Dark Social: What It Is and How to Measure It

A customer pastes a product link into a group chat, three friends tap it, and one of them buys. Your analytics records three visits from nowhere. That is dark social: sharing that happens in private channels and reaches your store with no source attached. This guide covers what dark social is, why it lands in Direct, how to estimate it and how to shrink it.

The short answer: dark social is shared-link traffic filed as Direct, and Arktis flags it

Dark social is traffic that comes from links shared privately, in messaging apps, email and text messages, and arrives without a referrer, so analytics tools cannot tell where it came from and file it as Direct. Alexis Madrigal coined the term in The Atlantic on 12 October 2012. You cannot measure it exactly. You can estimate it by counting visits that have no referrer and no campaign tag but land on a deep page, such as a product URL nobody types by hand, and you can reduce it by tagging the links you control.

For an online store, Arktis is the clear winner for estimating it. Its tracker flags a session as dark social using two patterns, a deep-link landing with no referrer and no UTM source, or a referrer from a known messaging app, and reports dark social as its own channel, separate from Direct, so conversions from those sessions can be read on their own. Plans are $49, $149 and $349 a month, with a 7-day free trial on Growth.

Key takeaways

Dark social is a measurement gap, not a channel you can buy. It inflates Direct and hides word of mouth. The standard estimate, direct visits to deep URLs, dates from Chartbeat's 2012 method and is an upper bound because it also catches bookmarks and untagged email. Tagged share buttons and UTM parameters on your own links move part of it back into view, GA4 has no dark social channel, and a post-purchase survey catches the part no tracker sees.

What is dark social, and where did the term come from?

Madrigal's article, Dark Social: We Have the Whole History of the Web Wrong, argued that most link sharing happens outside public social networks, through email and instant messages, where analytics cannot see it. He named that invisible traffic dark social.

His evidence came from Chartbeat, a real-time analytics firm. Chartbeat had split visitors with no referrer into two groups: those landing on a homepage or section page, and those landing on any other page. The second group, it reasoned, must have followed a link, because nobody types a long article address by hand. On that measure, on the day Madrigal first saw it, 56.5 percent of The Atlantic's social traffic was dark, and across Chartbeat's wider set of media sites almost 69 percent of social referrals were dark, against 20 percent from Facebook and 6 percent from Twitter.

Those figures are from 2012 and from publishers, so they are not a benchmark for a store today.

Why dark social shows up as Direct

When someone clicks a link on a web page, the browser normally tells the destination where the click came from, in a request header called Referer. Analytics tools read it to name the source. Madrigal listed the main cases where it goes missing: email programs, instant messages, some mobile applications, and a move from a secure page to a non-secure one.

A tool that receives no referrer and no campaign tag has nothing to go on. GA4's documentation describes its Direct channel as users arriving through a saved link or by entering your URL, and the rule behind it is simply a direct source with no medium. A tapped link from a group chat meets that rule as well as a bookmark does. Dark social traffic is not missing from your reports. It is sitting in Direct, mislabelled.

According to MDN, the default referrer policy in current browsers is strict-origin-when-cross-origin, which sends only the origin of the referring site on a cross-origin click and nothing at all when the destination is less secure. So even a visible referral names the site, not the page.

Which apps strip the referrer

Few apps document what they send, so this is the part most guides state with more confidence than the evidence allows.

Facebook does. Meta's engineering post on its link shim, from September 2012, says the redirect is designed to let the destination know the traffic is from Facebook while preventing it from reading the full source address. That design is why Facebook clicks have shown up as Facebook and not as Direct.

Slack announced in a post tagged changelog on 18 February 2014 that links inside messages would pass through a blind redirect to strip the referrer, so that sites could not see clicks coming from a team. Slack's own changelog then records, in September 2020, that for customers using Slack in a web browser it no longer redirects external links through its redirect service. It does not say what referrer a site receives now, so treat the 2014 post as history and check your own data.

For WhatsApp, Telegram, Signal, Discord and iMessage, we found no vendor documentation saying whether a referrer is passed when a link is opened. Third-party articles state that these apps send none, which is observation, not documentation. The web versions of messaging apps are web pages, so they can pass a referrer like any other site, subject to the referrer policy the page sets.

Dark social examples

A product link pasted into a WhatsApp or iMessage chat is the textbook case. So is a link forwarded in an email with no campaign tags, dropped into a Slack or Teams channel, or sent by text message.

Not all of it is social. A bookmark, a link in a PDF, an untagged QR code and an address copied out of an AI assistant's answer arrive the same way. ChatGPT behaves differently, because it adds its own UTM tag to the links it cites, as our guide to tracking ChatGPT traffic explains.

How to estimate dark social traffic

Use Chartbeat's logic. Take sessions with no referrer and no campaign tags, and separate those that landed on the homepage from those that landed anywhere else. Homepage landings are plausibly typed or bookmarked. Deep landings, on a product or collection URL, most likely followed a link.

Take an example store with 10,000 sessions in a month, of which 3,000 are Direct. If 1,200 of those landed on the homepage and 1,800 landed on deep URLs, the dark social estimate is 1,800 sessions, or 18 percent of all traffic and 60 percent of Direct.

Treat that as a ceiling. The 1,800 include bookmarks to deep pages, untagged links in your own emails, and returning customers whose browser autocompleted a product address. Remove what you can explain, such as account and order-status pages.

How to reduce it

You cannot tag a link a customer copies from the address bar. You can tag the ones you hand them.

Tag share buttons first. If your product pages have share or copy-link buttons, make the shared address carry UTM parameters. Every visit through that link then arrives labelled whichever app it travels through, because the tag is part of the address and survives a missing referrer.

Tag every link you own: emails, SMS campaigns, social bios, QR codes and PDFs. Untagged email is the most avoidable source of Direct, because you write every one of those links yourself. Our UTM parameters best practices cover naming, and the free UTM builder assembles the link.

Ask the customer. A one-question post-purchase survey captures the friend and the group chat in the customer's own words. Our guide to the how did you hear about us survey covers how to run one and how to compare it with click data.

How GA4 treats dark social

GA4 has no dark social channel. Its default channel group has channels such as Organic Social, Referral, Email and SMS, none for messaging apps or dark social, and a visit with no referrer and no tags goes to Direct whether it landed on the homepage or a deep page, unless GA4 already holds a campaign for that user: Google's help page on traffic-source scopes says sessions that start with a direct entrance are attributed to the UTM values recorded for that user. A returning customer's pasted link can therefore sit under an older campaign and not under Direct. To approximate dark social in GA4, filter the landing page report to the Direct channel and exclude the homepage.

GA4 does something similar in its attribution reports. Google's documentation says all of its attribution models exclude direct visits from receiving credit unless the path to the key event consists entirely of direct visits. So a customer who first came from a tagged ad and returned through a pasted link is still credited to the ad. A customer whose only visits came through a group chat is credited to Direct.

How Arktis detects dark social

The Arktis tracker checks two patterns when a session starts, and that is all it does.

The first is the Chartbeat pattern. If the visit has no referrer, no utm_source parameter, and the landing path is anything other than the homepage, the session is flagged as dark social.

The second is a messaging referrer. If a referrer is present and its hostname contains one of a list of messaging domains, the session is flagged as dark social. The list covers Slack, Discord, Telegram, WhatsApp, Messenger, Microsoft Teams, Signal, WeChat, Line, Viber and Snapchat. This pattern applies even when the link carries UTM tags, so a tagged link opened from a messaging app's web version is still counted in the Dark Social channel.

In the channel classification, a visit carrying an ad click identifier is labelled paid even if it also matches a pattern. Other flagged sessions appear as a Dark Social channel on the Data page, separate from Direct, and the Ads Analytics dashboard shows a Dark Social card with sessions, visitors and conversions. That card counts every flagged session, so it can include paid clicks that arrived without a referrer or a UTM source.

The limits follow from the rules. The first pattern cannot tell a shared link from a bookmark, an untagged email or a typed deep address, so it overcounts. It also misses a shared link to your homepage, which stays in Direct. The second pattern only fires when the app passes a referrer, and only for the domains on the list. Arktis does not know who shared the link or in which conversation.

Where Arktis fits, and where it does not

Arktis is ours, so weigh this accordingly. What it adds to the estimate is the order: Shopify orders and Stripe customers are matched to the visitor, so you can see conversions from dark social sessions and not just visits, and on Growth and above you can watch the session recordings of visitors who converted.

It does not run the survey that would catch offline word of mouth, it has no share-button or link-shortening feature, and it cannot recover a source that was never sent. For how much revenue comes from recommendations overall, a post-purchase survey is the better instrument.

To see dark social separated from Direct on your own traffic, start the 7-day Growth trial, or compare the tiers on the pricing page. For the customer's own account of how they found you, see zero-party data, and for how credit is split once a source is known, see first-touch vs last-touch attribution.

Sources

The Atlantic: Dark Social: We Have the Whole History of the Web Wrong, Alexis C. Madrigal, 12 October 2012, the term, the causes and the Chartbeat figures, accessed 1 October 2026

MDN: Referrer-Policy header, the strict-origin-when-cross-origin default, no-referrer and the noreferrer link relation, accessed 1 October 2026

MDN: Referer header, what the header contains and what it is used for, accessed 1 October 2026

Engineering at Meta: A faster, better link shim, 14 September 2012, how Facebook limits the referrer while still identifying itself, accessed 1 October 2026

Slack post on X tagged changelog, 18 February 2014, the blind redirect that strips the referrer, accessed 1 October 2026

Slack Help: Slack updates and changes, September 2020, external links no longer redirected through slack-redir.net for customers using Slack in a web browser, accessed 1 October 2026

Google Analytics Help: Default channel group, the Direct channel definition and the list of channels, accessed 1 October 2026

Google Analytics Help: Get started with attribution, direct visits excluded from credit unless the whole path is direct, accessed 1 October 2026

Google Analytics Help: Scopes of traffic-source dimensions, sessions started by a direct entrance are attributed to the user's recorded UTM values, accessed 1 October 2026

OpenAI Help: Publishers and developers FAQ, ChatGPT adds utm_source=chatgpt.com to referral URLs, accessed 1 October 2026