The DeMicco Digest
For each post, I use Google NotebookLM to create a podcast-style conversation between two AI hosts. I don’t script or edit their discussion, so it’s their interpretation of the article and a glimpse into what AI can do. The written post reflects my own views. How I use AI on this site
Your CRM says paid search produced almost nothing this year. Your ad platform says otherwise. One of them is lying, and it is probably not the one you think.
I have sat through a version of this meeting more times than I would like. A marketing manager presents the year’s lead sources. Paid search is a sliver. “Direct” is a third of the chart, sometimes more. Someone senior asks the obvious question: if paid search is producing so little, why are we spending on it? The marketing manager does not have a good answer, because the report is the report. Six weeks later, the paid budget is halved.
What nobody in the room knows is that “Direct” has quietly changed meaning. Ten years ago it meant a visitor who typed your web address into a browser or clicked a bookmark. Today it also means every visitor whose source your CRM was not permitted to record. Those are different things, and the difference is where your paid leads went.
Table Of Contents
The Alphabet Soup: SEO, AEO, and GEO Defined
HubSpot publishes the rules it uses to classify a contact as Direct Traffic, and it is worth reading them slowly, because they are more expansive than most marketers assume. A contact is filed as Direct if the referring URL is empty, which happens when someone types the address but also when the referring information is “otherwise lost.” A form submission is filed as Direct if it came from a page without the HubSpot tracking code, if no user token was passed with the submission (which is the case for many API-connected and third-party forms), and, in HubSpot’s own words, if the visitor “has opted to not accept cookies from your site or ignored the banner completely.”
Read that last one again. Ignored the banner. Not declined it. Ignored it. A prospect who clicks your Google ad, lands on your page, scrolls past the cookie notice without touching it, reads your product specifications, and fills out your quote form is, as far as your CRM is concerned, Direct.
Now layer in the browser. Apple’s Safari has capped the lifetime of cookies set by JavaScript, which includes most analytics and CRM tracking cookies, at seven days since 2019. A buyer who clicks your ad on a Tuesday, gets pulled into a plant emergency, and comes back the following Wednesday to request a quote arrives with no cookie and, therefore, no source. In industrial B2B, where a considered purchase can take weeks between first click and first inquiry, that seven-day window catches a large share of your best prospects.
Before you blame consent, rule out the plumbing
Everything above assumes your own tracking was done right, and that assumption fails more often than most marketers admit. A missing or misconfigured piece of tracking produces exactly the same Direct spike as a declined cookie banner, and it is your fault rather than the browser’s. Consent is the explanation only after these have been checked.
- Auto-tagging in Google Ads is on. Without it, no click identifier reaches your site, and every paid visit that survives the landing page looks like a typed address.
- Every non-Google paid link carries UTM parameters. LinkedIn, industry directories, trade publication placements, sponsored newsletters. If a paid link has no tags, the CRM cannot classify it, and the ad platform has nothing to reconcile against.
- The CRM’s ad-platform integration is connected and current. HubSpot’s Google Ads integration, or its equivalent, is how click data and contact records get matched. A disconnected integration, or one connected to the wrong account, silently drops the match.
- The tracking code is on every page, including landing pages built elsewhere. Pages built on a separate landing-page tool or a subdomain without the code are the most common single cause I encounter.
- Redirects preserve parameters. A vanity URL or a redirect chain that drops the query string strips the click identifier and the UTMs before the tracking code ever sees them.
- Cross-domain tracking is configured. If the buyer moves between two of your domains before converting, the cookie has to follow. If it does not, the conversion is Direct.
- Forms pass the user token. Native forms do. API-connected and third-party forms only do if someone built them to.
Run this list before the consent conversation. If the plumbing is clean and Direct is still swollen, the rest of this post applies. If it is not, fix the plumbing first; you will recover more leads that way than any reporting change can.
Why this is a budget problem, not a reporting problem
If this were only a matter of tidier charts I would not be writing about it. The reason it matters is what happens downstream. The monthly report goes to leadership. Leadership makes allocation decisions on it. When paid search looks weak in the CRM, paid search gets cut, and the cut lands on the channel that was quietly producing the leads now mislabeled as Direct.
I wrote earlier this spring about how slow follow-up makes good leads look bad and gets the campaign that produced them defunded. This is the other half of that problem. Fast follow-up will not save a campaign whose leads are invisible in the report. Attribution is not a marketing vanity metric. It is the evidence the marketing budget is defended with, and right now that evidence is being systematically miscategorized in most industrial companies’ CRMs.
There is a compounding issue as well. Many CRMs carry two source fields, an original source set when the contact was first cookied and a latest source set on the most recent visit. Automations written years ago frequently stamp a lead-source field from one of these without anyone remembering which. It is not unusual to find a workflow, built by someone who has since left, that quietly overwrites a paid source with a default value on every new contact. The report inherits the error, and because the error is consistent, it looks like a trend.
How to find out whether it is happening to you
You do not need a consultant for this. You need an afternoon and access to three systems.
- Pull the last ninety days of form submissions from the CRM, sorted by source. Count the Direct share. As a rough starting point, if it is over 20 percent on a site that runs paid search, keep going.
- Pull the same ninety days from Google Ads and from your analytics. Count the conversions each attributes to paid search. If the ad platform shows meaningfully more paid conversions than the CRM shows paid contacts, you have found your missing leads. They are in the Direct bucket.
- Check the consent banner’s own numbers. Most consent tools report accept, decline, and ignore rates. Ignore rates are often substantial, and every one of those visitors becomes Direct on conversion.
- Open five Direct contacts at random and read their timelines. A true direct visitor has a short history. A mislabeled paid lead often has a first page view on a landing page that only paid traffic reaches, or a session that begins minutes after an ad click in the ad platform’s log.
- Audit any workflow that touches a source or lead-source property. Read what it sets and from which field. If you find one that writes a default value, you have found a second cause.
How to fix it
Some of this is configuration, some is process, and one part is a decision about honesty in reporting.
Stop calling everything unknown “Direct”
The most important change is the least technical, and it has to be done precisely or it becomes a flattering label on a mistake. Do not create one catch-all bucket. Create three, alongside true Direct, and only put a lead in a bucket you can prove it belongs in.
- True Direct. A returning or brand-aware visitor with a short history who typed the address or used a bookmark. This is what the word used to mean, and it should be a small number.
- Consent-declined. The visitor declined or ignored the banner, and you have evidence: a consent status captured at form submission, or a consent-tool log tied to the session. This bucket is a privacy outcome, not a measurement failure, and it should be reported as such.
- Source unavailable. The lead was tagged correctly, the plumbing was sound, and the source was still lost: the cookie expired before the return visit, a browser stripped the parameters, the token did not pass. This is the honest bucket for a properly instrumented system that could not capture the origin.
- Untagged. Your own tracking gap: a paid link without parameters, a landing page without the code, a form that did not pass the token. This bucket belongs on the report because it is the one you can fix, and hiding it under a privacy label would be dishonest.
The moment these exist, Direct shrinks to something believable, the unknowns become visible and distinguishable, and leadership stops treating a measurement gap as a channel result. Reporting an unknown as an unknown, and an error as an error, is not a workaround. It is accuracy.
Reconcile the CRM against the ad platform every month
Put the CRM’s paid-lead count and the ad platform’s paid-conversion count side by side in the monthly report, with the gap shown. The gap is the size of the attribution problem. Tracking it monthly turns an argument into a number, and a number can be managed.
Capture what you are allowed to capture, first party
Where your privacy policy and your jurisdiction permit it, pass campaign parameters from the landing page URL into hidden fields on the form itself, so the submission carries its origin without depending on a cookie. This does not solve the seven-day problem for returning visitors, and it is not a way around consent obligations; if a visitor has declined tracking, respect that. It does reliably catch the same-session paid conversion that a declined or ignored banner would otherwise erase. Capture the consent state at submission in a hidden field as well, so the bucketing above rests on evidence: parameters present and consent declined is consent-declined; parameters present, consent accepted, cookie missing is source unavailable; no parameters at all is untagged, and that is a plumbing ticket, not a privacy story.
Fix the doors, again
Every form on the site should be on a page with the tracking code, should pass the user token, and should not be a third-party or API form unless the integration is deliberately passing source information. This is the same “fix the doors” advice I gave about data ownership last month, applied to attribution. The two problems have the same cause: nobody owns the path data takes into the system.
Retire the old workflows
Any automation that sets a source value should be documented, owned, and reviewed. If nobody can explain what a workflow does, turn it off in a test and see what changes. The one you are afraid to touch is usually the one doing the damage.
Keep the ad platform’s conversion tracking healthy
This is the one place I will recommend a technical investment. Enhanced conversion tracking and properly configured consent mode keep the ad platform’s side of the ledger accurate, which gives you a credible second source to reconcile against. Your CRM will never see everything. Your ad platform, with modeling, sees more. Use both and report the difference.
What this looks like when it is working
A monthly report with more than one number for paid search: leads the CRM attributed to paid, conversions the ad platform attributed to paid, contacts in each of the consent-declined, source-unavailable, and untagged buckets, and the reconciled estimate with the method written down. It is a less tidy chart. It is also the first version of the chart that would survive a CFO’s questions, and it is the version that protects the budget for the channel that is actually working.
The buyers who clicked your ad and asked for a quote are not hiding. Your CRM just filed them under a word that used to mean something else. Go find them before budget season does.
Sources & Further Reading
The following resources informed this article. All claims have been verified against multiple sources where possible.
- HubSpot Knowledge Base, “More direct traffic in sources report than expected” – https://knowledge.hubspot.com/reports/why-do-i-have-more-direct-traffic-than-expected
- HubSpot Knowledge Base, “Understand source properties” – https://knowledge.hubspot.com/contacts/understand-source-properties
- WebKit blog, “Intelligent Tracking Prevention 2.1,” February 2019 – https://webkit.org/blog/8613/intelligent-tracking-prevention-2-1/
- Google Ads Help, “About auto-tagging” – https://support.google.com/google-ads/answer/3095550
- Google Ads Help, “About consent mode” – https://support.google.com/google-ads/answer/10000067
Joe DeMicco is the Founder and President of Amplify Industrial Marketing + Guidance (AIMG), a full-service B2B industrial marketing agency with 30+ years serving manufacturers, fabricators, distributors, and trade associations. He is also the founder of Industrial Web Search (IWS), a keyword-driven B2B supplier directory platform. Joe teaches the marketing module for the Goldman Sachs 10,000 Small Businesses program and writes about AI, marketing, and B2B strategy at demicco.com.
