Digital tracking, UTMs, and the real limits of Client-Side measurement
When an email campaign records ninety-four clicks on the sending platform and Google Analytics 4 returns five, the instinct is to look for a technical error. Wrong configuration, missing UTM parameters, a poorly set-up integration. In most cases, however, the systems are working correctly. The problem is structural.
How Client-Side tracking works
GA4 collects data through a JavaScript snippet that runs in the user’s browser. For this to happen, several conditions must be met: the browser must load the page, execute the scripts, and not block the Google Tag Manager® domain. If even one of these conditions fails, the session goes unrecorded. The email clicks happened, the page visit probably did too — but GA4 knows nothing about it.
The role of UTMs
UTM parameters — utm_source, utm_medium, utm_campaign — are text strings appended to URLs to identify the traffic source. Without them, GA4 cannot distinguish a visit arriving from an email campaign from one typed directly into the address bar. They are an indispensable tool, but they represent only the first layer of the problem: they correctly identify the source, but do not resolve the question of whether the session is detectable at all.
Platforms like Mailchimp® automatically append UTM parameters to links, but with values that reflect their own internal logic — audience names, campaign identifiers, timestamps. The result in GA4 is often difficult to read and filter. Setting parameters manually, with consistent and meaningful naming conventions, produces cleaner data and more useful reports.
The GDPR introduced the obligation to collect user consent before activating tracking tools. Google® responded with Consent Mode, a mechanism that makes the GA4 tag conditional on the user’s explicit acceptance.
The GDPR introduced the obligation to collect user consent before activating tracking tools. Google® responded with Consent Mode, a mechanism that makes the GA4 tag conditional on the user’s explicit acceptance.
The GDPR introduced the obligation to collect user consent before activating tracking tools. Google® responded with Consent Mode, a mechanism that makes the GA4 tag conditional on the user’s explicit acceptance.
Consent Mode and the European context
The GDPR introduced the obligation to collect user consent before activating tracking tools. Google responded with Consent Mode, a mechanism that makes the GA4 tag conditional on the user’s explicit acceptance. With analytics_storage set to denied by default — the correct configuration for countries in the European Economic Area — GA4 does not fire for users who decline the cookie banner. In Italy, where acceptance rates for analytical cookies are historically low, this translates into a systematic loss of data that can exceed seventy percent of real sessions.
Consent Mode v2 introduces a behavioural modelling function: GA4 attempts to estimate untracked sessions based on statistical patterns. These data points appear in reports as (not set) values and represent an estimate, not a measurement.
GA4 Consent Mode — Visual flowchart of the tracking path
Consent is a necessary condition, but not a sufficient one. Browser protections, firewalls, and everything else come into play after that.
User arrives on the site
from any channel or source
Cookie Banner Displayed
Does the user accept Analytical Cookies?
Analytical Cookies = Denied
Analytical Cookies = Accepted
Session Not Recorded
Session Recorded
GA4 estimates (not set)
* unless blocked by browser or firewall
GA4 Consent Mode — Visual flowchart of the tracking path
Consent is a necessary condition, but not a sufficient one. Browser protections, firewalls, and everything else come into play after that.
User arrives on the site
from any channel or source
Cookie Banner Displayed
Does the user accept Analytical Cookies?
Analytical Cookies = Denied
Analytical Cookies = Accepted
Session Not Recorded
Session Recorded
GA4 estimates (not set)
* unless blocked by browser or firewall
GA4 Consent Mode
Visual flowchart of the tracking path
Consent is a necessary condition, but not a sufficient one. Browser protections, firewalls, and everything else come into play after that.
User arrives on the site
from any channel or source
Cookie Banner Displayed
Does the user accept Analytical Cookies?
Analytical Cookies Denied
Analytical Cookies Accepted
Session Not Recorded
Sessionis Recorded
GA4 estimates
(not set)
* unless blocked
by browser or firewall
Browser-level tracking protection
Independently of consent, all major browsers have introduced privacy protection measures that interfere with client-side tracking. Safari’s Intelligent Tracking Prevention blocks third-party cookies and limits the persistence of first-party ones. Firefox’s Enhanced Tracking Protection classifies Google Tag Manager as a tracker and blocks it from loading by default. Chrome, historically more permissive, accelerated the phase-out of third-party cookies throughout 2025. The result is that a growing share of users goes untracked even when consent would technically be available.
Corporate environments
B2B email campaigns add a further layer of complexity. In many structured organisations, outbound traffic passes through proxies or firewalls that filter tracking domains at the network level. Microsoft SafeLinks, present across all Microsoft 365 environments, rewrites links in emails and opens them in a protected browser that does not execute JavaScript. Clicks are recorded by the sending platform, but the session never reaches GA4. On top of this, security bots automatically scan links before the actual user opens them, generating artificial clicks — a problem that more advanced email marketing platforms, including Mailchimp, have begun to filter, not without controversy over the lack of transparency in how the feature was rolled out.
The sessions tracked from an email campaign, however few, belong to users who completed an intentional journey: opening, reading, clicking. Their in-session behaviour — time on page, events, depth of navigation — tends to be significantly above average. That is a qualitative signal worth more than volume.
A more honest metric
The gap between clicks recorded by an email marketing platform and sessions detected by GA4 is not an anomaly to be corrected: it is an accurate representation of how digital tracking works in 2026. Accepting this, choosing the most reliable metrics for each channel — sending platform reports for email campaigns, GA4 for organic and paid traffic trends — and investing in advanced infrastructure only when the numbers justify it is a sounder approach than any technical optimisation applied to a structurally limited system.
The sessions tracked from an email campaign, however few, belong to users who completed an intentional journey: opening, reading, clicking. Their in-session behaviour — time on page, events, depth of navigation — tends to be significantly above average. That is a qualitative signal worth more than volume.
What a Communication Agency does in terms of Digital Measurement
Designing an effective tracking system requires a preliminary assessment of the variables at play: audience type, active channels, consent management platform, and measurement objectives. This translates into an analysis spanning the correct configuration of UTMs and Consent Mode through to the cost-benefit evaluation of advanced solutions such as server-side tracking — intervening only where the technical investment produces a measurable benefit over the tools already in place.
Related Posts
