What Is Dark Social? The Traffic Your Analytics Can't Name
- Dark social means links shared in private channels, such as chat threads, email or DMs, that arrive in your analytics with no referrer and get filed under Direct.
- No tool can name the app behind one of these visits. The browser sent no referrer, so there is nothing to read.
- On a site we run, 93% of no-referrer visits in a 7-day window started on a page other than the homepage. People rarely type deep addresses by hand.
- ChatGPT adds utm_source=chatgpt.com to links in its answers, so a tool that reads utm_source can catch those visits. A referrer-only tool counts every one as direct.
- You cannot name the source. You can tag the links you share yourself, and you can watch which pages those anonymous visits land on.
Dark social is the traffic that arrives from a link shared in a private channel and reaches your analytics with no referrer attached. The visit is real. The source is not recorded. Most people who ask what is dark social are really asking a second question: how much of my "direct" traffic is people passing my pages to each other? Some of it is. No tool can tell you which app did the passing.
Why the referrer never arrives
When a browser follows a link, it can send a Referer header naming the page the click started from. Browsers default to strict-origin-when-cross-origin when a site sets no policy, according to the MDN documentation on Referrer-Policy. Under that default, a cross-origin request sends the origin only, and only while the protocol stays HTTPS to HTTPS. A jump from HTTPS to HTTP sends no Referer at all. A link marked rel=noreferrer sends nothing.
Then the app layer takes over. Many apps open links with no referrer. Email clients, chat apps and native mobile apps often hand the browser a bare URL. So a click from a friend's message looks identical to someone typing your address from memory.
What Google Analytics calls direct
In the Google Analytics 4 default channel group, Direct is the channel where source is exactly (direct) and medium is (not set) or (none). Google describes Direct as users arriving via a saved link or by entering your URL. Unassigned is the value Analytics uses when no other channel rule matches the event data.
A private share carries no referrer and no campaign tag. No other channel rule matches it. That is how a share between two people ends up filed under Direct.
Counting by pageview makes the problem look worse than it is
On a site we run, a 7-day window produced 5,774 pageviews and 1,628 visits. A visit here means a run of pageviews with gaps of 30 minutes or less.
Counted by pageview, 3,841 of those 5,774 (66.5%) had no outside referrer. That figure is close to useless on its own, because a click from one page to another on the same site carries no referrer either. Most of that 66.5% is your own internal navigation.
| Measure | No outside referrer | Share |
|---|---|---|
| Pageviews, 7 days | 3,841 of 5,774 | 66.5% |
| Visits, 7 days | 856 of 1,628 | 53% |
| Visits, 30 days | 3,035 of 6,745 | 45% |
Count by visit and the number drops to something you can reason about. 856 visits arrived with no referrer and no campaign tag in 7 days.
Most of those visits started somewhere other than your homepage
Of the 856 no-referrer visits, 798 (93%) started on a page other than the homepage. 58 started on the homepage. Over 30 days the pattern held: 2,802 of 3,035 (92%) started elsewhere, and 233 started on the homepage.
People rarely type a deep address by hand. Someone landing with no referrer on a pricing page or a blog post almost certainly clicked a link. That tells you the shape of the visit. It tells you nothing about who sent it.
The landing page is a clue, never a name
If a visit starts on /pricing with no referrer, you know a link brought it. You do not know where that link lived. It could be a Slack thread, a newsletter you never sent, a forum, or a competitor's roundup. The landing page narrows the field to the topic people are sharing. It cannot name the app or the person.
No product can name it. The browser sent nothing, and there is nothing to decode.
You can still get closer than most dashboards let you. Separate the visitors who arrived from a link from the ones who typed your address, then look at where the linked ones landed. After that, tag your own shares. That last step is fully in your control.
Tag the links you share yourself
Every link you post in a group chat, a newsletter or a DM can carry utm_source, utm_medium and utm_campaign. Do that and the referrerless click still identifies its origin, because the tag rides in the URL. It is the cheapest fix in this whole area, and most small teams skip it.
Plenty of vendors promise to name your dark social sources. None can. If you are weighing paid tools, our breakdown of AI SEO Tools for Small Business: What's Worth Paying For covers what is measurable and what is guesswork dressed up in a chart.
AI answers created a second referrer problem
ChatGPT adds utm_source=chatgpt.com to the links in its answers. A visit that arrives with that tag and no referrer is not direct traffic, as long as your tool reads utm_source.
Over 30 days, 360 visits (5.3%) on a site we run carried utm_source=chatgpt.com and no referrer. A tool that reads only the referrer would have counted every one of them as direct. That is the one slice of assistant-sent traffic you can see with certainty, because the tag sits in the URL. How to See AI Traffic in Your Analytics walks through the rest.
Crawlers are a separate measurement. A site's server sees every request, so it can classify the agent that made it. Kymo tracks GPTBot (OpenAI's training crawler) and ClaudeBot (Anthropic's training crawler) alongside the indexing and live-fetch agents, and those crawler hits do not count against your event limit. The numbers that hold up under scrutiny are set out in AI Search Analytics: The Numbers You Can Actually Prove. Answers shift between searches, which is why AI Overview Tracking: Why the Same Search Shows New Answers matters more than any screenshot.
If you want the broader playbook for being found in answers, The Small Business Guide to AEO is the place to start.
Timing a direct visit against an AI read does not work
We tried it. The idea was to match a no-referrer visit to an AI assistant's read of the same page in the 10 minutes before, and treat the pair as one AI-sent visit. It found 1 to 2% more matches than chance, with no peak in the first 2 minutes. Timing cannot tell you which direct visits came from AI. Do not build a report on it.
How Kymo reports this
Kymo counts sources by visit rather than by pageview, and splits no-referrer visits into two buckets. Typed or bookmarked means the visit started on the homepage. Link, no referrer means it started on any other page. For the second bucket, the dashboard shows the landing page, which is a clue to the source and never a name for it. The docs on how Kymo counts visits and their sources cover the mechanics. For the crawler side, reading the AI report explains what each column means.
Pricing is simple: $9 a month or $90 a year for up to 10,000 events, $29 a month or $290 a year for up to 100,000 events. Every feature is on both plans, and both start with 14 days free, no card required.
Stop guessing. Watch.
start tracking it and you get one dashboard showing which pages AI engines read, how many people AI answers send there, and which of those people completed a goal, instead of a tool that asks a chatbot about your brand and reports a guess. If you want a read on your site first, the free AI visibility check reads a URL from public signals, so nothing needs installing, and the report arrives by email. Try it at kymo.in/tools/ai-visibility-checker.
Start free → 14-day free trial. No card required.