If GA4 shows a spike in Direct traffic on your confirmation page, or your key event data looks nothing like your sales, cross-domain tracking is a likely culprit.
GA4 recognises users through a first-party cookie scoped to one domain. When a user moves to another domain, the cookie can't follow. GA4 sees a new user and a new session with no source, medium or campaign. The sale is credited to Direct, and the campaign that drove the visit gets nothing.
This guide covers why that happens, how to configure cross-domain tracking, how to handle payment gateways and subdomains, and how to check it works.
Why GA4 loses sessions at domain boundaries.
GA4 stores its client ID in a first-party cookie called _ga. On www.example.com it sets _ga on example.com and uses it to keep sessions together and recognise returning users.
When the user moves to checkout.example-payments.com, the browser doesn't send that cookie, because it belongs to another domain. GA4 on the second domain can't tell it's the same person, so it starts again.
Unless the domains are set up to share identity, every crossing starts a new session. If your sales or leads happen on a different domain from your marketing site, nearly all of that attribution is wrong.
When you need it.
You need cross-domain tracking whenever a journey spans more than one domain and you want to measure it as one session. Typical cases:
- A marketing site on one domain and a checkout or booking platform on another. This does the most commercial damage, because sales are misattributed.
- A third-party payment gateway such as Stripe, PayPal or Sage Pay that takes payment on its own domain and then returns the user to your confirmation page.
- A subdomain set up as a separate site rather than sharing a cookie with the root domain.
- Several brand, product or country domains sharing one GA4 property. Tracking a multi-country website covers the country case.
If the whole journey stays on one domain, or on subdomains that share a cookie, you don't need it. If any crossing sits on the path to a sale or lead, you almost certainly do.
How it works.
When a user clicks a link to another configured domain, GA4 adds a _gl parameter to the URL. It carries the client ID and session details from the first domain. GA4 on the second domain reads it and continues the existing session instead of starting a new one.
Once the domains are configured this happens automatically for normal links. The user sees _gl in the address bar briefly and nothing else changes.
Both domains need the same GA4 tag (the same Measurement ID), and both need to be in the domain list. If only one side is set up, the handoff fails.
Method 1: the GA4 interface.
This is the simpler route and suits most setups.
Go to Admin → Data Streams → your web stream → Configure tag settings → Configure your domains. Add every domain in the journey, for example www.example.com and checkout.example-payments.com. If you're not sure how the site handles www, add both versions.
GA4 then decorates any link from one listed domain to another with _gl. Changes apply to new sessions straight away.
Method 2: Google Tag Manager.
If GA4 runs through GTM, you can set cross-domain options on the Google tag (formerly the GA4 Configuration tag) by adding a linker configuration parameter with your list of domains.
Setting cross-domain in both the GA4 interface and GTM can cause conflicts. Pick one method and stick to it.
If the container has been optimised for Tag Manager's new tagging experience, the container itself is now the Google tag. Check where your domain list lives after the change before you edit it, and still keep it in one place.
Subdomains.
Subdomains usually don't need cross-domain tracking. By default GA4 sets the _ga cookie on the highest level domain it can (the cookie_domain setting is "auto"), so www.example.com and shop.example.com share it and sessions carry across.
If someone has overridden that, set cookie_domain to example.com on the Google tag so the cookie is readable from every subdomain.
If a subdomain behaves like a separate site (different server, different property or its own cookie settings), treat it as a separate domain and add it to the list.
When in doubt, test. Check whether the _ga cookie set on the main domain is present on the subdomain. If it is, you probably don't need anything more. If it isn't, add the subdomain to the list.
Referral exclusions: a different job.
Referral exclusions are often confused with cross-domain tracking, but they solve a different problem.
When a user returns from a domain on your unwanted referrals list, GA4 doesn't record that domain as a new traffic source. That matters for payment gateways: without it, a return from PayPal can take the credit for a sale that a campaign drove.
The two usually work together. Cross-domain tracking handles the outbound step, passing _gl when the user leaves your domain. Referral exclusions handle the return, so the gateway doesn't overwrite the original source.
A common mistake is putting your own domain in referral exclusions instead of the domain list. Your own domains belong in the cross-domain list. Third-party domains that users return from, such as payment gateways, belong in referral exclusions.
To add them: Admin → Data Streams → your stream → Configure tag settings → List unwanted referrals.
Testing the setup.
Don't assume it works because it's configured. Test it before you rely on the data.
- Open GA4 DebugView and turn on debug mode, through GTM Preview or the Tag Assistant extension.
- Go from the main domain to the second domain by clicking a real link on the page, not by typing the URL.
- Check that _gl appears in the URL when you land. Then compare the _ga cookie in your browser's developer tools on both domains. The client ID part should match. If it differs, _gl wasn't passed or wasn't read.
- After a test purchase or lead, check Reports → Acquisition → Traffic acquisition. If the key event shows the original source rather than Direct, the setup works end to end.
- In an Exploration, look at the source breakdown for sessions that include the confirmation page. If Direct still dominates, the handoff is failing somewhere.
Common mistakes.
Missing domains. GA4 only adds _gl to links going to listed domains. Every domain in the journey needs to be there, including any intermediate redirect domains.
Configuring in both GA4 and GTM. This can cause conflicts. Use one method.
Adding subdomains that already share a cookie. They usually just need the right cookie_domain. Adding them to the domain list as well can cause duplicate parameters.
Leaving the payment gateway out of referral exclusions. Even with cross-domain working outbound, the return visit can overwrite the original source.
Testing only in GTM Preview. Preview doesn't always behave like live browsing. Test on the live, published site as well.
A stray Google tag on the page. A hard-coded gtag('config') call outside Tag Manager can carry different linker settings from the container. Since October 2026 each one shows in Preview as a gtag.config event, so they're easy to find.
Payment steps in an iframe. If the payment form is embedded in an iframe on your page rather than a redirect, cross-domain settings won't help, because iframes don't get link decoration. This needs a different approach, usually server-side tracking.
Setup checklist.
- List every domain in the journey that needs to share session data.
- Add them all to the cross-domain list, in GA4 or GTM, not both.
- If subdomains are involved, check
cookie_domainis set to the root domain (or left on auto). - Add third-party return domains, such as payment gateways, to referral exclusions.
- Click through each domain crossing on the live site and check _gl arrives.
- Confirm the client ID matches on both domains.
- Check Direct on the confirmation page to confirm sales and leads are attributed correctly.
- If a gateway strips _gl, look at a custom return URL, server-side tracking or a first-party data approach.
Summary.
If sales or leads happen on a different domain from your marketing site and cross-domain tracking isn't set up, nearly all of that attribution is wrong. Direct gets the credit and your campaigns get none.
The setup itself is simple: list every domain, use one configuration method, add payment gateways to referral exclusions, and test on the live site. The hard cases are gateways that strip query parameters on the way back, which need a server-side fix or work with the gateway provider.
The client ID check takes five minutes and tells you for certain whether the handoff works.
If it still breaks, Marc Alexander, a Google Tag Manager consultant, can find out where.
