// AI ATTRIBUTION / DARK AI TRAFFIC
Dark AI Traffic: What the 70 Percent Estimate Can Prove
The 70.6 percent dark AI traffic figure comes from a vendor classifier. Its validation limits deserve the same attention as the headline.
The AI Attribution Gap explains how an AI referral can lose its source information. The mechanism is known; its share of your Direct traffic is not. Those are separate claims.
The stat everyone quotes doesn't survive a source check
The version you have probably seen: a marketer found 86 percent of new users misfiled as Direct, while referral traffic fell 90 percent and new users grew 126 percent year over year. It reads as proof. I went to the original.
The illustration traces to a July 2025 Search Engine Journal analysis of one consultant's GA4 dashboard. The 126 percent figure describes Direct traffic rising year over year, not new users. The owner also reported blogging more frequently, a possible confound rather than proof of any particular source. Organic social was down 33 percent and organic search down 28 percent. One dashboard cannot identify which channel produced the change.
That leaves a single-property illustration, a metric changed in retelling, and multiple possible explanations. It is not a measured hidden-AI share.
The industry's headline number is circular
The Loamly benchmark estimates that 70.6 percent of its classified AI traffic is hidden. It discloses no classifier, validation set, or false-positive rate. That prevents an independent audit of the category and its hidden share.
Other vendors report different ranges using different datasets and methods. Attrifast reports a median 34 percent of Direct as AI and approximately 80 percent precision for its behavioral layer. These percentages use different denominators from Loamly's hidden share. Neither the spread nor a stated precision figure makes one estimate a measured floor for your site.
What the panel observed
Every method above infers AI influence from what is missing: no referrer, a new visitor, a deep page. One study did something different. A clickstream panel with an opted-in user base tracked real visits to paired competitor brands after each was recommended by an AI assistant, across a seven-day window, and could observe what actually happened rather than guess from absence.
The panel reported 55.9 percent of the traced AI-influenced visits through branded search, 19.9 percent through direct navigation, and 8.8 percent through assistant click-through. Direct is larger than click-through in that comparison. These are later brand visits within the panel's seven-day window, not a measurement of the share of AI clicks that lost a referrer. They cannot validate the vendor hidden-share estimates.
Pew's July 2025 browsing study asks another question. It found traditional-result clicks in 8 percent of Google visits with an AI summary, compared with 15 percent without one; summary-link clicks occurred in about 1 percent. That describes Google browsing in the study, not the origin of a different site's Direct visits.
What actually strips a referrer, and what doesn't
Chrome made cross-origin referrers origin-only by default in August 2020. Firefox followed in March 2021. Neither change produces Direct traffic by itself. Origin-only means the destination still learns you came from a source, just not the exact page. Direct requires no referrer to arrive at all, which is a narrower and more specific failure.
Common causes include a bookmark or typed URL with no referring document, a native app handing a link to the browser without source information, and a linking page setting a no-referrer policy. HTTPS-to-HTTP navigation also loses the referrer under policies such as strict-origin-when-cross-origin; the W3C specification permits other behavior under unsafe-url. Browsers can suppress referrers for privacy as well. These mechanisms are not specific to AI.
Cloudflare observed that referrals from Claude's native app lacked a referrer and described behavior in other native apps as an inference. Web and native-app behavior can differ. Preserve that surface distinction before applying the result to traffic labelled with one assistant name.
UTM parameters can supply explicit source information when a link carries them, but their presence is not universal across assistant surfaces. Incomplete campaign tagging can also change classification. Inspect actual landing URLs, source, medium, and campaign values rather than assuming every assistant link is tagged or untagged.
A crawl is not a click
Server logs can confirm an AI company's bot visited a page. They cannot tell you a human read the answer and came to your site afterward, because that is a separate event the bot never sees. Conflating the two is how a crawl becomes a phantom conversion in somebody's dashboard.
OpenAI distinguishes OAI-SearchBot, GPTBot, ChatGPT-User, and OAI-AdsBot; the last validates submitted ad pages rather than providing a human-referral count. Anthropic distinguishes ClaudeBot, Claude-SearchBot, and Claude-User. Use the current purpose and verification guidance for each signature. A user-agent string alone can be spoofed.
Google-Extended is a robots.txt control token without a separate HTTP user-agent string. Applebot-Extended controls use of Applebot-crawled data and does not crawl pages itself. Searching logs for either token cannot establish whether the underlying crawler accessed a page.
Older audits show why the denominator matters
A no-referrer, deep-page, new-visitor rule also appeared in dark-social measurement. Chartbeat's follow-up found that better mobile-app detection reassigned a large share to ordinary referrals. In Jason Packer's 2014 organic-search analysis, the point is denominator dependence: Groupon's 60 percent of Direct result did not establish that share for another site. The fraction of organic referrals missed and the fraction of Direct that was organic are different measures. That is a useful warning against transporting any hidden-share figure between sites.
In SparkToro and Really Good Data's April 2023 experiment, 1,113 known visits crossed eleven social networks over ten days. In that sample, every tested TikTok, Slack, Discord, Mastodon, and WhatsApp visit was classified as Direct without referral information; Instagram DMs lost that information in 30 percent of visits. The panel was not representative of all internet users. A classifier that treats those no-referrer journeys as AI can mislabel ordinary social sharing. Test that confound rather than assuming it is absent.
What can be measured next
Custom channel groups can organize known assistant referrers. Server-side measurement can improve coverage for some tracking losses. Neither can manufacture source information that never reached the site. Those tools remain useful within that boundary.
Verify crawler activity separately, preserve observed referral domains, and track citation appearances as sampled visibility. If you estimate no-referrer influence, publish the classifier, validation method, and false-positive rate. Without those, the estimate is neither a counted total nor a validated upper bound.
Company identification is a separate measurement problem. Naming an account does not identify the source of its visit. When the source cannot be established, retain the unknown instead of printing a precise AI percentage. The pipeline article follows the evidence that can be preserved into commercial reporting.
Frequently asked questions
Is the viral stat about 86 percent of AI traffic hiding in Direct real?
The underlying dashboard showed 86 percent of new users arriving through Direct, not 86 percent of AI traffic hiding there. In Search Engine Journal's July 2025 analysis of one consultant's property, Direct traffic rose 126 percent year over year. The owner also reported blogging more frequently, a possible confound rather than a demonstrated explanation. Without evidence identifying the visits' origins, that dashboard cannot establish a hidden-AI share.
How much of my Direct traffic is actually AI?
A universal share is not established. Vendor estimates use different cohorts, classifiers, and denominators, while many non-AI journeys also lose referrers. A panel of AI-influenced later visits does not establish what fraction of your Direct traffic came from AI.
Does GA4's AI Assistant channel fix the dark traffic problem?
It classifies recognized assistant referrers. It cannot identify the origin of every no-referrer visit, and the missing share is not established merely by the channel total.
Why does AI-influenced traffic often look like branded search instead of Direct?
In the cited seven-day panel, 55.9 percent of traced AI-influenced visits arrived through branded search, 19.9 percent through direct navigation, and 8.8 percent through assistant click-through. Direct was larger than click-through. These later-visit shares do not measure how many AI clicks lost referrers.
What actually recovers referrer-less AI traffic?
Logs can verify crawl activity, which is a separate event from a human referral. They cannot identify a missing human source merely from a prior fetch. Report crawl-confirmed activity as crawl activity and keep unvalidated human-source estimates separate.
What is a false-positive rate, and does Loamly publish one?
It is the rate at which a classifier labels non-AI visits as AI. Loamly does not publish the validation evidence needed to audit that rate. Other vendors disclose different limits; a stated precision figure is not the same as a false-positive rate.
Sources
The original illustration: Search Engine Journal’s July 2025 single-property analysis. Vendor estimates: Loamly and Attrifast. Panel sources: Pew and SparkToro’s Similarweb analysis. Other attribution checks: Chartbeat’s mobile-app research, SparkToro’s controlled dark-social study, Quantable’s denominator discussion and Cloudflare’s crawl-to-referral measure. Current crawler documents are linked beside the bot-specific claims above.
About the author
Jeff Brokaw is a CMO and Certified Chief AI Officer who builds AI workflows, measurement systems, and the commercial operations around them.