GA4 Data Quality: Fixing Unassigned Traffic, (not set), Referral Leakage, Internal Traffic, Bots and Thresholding

Dirty data makes every decision harder. A quarter of traffic Unassigned, landing pages full of (not set), the payment gateway as the top referrer, and the agency's own visits inflating sessions. Each has a specific cause and a specific fix. This guide goes through them in the order I check them on a new property.

1. Unassigned Traffic

Open Reports, then Acquisition, then Traffic acquisition, and look at the Unassigned row. Add source and medium as a secondary dimension to see which combinations fall in.

Causes and fixes:

• Non-standard utm_medium. newsletter, Email, paid-social, fb. Change links to the recognised values: email, paid_social, cpc, social, display, affiliate, referral. The UTM guide on this site has the list.
• Measurement Protocol or server events without session data. Events sent from a server with a client ID but no session parameters land Unassigned. Include session_id and engagement_time_msec from the browser when sending server events, or send them through server-side GTM which preserves the session.
• Events that fire before the Google tag. Put the Google tag on Initialization.
• Custom channel groups. If you defined custom channel rules, check they cover your mediums.

2. (not set)

Landing page (not set): the session's first event was not a page_view. Confirm the Google tag fires first and page_view is sent, including in single page apps where the first route must send one.

Source and medium (not set): typically Measurement Protocol events or sessions created by late-arriving events with no attribution. Same fixes as above.

Country or device (not set): small volumes from privacy proxies and bots; ignore unless large.

Item name (not set): purchases with items missing item_name; fix the dataLayer.

3. Referral Leakage

Open Traffic acquisition with session source. If you see your payment provider, your own domain, an SSO provider or a booking vendor as a referrer, the session restarted when the visitor returned.

Fix: in the data stream, Configure tag settings, then List unwanted referrals, add each domain. For domains you also run tags on, configure cross-domain measurement instead; the Cross-Domain guide on this site covers it. Self-referrals from your own domain usually mean two Google tags or a misconfigured cookie domain.

4. Internal and Developer Traffic

In the data stream, Configure tag settings, then Define internal traffic, add rules for your office IP, home IPs of frequent testers, and the agency. Then in Admin, Data settings, Data filters, set the internal traffic filter to Active. Until it is active, the traffic is only flagged, not excluded.

For developers with dynamic IPs, a Chrome extension that sets a traffic_type parameter, or a GTM variable that sets it when a specific cookie is present, lets you filter without IPs. Create a filter for that traffic_type value.

Also exclude staging and development hostnames: either a separate GA4 property for staging, which is cleaner, or a GTM exception on hostname so no tags fire there.

5. Bots and Spam

GA4 excludes known bots automatically. What remains:

• Direct spikes with 100 percent bounce and odd locations. Often scrapers. Add a filter on hostname to accept only your domains, by creating a filter that excludes sessions where the hostname is not yours, through a custom dimension or by checking the hostname in GTM and blocking tags on unknown hosts.
• Referral spam. Rare in GA4. Unwanted referrals handles the odd domain.
• Your own uptime monitors and crawlers. Identify by user agent in a GTM blocking trigger.

6. Duplicate Page Views and Events

Engagement rate near 100 percent and page views per session double what makes sense usually means two Google tags. In Preview, load a page and count page_view fires. Check the page source for a hard-coded gtag snippet or a plugin sending to the same measurement ID. Remove one.

Duplicate purchases: missing transaction ID or a push that repeats on refresh. The Ecommerce Specification guide covers the guard.

7. Thresholding From Google Signals

With Google Signals on, small reports show a warning and hide rows. Options: turn Signals off if you do not use demographics or cross-device reporting from it; set Reporting identity to Device-based; or accept it and widen date ranges. For most small sites, Signals off is the right call.

8. Session Counting Oddities

Sessions spanning midnight split in two. Sessions longer than the timeout restart. Reloaded pages with _gl parameters re-stitch oddly. These are expected GA4 behaviours; document them for stakeholders rather than fixing them.

9. Data Retention and Reporting Gaps

Explorations that end abruptly in the past are hitting the retention limit. Set retention to 14 months and link BigQuery for anything longer.

A Monthly Hygiene Routine

1. Traffic acquisition: Unassigned share below 5 percent.
2. Source and medium: no own domains, payment or SSO providers.
3. Landing page: (not set) below 2 percent.
4. Events: no unexpected spikes, no duplicated purchase events.
5. Data filters: internal filter active, test visits absent from reports.
6. Realtime: a quick check from a work device that your session is excluded.

Outcome

Channel reports that reflect where visitors really came from, landing pages that are set, sessions that are human and external, and conversion counts that match the business. Clean data is not glamorous, but every decision built on it is better.