“(not set)” in your GA4 source/medium report isn’t a bug in Google Analytics. It’s GA4 honestly telling you it couldn’t determine where a session came from – and once you understand why, it’s usually fixable, or at least explainable.
Here’s what actually causes it, in order of how often we find each one.
1. Cross-domain tracking not configured
If a user’s journey crosses domains – your marketing site to a separate checkout domain, or a subdomain that isn’t correctly linked – GA4 can lose the session’s original source. The user technically starts a “new” session on the second domain with no referrer data, and that session gets bucketed as (not set) or misattributed to Direct.
Fix: configure cross-domain measurement in GA4’s Data Streams settings, listing every domain the user journey actually touches – not just your main domain.
2. Server-side GTM stripping parameters it shouldn’t
If you’re running server-side tagging, a misconfigured client or transformation can strip UTM parameters or referrer data before the event ever reaches GA4’s processing. This is easy to miss because the event still arrives – it’s just missing the attribution data GA4 needs.
Fix: check your sGTM client configuration and any transformations for anything touching utm_source, utm_medium, or the referrer field. Compare a request in transit against what actually lands in GA4’s DebugView.
3. Session timeout breaking the attribution window
GA4 attributes a session to its original source only within your configured session timeout window (default 30 minutes) and, separately, within your attribution lookback window for conversions. A user who clicks an ad, leaves the tab open, and returns hours later can generate a second session with no clear source – especially if they didn’t click through a link with UTM parameters the second time.
Fix: this one is often not “fixable” so much as expected behavior – but it’s worth knowing this is a legitimate cause before you go hunting for a tagging bug that doesn’t exist.
4. Missing or inconsistent UTM tagging
The most common cause, and the most avoidable. An email campaign, a paid social post, or a partner referral link without UTM parameters arrives as Direct or (not set) depending on referrer availability. If your team runs campaigns across multiple channels without a shared UTM naming convention, this compounds fast.
Fix: a UTM builder template and a naming convention document, enforced before a link goes live – not audited after the fact.
5. Consent Mode modeling gaps
If a meaningful share of your traffic denies analytics consent, GA4 relies on behavioral modeling to estimate what that traffic’s source/medium likely was. Modeling requires a sufficient data threshold to work reliably – smaller properties, or properties with a high consent-decline rate, will see more of this traffic bucketed as (not set) because GA4 doesn’t have enough signal to model it confidently.
Fix: not a tagging fix – this is a data volume and consent rate reality. Improving your consent acceptance rate (a clear, non-manipulative consent banner) genuinely helps here, as does correctly implementing Consent Mode v2 so GA4 gets the maximum signal it’s legally allowed to have.
6. Browser privacy features stripping the referrer
Safari’s ITP and some browser privacy modes strip or truncate referrer information for cross-site navigation. Traffic that should show as Referral or Organic can arrive with no referrer at all, and either get misattributed to Direct or, if compounded with other issues above, show as (not set).
How to actually diagnose which one you have
- In GA4 Explore, build a free-form report segmenting (not set) sessions by landing page, device category, and hour of day – patterns here point you toward a cause (e.g., concentrated on one landing page → check that page’s UTM setup; concentrated on mobile → check app-to-web handoffs)
- Check whether the (not set) volume correlates with your consent decline rate – if it roughly tracks, modeling gaps are a likely major contributor
- Use GTM Preview mode on a fresh session and manually trace whether UTM parameters survive from the initial click through to the GA4 event
- If you’re on server-side GTM, compare the raw incoming request against the outgoing GA4 payload for any dropped parameters
(not set) is rarely one single cause – it’s usually two or three of the above compounding. Diagnosing it properly means ruling each one in or out systematically, not guessing at the first plausible explanation.