1 · The stack
One switch decides what loads
There is no Google Tag Manager or separate gtag install. Every tool below reaches the browser through Segment, and Segment loads only when a short block of custom site code says so. That block checks a single consent category.
utm_* values before PHP sees them.analytics.reset().page, track, identify. No consent data on events.G-P0ERYLCMC4), Google Enhanced Conversions, Meta, TikTok, Snap, Reddit, Braze, LiveChat.What changed from the first diagram
- 1Events carry a consent stamp. They don't. No
context.consentis sent, so Segment's consent category mappings do nothing. - 2A Segment consent wrapper waits for OneTrust. Custom site code does the waiting, from the window load event.
- 3GA4 depends on a mapping to Performance. GA4 loads whenever Segment loads. It fires before any click for U.S. visitors (retest confirmed).
- 4After Reject All, Segment filters destinations. Nothing stops on the current page. Segment stays off from the next page on.
- 5New: ad pixels follow Performance consent, not Targeting. Turning off only Targeting changes nothing.
How to read the evidence tags
- CConfirmed in a browser test on Oct 13, 2026.
- RRead from the production site code or a settings screen. Logic is certain; the network result hasn't been watched.
- DFrom the vendor's documentation. Not tested on this site.
- ?Not yet tested. The box shows the expected result.
2 · Consent flow
What happens for each kind of visitor
Pick a visitor. Columns run left to right in time; rows are the systems involved. Red boxes are places where data flows even though the visitor's choice says it shouldn't.
3 · Destinations
Every tool waits on the same category today
Each of these runs in the visitor's browser (device mode), so once one has loaded it can't be pulled back until the next page load. The proposed column follows the audit; two rows still need a decision.
| Tool | What it does here | Loads when, today | Proposed gate |
|---|---|---|---|
| GA4 Web | Site analytics. Google Signals and ad personalization are on; Consent Mode is off. | Performance (C0002) | Decide: Performance, Targeting or both |
| Google Enhanced Conversions | Sends hashed conversion data to Google Ads. | Performance (C0002) | Targeting (C0004) |
| Facebook Pixel | Ad conversions and audiences. | Performance (C0002) | Targeting (C0004) |
| TikTok Pixel | Ad conversions and audiences. | Performance (C0002) | Targeting (C0004) |
| Snap Pixel | Ad conversions and audiences. | Performance (C0002) | Targeting (C0004) |
| Reddit Pixel | Ad conversions and audiences. | Performance (C0002) | Targeting (C0004) |
| Braze | Email and messaging profiles. | Performance (C0002) | Targeting (C0004) |
| LiveChat | Chat widget. | Performance (C0002) | Not discussed yet |
Option A · Segment's official OneTrust wrapper
Consent travels on every event and each destination maps to its own category in Segment. Needs a Business-tier plan, Destination Filters turned on (off today), and every destination mapped.
Option B · Keep and fix the custom loader
Add a Targeting check for the ad tools, guard initSegment(), and reload the page after Reject All. Document it as the only gate, retest after every OneTrust change, and switch off Segment's unused consent categories so nobody assumes they're live.
4 · UTM journeys
Follow a link from the post to the report
This is a separate problem from consent. UTM tags are the labels on a link that tell GA4 where a visit came from. When they're missing, misspelled or lost along the way, GA4 files the visit under Referral or Direct. Pick a path, then flip between today and after the fixes.
5 · Where Direct comes from
More than half of sessions have no known source
GA4 session source / medium, Jul 15 – Oct 12, 2026: 194,918 sessions. Direct / (none) is 108,813 of them, or 55.8%.
Leaks GA4 can see
Sessions credited to the wrong source in the same period.
Leaks GA4 can't see
- ·Untagged taps inside social apps that send no referrer land straight in Direct.
- ·Untagged clicks from email apps (Gmail app, Apple Mail) do the same. Only Gmail on the web shows up, as
mail.google.comreferral (209 sessions). - ·Redirects that drop the query string entirely leave no trace. The 27
PANTHEON_STRIPPEDsessions are only the ones that kept a mangled tag. - ·Opt-in visitors who move past the landing page before accepting.
- ·Meta paid isn't lost, just split: 8,620 sessions across six source / medium names.
6 · Link tools
Build a link to the standard, or check one
Lowercase only, underscores instead of spaces, the platform in source, the traffic type in medium, and the campaign as org_topic_yyyymm. Nothing you type here leaves this page.
Link builder
Link checker
7 · Glossary
Terms used on this page
8 · Open questions
What's still unresolved
None of these changes the overall picture above. They decide the exact fixes and close the boxes marked with a question mark.