You launch a campaign. The clicks arrive. The budget is spent. GA4 then tells you most of it was "Direct".
That used to mean someone forgot the UTMs. Now it often means something duller: browser privacy protections have made link-based attribution less reliable, while most campaign measurement still depends on link parameters arriving intact and being readable at exactly the right moment.
This article explains why attribution drops out, what Safari's Link Tracking Protection does, and how Marc Alexander, a GA4 consultant, keeps campaigns measurable without building something you'd rather not describe in writing.
What Link Tracking Protection does.
Safari's Link Tracking Protection targets tracking information in destination URLs during cross-site navigation. WebKit describes two behaviours that matter to marketers.
First, Safari removes query parameters it has identified as click-level or user-level tracking, before navigation, so those values never reach your site. WebKit distinguishes these from campaign attribution parameters, which are allowed through.
Second, after a cross-site navigation, third-party scripts that read the full URL through common APIs can be shown a version with no query parameters or fragment, and in Private Browsing the cross-site document.referrer is hidden from scripts too.
The second part is the quiet killer. Even when parameters arrive, the scripts you rely on to capture them may not be able to see them.
Why GA4 calls it Direct.
GA4 attribution is only as good as the signals it captures at the start of a session. If the campaign details are missing, stripped or unreadable when GA4 sets the session's source, it defaults to Direct because it has no evidence of source, medium or campaign.
That isn't GA4 being difficult. It's GA4 refusing to make something up. The trouble is that your reports now suggest your marketing has become brilliant at brand awareness and terrible at everything else.
The compliance constraint.
Faced with attribution loss, the temptation is to "capture it earlier" or "store it somewhere else". This is where sensible organisations create a compliance problem while fixing a reporting one.
In the UK, the ICO's PECR guidance says analytics cookies are not strictly necessary and need consent. In the EU, the EDPB has said that techniques such as tracking links and pixels fall within the scope of ePrivacy rules, specifically so that nobody sidesteps consent by swapping cookies for other tracking methods.
So the aim isn't to recover attribution at any cost. It's to keep campaigns measurable in a consent-aware way you can defend.
The approach that holds up.
If third-party scripts can't reliably read URL details after cross-site navigation, stop betting your attribution on one fragile moment where a script reads location.search and hopes the parameters are still there.
Design for session continuity instead: carry the campaign details safely through real browsing behaviour, and apply them to analytics only once consent has been given, where consent is required.
The Session Integrity Layer.
Marc built the Session Integrity Layer (SIL) for this problem. It's a lightweight browser-side layer deployed through Google Tag Manager, and it activates only after the visitor consents to analytics. It doesn't send data anywhere new. It governs how GA4 interprets what's already there, so sessions and attribution look more like real visits.
For Link Tracking Protection, the key feature is consent-based attribution recovery. Campaign URLs can carry harmless hash (anchor) fragments, and once the visitor consents, SIL turns those fragments into standard query parameters so GA4 can attribute the session, without any analytics processing before consent.
SIL also deals with sessions that don't behave like people. It aligns session continuity with GA4's own session signals, which cuts the odd cases where GA4 starts a new session without a clean landing and attribution gets muddied.
Check before you fix.
SIL is the fix you install. An audit stops you installing it blindly.
It maps your real campaign entry points and finds where attribution is lost: which browsers, which modes (including Private Browsing), which redirect patterns and which consent timing. It then tells you whether SIL is the right answer, how to configure it and what success should look like in your reports.
If Direct is inflating, UTMs are disappearing or campaign performance on iOS journeys has become hard to prove, those are the symptoms SIL was built for.
Marc implements it in GTM alongside the consent setup you actually run, and checks that GA4 reflects what's happening on the site. The GA4 mini audit is the smaller first step if you want the attribution problem sized first.