Category: Privacy
All blog posts in this category.
Website tracker audit: a practical checklist for small teams
A tracker audit is not a cookie-counting exercise followed by a screenshot. Its purpose is more practical: to understand which components communicate with which services, when they do so, why they exist and what data they transmit. That distinction matters. A site can set no HTTP cookie and still send information to third parties. Conversely, a cookie may be strictly necessary to deliver a feature requested by the visitor. The word “cookie” does not determine purpose, risk or the applicable legal rule. For a small business, B2B SaaS team or multi-site operator, the useful output is not a fifty-page report. It is a reproducible inventory connected to owners, decisions and remediation work. Keep one boundary clear from the start: a technical audit is not a legal opinion. It provides the facts needed to document the setup and support a qualified assessment. What the audit should answer By the end of the exercise, the team should be able to answer eight questions:Which scripts, pixels, SDKs and third-party resources load? Which cookies, local storage entries or identifiers are created? Which requests fire before the visitor makes a choice? What data appears in URLs, headers and request bodies? Which provider receives each data point? Which operational purpose justifies each component? How long are identifiers and collected data retained? Who can access, export or reconfigure the data?This prevents a common failure mode: reviewing the banner while never testing what the website actually does. European regulators use a technology-neutral understanding of trackers. It can include cookies, pixels, local storage and fingerprinting techniques. An empty cookie list is therefore not sufficient evidence that no tracking occurs. Build a representative test scope Testing the home page alone rarely gives a useful result. Components differ by template, journey and consent state. Your sample should cover at least:the home page; a content page; a product or service page; a pricing page; a form; a confirmation page; an authenticated area, where applicable; a page embedding video, maps, chat or booking tools; a campaign URL with UTM parameters; major language versions or domains in a multi-site setup.Test several states as well:first visit with no stored choice; reject all optional trackers; selective acceptance; accept all; returning visit with a saved choice; private browsing or a clean browser profile.Add a dedicated scenario for sensitive areas. A customer portal, healthcare form, HR page or admin interface should not be treated like an ordinary editorial page. A seven-step tracker audit 1. Start with a clean browser Use a fresh browser profile without extensions that block or rewrite requests. Open developer tools before loading the page and preserve the network log. Record:tested URL; date; browser and version; consent scenario; production or staging environment; person running the test.This makes the audit reproducible and allows a reliable before-and-after comparison. 2. Inventory loaded components In the Network panel, inspect scripts, images, fetch calls, XHR and documents. Record third-party domains and first-party-hosted files supplied by external vendors. A script served from your domain is not necessarily operated by your team. Proxies, tag managers and CDNs can obscure the functional source. For every component, capture:Field QuestionComponent Which script or service loads?Owner Which team requested it?Provider Who operates it?Purpose Measurement, support, security, advertising or media?Trigger Before choice, after acceptance or after an action?Observed data URL, referrer, IP, identifier or event?Destination Which domain and known processing region?Decision Keep, configure, defer or remove?Do not stop at the vendor name. The same company may provide products with very different data practices. 3. Inspect browser storage Review:first-party and third-party cookies; localStorage; sessionStorage; IndexedDB; service workers; application caches where relevant.For every entry, record its name, domain, lifetime, attributes and creation time. Secure, HttpOnly and SameSite are valuable security attributes, but they do not determine purpose or consent requirements by themselves. Clear site data between scenarios. Otherwise, an identifier created during the “accept” test can contaminate the “reject” test. 4. Compare behaviour before and after a choice Reload the same page in each state and compare:contacted domains; request count; created cookies; sent events; deferred scripts; calls triggered by interaction.A tag may stay silent at first load and fire after scrolling, clicking or opening a widget. Test the important interactions, not only the initial page request. For session replay, chat and personalisation tools, review masking and excluded areas. A minimal tracking plan is a useful reference point: collection should remain tied to a decision rather than the technical ability to record everything. 5. Inspect the transmitted payload Open representative requests and examine:full URL; query parameters; request body; headers; referrer; persistent identifiers; event properties.Look specifically for data that should not enter an analytics URL:email address; telephone number; name; customer ID; password-reset token; session token; free-form text; sensitive search query; case or account reference.URLs are routinely copied into logs, browser history, observability systems and support tools. Data placed in a query string can spread far beyond the analytics product. 6. Connect technical findings to governance The Network panel cannot answer every question. Review the vendor documentation and account settings:retention; hosting and subprocessors; international transfers; vendor reuse of data; sharing options; roles and access; exports; deletion; audit logs; multi-site configuration.Where a team is considering a limited audience-measurement exemption, the actual configuration matters. Under the CNIL framework, the purpose must be strictly limited to audience measurement for the publisher, and the result must be anonymous statistics without cross-site tracking or data combination. The national rules and implementation need to be assessed for the relevant country. 7. Turn the inventory into work Use four simple severity levels:Critical: sensitive data or tokens exposed, marketing tags firing after refusal, session identifiers in URLs. High: unknown provider, no internal owner, session replay on sensitive areas, uncontrolled retention. Medium: excessive lifetime, duplicate tags, unnecessary parameters, incomplete documentation. Low: naming cleanup, stale test tags, missing comments or weak evidence.Every action needs an owner, due date and validation test. “Review later” is not a workable remediation item. A 90-minute first pass A small site can complete an effective initial review in one short workshop. 20 minutes: map the scope List critical templates, expected tools and consent states. 30 minutes: observe Inspect network and storage on three to five pages in the initial, reject and accept states. 20 minutes: reconcile Compare observed domains with the consent interface, privacy notice, tag manager and vendor contracts. 20 minutes: decide Remove ownerless components, open high-priority tickets and schedule deeper tests. This does not replace a full assessment, but it often finds the most expensive issues: forgotten scripts, duplicate tags, personal data in URLs and premature firing. Common audit mistakes Treating a scanner as a conclusion Automated tools help discover domains and cookies. They cannot always determine purpose, event context or contractual configuration. Their findings need manual verification. Testing only “accept all” The reject state is often the most informative test because it shows whether the visitor’s choice is actually enforced. Ignoring first-party requests A request sent to your own domain may still be proxied elsewhere or contain data that should not be collected. Auditing production once A new tag-manager rule, CMS plugin or marketing integration can change collection without a visible interface change. Lightweight quarterly reviews and pre-launch checks are more useful than one large annual exercise. Producing a table with no owner An inventory without decisions, owners or dates becomes stale quickly. Governance turns the audit into actual risk reduction. The minimum evidence package Keep four items:the component inventory; key evidence, such as screenshots or network exports; a decision log with rationale; remediation tasks and retest results.Version the document. For multi-site teams, add a “web property” column and distinguish global components from local exceptions. Conclusion The goal is not to declare the site perfect. It is to explain what was observed at a given date, why each component exists and how gaps are being resolved. FAQ Does a cookieless site still need a tracker audit? Yes. Pixels, network calls, local storage and identification techniques can operate without HTTP cookies. The audit must focus on data flows and purposes, not only cookies. Are automated scanning tools enough? No. They accelerate discovery but do not replace manual checks of trigger conditions, payloads, account settings and internal ownership. Must every page be tested? Not necessarily. Select a representative sample of templates, integrations, journeys and consent states, then test sensitive areas more deeply. How often should the audit be repeated? After material stack changes, before sensitive launches and on a cadence that matches the rate of change. For a small team, a lightweight quarterly review is often more realistic than a large yearly audit. Does a technical audit prove GDPR compliance? No. It documents technical facts. Compliance also depends on purposes, legal bases, contracts, transparency, individual rights and applicable national ePrivacy rules. Sources Sources checked on June 21, 2026.CNIL, Cookies and trackers: what does the law say? CNIL, Cookies and audience measurement solutions CNIL, public consultation on session replay, February 25, 2026 EDPB, Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive Chrome for Developers, Network panel reference OWASP, Information exposure through query strings in URL
- 02 Feb, 2026
AI traffic: how to measure visits that ChatGPT, Perplexity and Claude send to your website
Something has shifted in the way people find your website. And chances are, you have no idea it's happening. Since late 2024, conversational AI platforms have moved beyond answering questions. They now cite sources, insert links, and send real visitors to real websites. ChatGPT, Perplexity, Claude, Gemini, Copilot: these tools are becoming a genuine discovery channel, one that rivals traditional search engines in the quality of traffic it delivers. The catch? Most analytics tools don't separate this traffic. It gets lumped into "referral," blends into "direct," or vanishes from reports entirely. You may already have visitors arriving through a ChatGPT recommendation, and your dashboard won't show it. This article gives you the full playbook: how to spot AI traffic, why it matters, and what to do about it. A new discovery channel, growing fast The raw numbers are still modest. But the trajectory is hard to ignore. A study by SE Ranking covering nearly 64,000 websites across 250 countries (January-April 2025) found that ChatGPT alone accounts for 78% of all AI referral traffic worldwide. Perplexity comes in at roughly 15%, Gemini at 6.4%. Claude and DeepSeek share the remainder at under 1% each, though both show compelling growth curves. (Source: SE Ranking, "AI Traffic in 2025") A separate analysis by Conductor, reported by Search Engine Land, confirms this hierarchy across 13,770 domains and 3.3 billion sessions: AI traffic averages about 1% of total site visits, with ChatGPT generating 87% of it. (Source: Search Engine Land, Nov. 2025) One percent sounds negligible. Two things make it anything but. Growth is strong, but still uneven. Between January and April 2025, ChatGPT's share of global internet traffic doubled in SE Ranking's study, from 0.08% to 0.16%. Some industry analyses also show strong year-over-year growth in AI referral traffic. These figures still need to be read by sector: they do not automatically make AI the first acquisition channel for every site. Traffic quality can be interesting. Visitors arriving from AI platforms spend an average of 9 to 10 minutes per session in SE Ranking's study, compared to 3 to 4 minutes for organic search. Claude-referred sessions in that dataset reached a very high average duration in the EU. These are signals to inspect, not a conversion guarantee: each team should verify landing pages, useful events, and conversions in its own data. The logic is straightforward: a user who clicks a link inside an AI response has already asked a specific question, received context, and chosen to visit your site from among the cited sources. Their intent is pre-qualified. They know why they're coming. Why your analytics can't see it If AI traffic is this valuable, why doesn't it show up clearly in your reports? Three technical issues create this blind spot. The missing referrer problem When someone clicks a link in Perplexity from a web browser, the HTTP Referer header typically passes perplexity.ai as the source. Your analytics tool can then classify the visit as a referral from Perplexity. But this mechanism does not always work. Depending on the context, some sessions from AI tools may not pass a usable referrer. The reasons vary: mobile apps (ChatGPT on iOS, Copilot in Windows) may open links in internal webviews, some AI agents prefetch or preview pages without triggering the analytics script, and AI browsers such as Perplexity Comet or ChatGPT Atlas do not all pass signals the same way. (Source: MarTech, Nov. 2025) The result: a significant portion of AI traffic falls into the "direct" or "unassigned" bucket in your analytics, invisible and unattributed. GA4's default classification Google Analytics 4 can classify visits from AI assistants as "referral," the same category as a link from Facebook, a forum, or a directory listing. In the setups observed when this article was first written, teams still needed their own grouping to isolate this traffic. Always verify the current GA4 interface before documenting the procedure. In practice, if you open your acquisition report in GA4 without custom configuration, ChatGPT traffic is buried among dozens of other referral sources. For a site receiving hundreds of different referrers, spotting chatgpt.com or perplexity.ai requires knowing what to look for. The bot-vs-human confusion AI platforms interact with your site in two fundamentally different ways. The first is referral traffic: a human clicks a link in an AI response and lands on your page. This is real traffic with a real visitor. The second is crawling: AI platform bots (GPTBot for OpenAI, PerplexityBot, ClaudeBot, and others) visit your site to index content and feed their models. This crawl traffic is not useful audience data. It's data harvesting. GA4 automatically filters known bots, but the list isn't comprehensive. Some newer AI bots slip through, while some legitimate human visitors from AI tools get incorrectly filtered. Cloudflare has observed crawl-to-referral ratios as high as 700:1 for Perplexity, which gives a sense of how much harvesting activity exists relative to actual human visits. (Source: Digiday, Dec. 2025) How to identify AI traffic in your tools Two approaches work, depending on what you're using. In GA4: create a dedicated "AI Traffic" channel The recommended method is to build a custom channel group that aggregates all known AI sources. Here's the process:In GA4, go to Admin > Data Settings > Channel Groups. Click the default channel group, then "Copy" to create a new one. Add a channel called "AI Traffic." Set the rule: Match type = "matches regex", then paste this pattern:(chatgpt\.com|chat\.openai\.com|perplexity\.ai|claude\.ai|gemini\.google\.com|copilot\.microsoft\.com|deepseek\.com|meta\.ai)Drag your "AI Traffic" channel above the default "Referral" channel in the priority order. This is critical: GA4 evaluates rules top-down, and if "AI Traffic" sits below "Referral," visits will be classified as referral before reaching your rule.This setup only applies to new data (no retroactive effect). Allow a few days before results appear. For a one-time analysis of historical data, create an Explore report with a filter on "Session source" using the same regex. (Source: MarTech, Nov. 2025) In a lightweight analytics tool (Plausible, Fathom, etc.) This is where a well-designed simple tool can help. In Plausible, the "Sources" report displays every identified referrer directly. If chatgpt.com or perplexity.ai appears as a source, you can inspect it without creating a custom channel first. Click the source to filter the dashboard by that origin and analyze entry pages, time on site, and triggered events. Plausible documented its own experience: in 2024, the Plausible blog saw a 2,200% surge in AI referral traffic within months, all identifiable from their standard dashboard with zero configuration. (Source: Plausible, Dec. 2024) This is a textbook case where the frugal analytics philosophy helps: when a tool is designed to surface essential data without layers of configuration, emerging signals are easier to inspect. A tool like GA4 remains powerful, but it often requires dedicated configuration to isolate a new family of sources. For a broader view of analytics tool families, see our Google Analytics, Matomo, and frugal analytics comparison. AI referral traffic vs AI crawling: two different things A common mistake is conflating referral traffic (humans clicking) with crawling (bots scraping). They deserve separate attention because they raise different questions. AI referral traffic is an opportunity. It represents a qualified, pre-informed visitor arriving with intent. Measuring it lets you optimize landing pages, adapt content, and understand how AI platforms perceive your site. AI crawling is a governance question. Bots like GPTBot, PerplexityBot, and ClaudeBot visit your site to train their models or answer user queries in real time. Some do so aggressively: Cloudflare found that GoogleBot's crawl volume (which also feeds Gemini) dwarfs that of all other AI bots combined. You can control crawling through your robots.txt file: User-agent: GPTBot Disallow: /User-agent: PerplexityBot Disallow: /User-agent: ClaudeBot Disallow: /But beware the paradox: blocking the crawl can reduce your referral traffic. If an AI can't index your content, it can't recommend it to users. This is a trade-off to make deliberately. An emerging approach uses an llms.txt file (a Markdown file placed at your site's root) to guide AI platforms toward the content you want to make accessible, without blocking all crawling. Anthropic (the company behind Claude) uses this mechanism on its own site. How to get cited by AI platforms Understanding AI traffic also means understanding what triggers it. AI platforms don't cite sites randomly. Several factors drive citations. Content structure matters. Analyses cited by Superprompt suggest that pages with clear heading hierarchies (H2, H3, lists) and direct answers are easier for AI systems to reuse. Structured FAQ sections are particularly useful because they match the question-and-answer format of AI interactions. Freshness can help. Recently updated content is often easier to use in answers that need current information. The effect still depends on topic, domain authority and how the AI platform retrieves sources. Original data attracts citations. Data tables, proprietary statistics and exclusive benchmarks can be easier to cite than generic content. This is another argument for precise, data-driven KPIs over vanity metrics. Traditional SEO remains the foundation. Several market studies connect AI visibility with conventional SEO signals: structure, authority, freshness and editorial clarity still matter. SEO doesn't depend on Google Analytics, but it remains part of the foundation for AI visibility. What this means for choosing an analytics tool AI traffic exposes an operational limit in complex analytics platforms: emerging signals often need prior configuration before they are easy to read. With GA4, you need to create a channel group, write a regex, update it regularly (new AI tools launch every month), and accept that the data won't be retroactive. It's doable, but it demands technical expertise that most small business owners and freelancers simply don't have. With a well-designed lightweight analytics tool, AI referrers can appear directly in the sources report, right alongside Google, LinkedIn, or Twitter, when the referrer is actually transmitted. That does not remove webview, direct or prefetch limits, but it makes visible signals easier to read. That's the core principle of analytical sobriety: collect less data, but make every data point immediately readable. AI traffic is not something to ignore. It is one signal of a change in how some people discover content online. Sites that measure it today will mostly have a clearer read on emerging sources, without overstating a volume that often remains small. The question is no longer whether AI platforms send traffic to your site. It's whether your measurement tool shows it to you.Frequently asked questions What percentage of my traffic comes from AI? Late-2025 studies still place identifiable AI traffic at a small share of total traffic, with large variations by sector. That only reflects identifiable traffic: when an AI session lacks a usable referrer, it can fall into "direct" and remain difficult to attribute. How do I see ChatGPT traffic in Google Analytics 4? If your GA4 interface does not yet provide an AI channel that fits your needs, create a custom channel group: go to Admin > Data Settings > Channel Groups, add an "AI Traffic" channel with a regex rule covering AI domains (chatgpt.com, perplexity.ai, claude.ai, gemini.google.com, copilot.microsoft.com). Place it above the "Referral" channel in the hierarchy. Data will only be collected from the date you create the channel. Should I block AI bots with robots.txt? It's a trade-off. Blocking AI bots (GPTBot, PerplexityBot, ClaudeBot) via robots.txt prevents your content from being indexed by these platforms, which may reduce citations and referral traffic. On the other hand, not blocking means your content feeds AI model training, raising intellectual property and consent questions. A middle-ground approach uses an llms.txt file to guide AI platforms toward the content you want them to access. Can cookieless analytics detect AI traffic? Yes, when a usable referrer is transmitted. Cookieless tools like Plausible, Fathom, or Simple Analytics can display those referrers directly in their sources report without a dedicated channel group. That is often easier to inspect, but it does not solve referrer, direct or prefetch limits. How do I optimize my content to get cited by ChatGPT or Perplexity? Five levers are worth testing: structure content with clear headings (H2/H3) and FAQ sections; keep content fresh when the topic requires it; produce original data (tables, statistics, benchmarks); maintain strong traditional SEO; and consider an llms.txt file to make structured content easier for AI crawlers to access. Effects vary by platform and topic, so document your assumptions before turning them into an editorial rule.Sources and figures were checked for the initial February 2026 publication. AI traffic shares and GA4 classifications evolve quickly: verify the current interface and documentation before turning this into an internal rule. Sources Sources checked on May 10, 2026.SE Ranking, "AI Traffic in 2025: Comparing ChatGPT, Perplexity & Other Top Platforms" Search Engine Land, "AI sends 1% of website traffic — and most of it is from ChatGPT" MarTech, "How GA4 records traffic from Perplexity Comet and ChatGPT Atlas" Plausible Analytics, "Breaking down our 2.2K% surge in AI traffic"