GA4 Session Attribution: Session Logic and Scopes (2026)

"GA4 shows Direct way up. Conversions look weird. The source doesn't match what Google Ads says."

If you've migrated from Universal Analytics and these complaints sound familiar, you're not alone. GA4 feels wrong to a lot of people—but the platform isn't broken. The mental model is.

Universal Analytics was session-container based. A session was a discrete box: it started, things happened inside it, it ended. Attribution belonged to the session as a unit.

GA4 is event-stream based. Events flow in continuously. Sessions are derived constructs—assembled after the fact from event data. Attribution depends on which scope you're looking at: user, session, or event.

This fundamental difference explains why reports don't match, why numbers shift when you change dimensions, and why "Unassigned" keeps showing up where you don't expect it.

This post breaks down GA4 session logic, explains the three scopes, clarifies the Unassigned vs (not set) vs Direct confusion, and gives you a practical framework for interpreting reports without losing your mind.

Sessions Are Assembled From Events

In GA4, a session isn't a container that collects hits. It's a construct derived from the event stream.

How Sessions Get Created

When a user arrives on your site, GA4 fires a session_start event. This event generates two key parameters:

• ga_session_id: A unique identifier for the session
• ga_session_number: How many sessions this user has had

Subsequent events (page_view, scroll, click, purchase) are associated with that session via the ga_session_id. When the user goes inactive for 30 minutes (default timeout) or crosses midnight in the property's timezone, a new session_start fires on the next interaction.

When Sessions Break

Sessions can become incomplete or orphaned when:

• session_start doesn't fire: Due to ad blockers, consent rejection, or implementation errors, the session_start event may be missing. Subsequent events have no session to attach to.
• Events arrive out of order: In edge cases, events can arrive at the GA4 servers before the session_start that should precede them.
• Cross-domain tracking gaps: If the linker parameter isn't passed correctly between domains, GA4 treats the second domain as a new user and new session.

The result: events that don't cleanly belong to a session, sessions with incomplete attribution, and reports that show gaps or anomalies.

Why UA and GA4 Will Never Match

If you're comparing GA4 numbers to historical Universal Analytics data, stop. The systems measure differently by design.

Key Differences

Why This Matters

Teams expecting GA4 to produce the same numbers as UA will always be disappointed. The session model is different. The engagement model is different. The attribution model is different.

Accept that GA4 is a new baseline, not a continuation of UA. Compare GA4 to GA4 going forward.

User vs Session vs Event Scope (and What Each Answers)

This is where most attribution confusion lives. GA4 has three scopes, and using the wrong one produces misleading reports.

User Scope: How Did We Acquire Them?

User-scoped dimensions describe how the user was first acquired. They persist across all sessions.

• First user source: The source that drove the user's first visit
• First user medium: The medium of that first visit
• First user campaign: The campaign that acquired the user

Use this for: Acquisition reporting. "Which channels bring us new users?"

Don't use this for: Session-level analysis. If a user was acquired via paid search but returns via organic, user scope still shows paid search.

Session Scope: What Drove This Visit?

Session-scoped dimensions describe what drove the current session.

• Session source: The source of this specific session
• Session medium: The medium of this session
• Session campaign: The campaign associated with this session

Use this for: Traffic analysis. "What channels are driving visits this week?"

Don't use this for: Conversion attribution in multi-touch journeys. Session scope shows the session source, not necessarily the converting touchpoint.

Event Scope: What Influenced This Conversion?

Event-scoped dimensions describe the attribution at the time of a specific event (like a purchase or form submission).

• Source: The source attributed to this event
• Medium: The medium attributed to this event

Use this for: Conversion analysis with attribution models. "What touchpoints contributed to this purchase?"

Don't use this for: General traffic analysis. Event scope is specific to individual events, not sessions or users.

The Scope Mismatch Problem

If you pull a report using first user source but measure sessions, you're answering: "How many sessions did users have, grouped by how we originally acquired them?"

That's not the same as: "What drove these sessions?"

Example: A user acquired via paid search returns three times via direct navigation. Using first user source shows three sessions attributed to paid search. Using session source shows one paid search session and two direct sessions.

Neither is wrong. They answer different questions. But mixing them up produces reports that mislead.

DDA Doesn't Apply Everywhere

GA4's data-driven attribution (DDA) model gets a lot of attention, but it doesn't apply to every report.

Where DDA Applies

Data-driven attribution primarily affects event-level conversion attribution. When you look at the Advertising reports or Conversion paths, DDA distributes credit across touchpoints based on modeled contribution.

Where DDA Doesn't Apply

• Session source dimensions: These typically use "last non-direct" logic for the session, not DDA.
• Standard reports with traffic dimensions: The Traffic Acquisition report shows session-level source, not DDA-weighted attribution.
• User-scoped dimensions: First user source is always the first touchpoint—no attribution modeling.

Lookback Windows

Attribution models use lookback windows to determine which touchpoints are eligible for credit. GA4's default windows:

• Acquisition conversion events: 30-day lookback
• All other conversion events: 90-day lookback (adjustable)

If a touchpoint falls outside the lookback window, it won't receive credit—even if it was influential.

Quick Reference: Which Report for Which Question

Three Different Problems Hiding in Your Charts

Unassigned, (not set), and Direct are not the same thing. They indicate different problems.

Unassigned

What it means: GA4's channel grouping rules couldn't classify the traffic.

Common causes:

• UTM parameters that don't match any channel definition
• Malformed or missing utm_medium values
• Custom channel groupings that have gaps

What to check:

• Audit your UTM conventions
• Review default channel grouping rules
• Check for misspelled or non-standard medium values

(not set)

What it means: The dimension value is missing for that event or session.

Common causes:

• Events firing before session_start
• Broken session linkage
• Missing data at the event level
• SPA (single-page app) implementation issues

What to check:

• Verify session_start fires correctly
• Check event sequencing in DebugView
• Review SPA tracking configuration
• Confirm cross-domain linker parameters

Direct

What it means: No referrer and no campaign parameters were present.

Common causes:

• Actual typed navigation or bookmarks
• Dark social (links from private channels)
• In-app browsers stripping referrers
• Referrer policy restrictions
• HTTPS to HTTP transitions (referrer dropped)

What to check:

• Isolate "Deep Direct" (direct traffic to non-homepage URLs)
• Review referrer policy settings
• Audit UTM tagging on controlled links
• Implement self-reported attribution

Summary:

• Unassigned = Channel rules failed (fix your UTMs and groupings)
• (not set) = Data missing (fix your implementation)
• Direct = No attribution signals (tag what you can, accept what you can't)

Observed vs Modeled Traffic and Why Your Numbers Shift

Consent Mode v2 adds another layer of complexity: some of your attribution data is now modeled, not observed.

Basic vs Advanced Consent Mode

• Basic mode: When consent is denied, no data is collected. Simple, but you lose visibility into non-consenting users entirely.
• Advanced mode: When consent is denied, GA4 collects cookieless pings with limited data. Google then models behavior and conversions based on consenting users.

What Gets Modeled

When a user denies consent in advanced mode:

• No cookies are set
• No user identifier persists
• GA4 receives limited event data

Google uses machine learning to estimate what those sessions and conversions would have looked like based on patterns from consenting users. This modeled data appears in your reports alongside observed data.

Why Numbers Shift

• Modeling thresholds: Google only applies modeling when there's enough data to produce reliable estimates. If consent rates change, modeled numbers can shift.
• Retroactive modeling: Modeled data can be updated as Google's models improve or as more baseline data becomes available.
• Report timing: Modeled data may take longer to populate than observed data.

What This Means for Attribution

Attribution for non-consenting users is probabilistic, not deterministic. You're seeing Google's best estimate, not tracked reality.

This isn't a GA4 problem—it's a privacy regulation reality. But it means attribution reports should be interpreted with appropriate humility.

The GA4 Decision Matrix: Use the Right Lens

Here's a compact reference for choosing the right scope and dimension for common business questions.

Rules of Thumb

1. For acquisition questions: Use user scope (first user dimensions)
2. For traffic questions: Use session scope (session dimensions)
3. For conversion questions: Use event scope with attribution reports
4. For debugging: Use Explorations with multiple dimensions to isolate issues

Why You Need an Evidence Layer for 2026 Attribution

GA4 is valuable for trend analysis, standard reporting, and understanding user behavior at scale. But it has limits.

What GA4 Can't Do

• Explain referrer-stripped sessions: GA4 shows Direct. It can't tell you whether that was a WhatsApp share, an in-app browser, or actual typed navigation.
• Provide confidence levels: Every attribution in GA4 appears equally certain, even when it's modeled or ambiguous.
• Create evidence logs: GA4 shows what it recorded, not the reasoning chain that explains likely sources.
• Handle dark social intelligently: Private channel traffic appears as Direct with no differentiation.

What Stakeholders Actually Need

When a client asks "where did this traffic come from?" and GA4 says "Direct," that's not an answer—it's an admission of ignorance.

Stakeholders need:

• Subtypes: Is this Direct likely typed navigation, dark social, or returning user behavior?
• Confidence levels: How certain are we about this attribution?
• Evidence: What signals support this classification?

Building an evidence layer into your reporting is essential. This means classifying direct traffic into likely subtypes, attaching confidence levels to attribution, and creating evidence logs that explain what probably happened—even when GA4 shows only "Direct."

GA4 remains your baseline. Evidence-based reporting is the "prove it" layer for ambiguous attribution.

Use Scopes Deliberately, Report Honestly

Three takeaways:

1. Sessions are constructed, not containers. GA4 assembles sessions from event streams. Understanding this changes how you interpret reports.
2. Scope mismatch is the #1 error. Using first user source to analyze session traffic, or session source to analyze conversions, produces misleading reports. Match the scope to the question.
3. Attribution is now partly modeled—report with evidence and confidence, not certainty. Between Consent Mode modeling and dark social, much of your attribution is probabilistic. Acknowledge this in reporting.

GA4 isn't lying to you. But it's only telling you what it can observe. For the rest, you need evidence, correlation, and appropriate humility.

Ready to add the evidence layer?

Build reports in the SEO Reporting Dashboard and share via shareable report links—communicate attribution nuance clearly to stakeholders.

---

GA4 Session Attribution FAQs

What is a session in GA4?

A session in GA4 is a construct derived from the event stream, not a container like in Universal Analytics. It begins with a session_start event and includes subsequent events associated with the same ga_session_id. Sessions end after 30 minutes of inactivity or at midnight in the property's timezone.

Why doesn't GA4 match Universal Analytics?

GA4 uses a fundamentally different measurement model. Key differences include: no midnight session splits, campaign changes don't automatically restart sessions, and engagement metrics replace bounce rate. GA4 and UA will never produce identical numbers because they measure differently by design.

What is the difference between first user source and session source?

First user source is user-scoped—it shows how the user was originally acquired and persists across all their sessions. Session source is session-scoped—it shows what drove the current visit. Use first user source for acquisition analysis; use session source for traffic analysis.

What causes Unassigned traffic in GA4?

Unassigned appears when GA4's channel grouping rules can't classify the traffic. Common causes include UTM parameters that don't match channel definitions, missing or malformed utm_medium values, or gaps in custom channel groupings. Audit your UTM conventions and channel rules to reduce Unassigned.

What does (not set) mean in GA4?

(not set) indicates the dimension value is missing for that event or session. Common causes include events firing before session_start, broken session linkage, SPA implementation issues, or missing data at the event level. Use DebugView to verify event sequencing.

How does Consent Mode v2 affect attribution?

In advanced Consent Mode, non-consenting users trigger cookieless pings with limited data. Google models their behavior and conversions based on patterns from consenting users. This means some attribution data is probabilistic, not observed. Numbers can shift as modeling updates.

Why is Direct traffic increasing?

Direct traffic increases when referrer data is missing. Common causes include dark social (links from private channels like WhatsApp and Slack), in-app browsers stripping referrers, referrer policy restrictions, and HTTPS-to-HTTP transitions. Not all Direct traffic is actually typed navigation.

What should agencies report when attribution is unclear?

Report with evidence and appropriate confidence levels. Use correlation (timing of activities vs traffic spikes), self-reported attribution ("how did you hear about us?"), and outcome metrics (conversions, branded demand) alongside channel data. Acknowledge what's observed vs modeled, and avoid false precision.