The Cookiegate Saga

It was an average day at the (remote) office. I’d just finished running traffic reports for the month prior, when a perception of doom came over me. The results were bad. The vast majority of traffic was labeled as “direct” in our analytics, with no real explanation to point to. Why, I thought, can’t we see how people are getting to our site? I wound up finding the answer, and the fix, thanks to some trust in the experience of a co-worker. 

Before that, I’d gone down every rabbit hole I could think of.

  • Our UTM discipline was immaculate (I’d made sure of it). 
  • Attribution to campaigns in Hubspot was being leveraged appropriately.
  • Google Analytics was showing a BIG discrepancy in the total volume of traffic compared to Hubspot’s reports, but every tag manager test I could run would function successfully (This situation turned out to be the reason we stopped relying on GA4).

Up to this point, my team and I had resigned to the idea that more and more people were actively blocking tracking cookies and UTMs in the interest of privacy; especially likely in the B2B, Fortune 500 target demo we were aiming at.

Later that morning, our Director of Demand-Gen told the team she’d attended dinner with some sales reps from our retargeting & ABM platform. She mentioned trying to strike up a conversation with other demand-gen focused people there, who seemed to think she was crazy when she asked if they were also having difficulty with traffic attribution.

It got me thinking: if they’re not having this kind of trouble, then it’s got to be something unique to us. Maybe it’s something about the cookies. They think she’s crazy, and I know she’s not.

On this, I was inspired to start digging through Hubspot support docs (the site was built on Hubspot CMS) looking for anything that might indicate why we’re seeing so much ‘direct’ traffic. I stumbled on a single line of text that explained everything.

If a user decides to opt-out of tracking cookies via your banner, or chooses to ignore it, related traffic will be labeled as ‘direct’ (paraphrased). 

Oh. Em. Gee.

In the minutes following. I checked and rechecked all the laws around cookie policies for automatically issuing tracking cookies. Nothing in AMER would preclude us from doing this; we weren’t selling data or sending CEMs without permission. I then altered the behaviour of the cookie banner to require a dedicated opt-out instead. Just a day later, and our analytics confirmed the reason our traffic sources wouldn’t record as a cookie opt-out by default. 

A flurry of expletive slack messages between my team ensued:

  • “When did Hubspot change this behaviour?”
    • The support doc in question was updated at Jan 10, 2024, which correlated to when we really started losing numbers.
  • “Why the [expletive] didn’t they tell us!?”
    • I’m not a representative of Hubspot. 
  • “Why does Google Analytics look like it’s working now?
    • This was interesting, Hubspot’s Anayltics could see its own traffic previously labelled as direct, while Google Analytics couldn’t see it at all without tracking cookies functioning, hence the aforementioned huge discrepancy. Without a cookie opt-in, even Google Analytics tags can’t fire for users.
  •  “How the hell did you figure this out?”

That last question’s already been answered here. I regarded the people on my team as brilliant and things just didn’t add up when others thought they were out-to-lunch. Our quantifiable traffic in the months since then has been breaking records across nearly all measured sources. As for the big dip in our reporting, we now refer to it internally as Cookiegate, and have already eaten our feelings accordingly.