable domain
Two brands, one GA4 property	Yes

Subdomains are the common source of wasted effort. They already share cookies. Configuring them changes nothing.

Cross-domain tracking is not a setting you switch on once. It is a dependency between your tagging and every piece of infrastructure that touches a URL — redirects, rewrites, routers, CDN rules. Any of those can break it, none of them know it exists, and nothing will tell you when it happens.

Why it breaks again after you fix it

The setup survives until someone changes something adjacent to it. Redesigns, CMS migrations, framework upgrades, a new CDN rule, a vendor swap, or a new subdomain nobody added to the list.

Because the failure is silent, the usual discovery path is an unexplained rise in direct traffic weeks later, followed by an afternoon of confusion.

Two habits that catch it early:

• Re-run the ten-second _gl check after any deployment that touches routing, redirects or the checkout flow.
• Watch direct traffic as a share over time. A step change in direct that coincides with a release is this bug until proven otherwise.

The monitoring half

Diagnosis and repair here are entirely GA4 and GTM work — our extension writes no tags and cannot decorate a link.

Where GA4 Simple View helps is the second habit. Direct traffic sitting at 15% for months and then jumping to 30% is the signature of a broken link, and with the previous-period comparison on the Traffic tab that shift is visible the same week rather than at the next quarterly review. For teams running several properties, the multi-site view makes the same check cheap across all of them.

Everything else in this post you can do for free, in GA4 and your browser’s address bar.