Dark social: most sharing happens where you cannot track it

Most sharing is private, and your analytics files it under direct

Ask your last five customers where they first heard of you. Not where they clicked from, not what the attribution report says, but where the name first reached them. The honest answer will often be a conversation you never saw. A colleague mentioned you in a Slack channel. A friend dropped your article into a WhatsApp group. Someone forwarded a newsletter with one line on top: worth a look.

None of that shows up as a source in your analytics. When the recipient taps the link, the visit usually arrives with no information about where it came from, and Google Analytics files it under Direct, the bucket for visits it cannot explain. This invisible layer of private sharing has a name, dark social, and the most quoted figure about it is that it carries 80% or more of all sharing.

That figure is the headline of the earlier version of this article, and it deserves a closer look than it usually gets. It comes from a vendor study published in 2016, it measures something narrower than most people who quote it assume, and nobody independent has repeated it since. The direction it points in still holds up: most sharing is private. In this article I show where the number comes from and what it really measures, why a shared link turns into direct traffic, how to measure the private channel without tracking anyone who said no, and how to make private recommendations more likely. Along the way I work through the figures of an invented software firm in Leeds.

What dark social means, and where the name comes from

The term comes from Alexis Madrigal, writing in The Atlantic in October 2012. Working with the analytics firm Chartbeat, he looked at visits to individual articles that arrived without any referrer. Nobody types a long article address from memory, so those visits had to come from somewhere: email, instant messages, chat apps. On the day he first looked, this unmeasured traffic delivered 56.5% of the social visits to The Atlantic's stories, against 43.5% for all the social networks you know put together. Across Chartbeat's wider set of media sites, almost 69% of social referrals were dark, Facebook came second at 20% and Twitter third at 6%.¹

Dark social, then, is sharing through private channels where the information about the source is lost on the way. Someone copies a link and pastes it into WhatsApp, iMessage, Signal, Slack, Microsoft Teams, a LinkedIn message or an email. The person who taps it arrives at your site, and your analytics sees a visit with no history.

It is worth keeping Madrigal's own caveat in mind: the numbers were a snapshot of media sites in 2012, measured on the day he looked, and he says himself that they varied a lot from day to day.¹ It was a discovery, not a census.

Where the 80% comes from, and why I no longer put it in a headline

The figure behind "80% of sharing" is RadiumOne's 2016 white paper, The Dark Side of Mobile Sharing. RadiumOne sold sharing software that publishers installed on their sites: share buttons and a tool that noticed when someone copied a link. The paper analysed what the people using those sites did in February 2016, a universe the company put at more than 940 million monthly users. Its finding: 84% of outbound sharing from the sites happened through private channels such as email and instant messaging, up from 69% in the company's 2014 report. Facebook carried 7% and all other public networks together 9%. On mobile, 82% of shares were dark.²

Three things make me careful with that number.

It is a share of shares, not a share of traffic and not a share of recommendations. It counts the share actions the software could see on sites that had installed it. A recommendation made out loud in a meeting, or a link copied from the browser's address bar on a site without the tool, does not appear in it at all.

It comes from a vendor whose business was selling the measurement of dark social to advertisers. That does not make it wrong, but it is the kind of number a company has every reason to make large, and the paper's sample is the sites that bought the product, not the web.

It is ten years old. In 2016 the share buttons of the big networks were everywhere, the browser rules for passing on the source of a visit were looser, and messaging was smaller than it is now. I found no independent study since that repeats the measurement.

Chartbeat's own later look at its network gives a useful counterweight. In December 2014 it reported that dark social made up about a third of external traffic to the sites it measured, with upwards of 50% of external mobile traffic lacking a referrer on some sites. It also found that up to half of that dark traffic could be traced to apps, such as Facebook's and the apps people used to read Reddit, which at the time often opened links without passing on the source.³ So part of what looked like private sharing was public social traffic that had lost its label.

The four figures look contradictory until you notice that each one divides by something different.

Four dark social figures, four different denominators

The honest summary is the one in the title: most sharing is private, and a sizeable part of what your analytics calls direct is really someone passing your link on. Whether that is 50% or 84% depends on what you count, on your audience and on the year. Anyone who quotes a precise figure for your site without measuring your site is guessing.

Why a shared link arrives as direct traffic

When you click a link on a web page, the browser normally tells the next site where you came from, in a request header called the referrer. Analytics tools read it to sort visits into channels. The mechanism fails in three common situations.

The first is a link opened from an app rather than a web page. A link tapped in WhatsApp, in the Mail app, in Slack's desktop app or in a PDF opens in the browser with no previous page, so there is nothing to report. Chartbeat tested this in 2014 by posting links in popular apps and clicking them: Gmail, instant messages and text messages passed no referrer on desktop, mobile browser or app, the Facebook app only sometimes, and the leading apps for reading Reddit not at all.³

The second is the browser's own privacy rule. If a site sets no policy of its own, browsers today default to one called strict-origin-when-cross-origin: to another site they pass on only the domain, never the full page address, and nothing at all when the visit goes from a secure HTTPS page to an insecure HTTP one.⁴ Webmail opened in a browser therefore tends to show up as a referral from the mail provider's domain, if it shows up at all, with no clue which message carried the link.

The third is plain copying. Someone copies the address from their browser and pastes it into a chat. Whatever the link carried when they found it is usually still there, but whatever the chat could have added is not.

Google Analytics 4 then applies its channel rules. A visit whose source is (direct) and whose medium is (none) or (not set) lands in Direct, which Google describes as users arriving "via a saved link or by entering your URL". Referral needs a medium of referral, app or link.⁵ A link pasted into WhatsApp meets neither description, but it ends up in Direct, beside the genuine bookmarks.

One more filter sits on top of all this. Your analytics only sees the visitors it is allowed to see. In Ireland, Germany and Austria I set up analytics with basic consent mode by default, so nothing is measured for people who decline. In the UK, how far analytics runs before consent is a risk decision for the business and its lawyer. Either way, every number below is a number about the people who said yes, and the dark share among them is not guaranteed to match the dark share among everyone.

Why private recommendations carry more weight

Public sharing is partly a performance. A post on LinkedIn is written for an audience and says something about the person posting it. A link sent to one colleague in a direct message is different. The sender picked a specific person because they thought it would help that person. The recipient knows that, and the trust between the two of them transfers to whatever they sent.

Think about your own habits. When you find a tool, a supplier or an article that genuinely solves a problem, you are more likely to send it to the two or three people who need it than to post it for everyone. That is the recommendation that moves a purchase, and it is the one your dashboards cannot see.

This creates a systematic distortion. Channels you can measure, such as paid ads, search and tagged campaigns, collect the credit for conversions. The private recommendation that planted the name weeks earlier collects none, because its visits sit in Direct or never happen at all: the recipient remembers the name and searches for it later, and the search gets the credit. A business that steers by its attribution report alone will tend to spend more on what it can see and less on what makes people talk.

No tool fixes that by force. You cannot put a pixel in a WhatsApp group, and you should not try. What you can do is ask, tag the links you hand out, and read your own data with the gap in mind.

Measuring what you can, without tracking people who said no

Ask, in an open text field

The most useful measurement of dark social is also the oldest: ask. Put a "How did you hear about us?" field on the demo request, the contact form or the checkout, and make it free text rather than a dropdown. A dropdown offers search, social, ad and other, and people pick the nearest box. Free text gets you "my business partner sent me your article" and "someone mentioned you in the hospitality owners' WhatsApp group", which no list would have anticipated.

It is not a perfect instrument. People forget the first touch and remember the last one, they compress a month of contact into one sentence, and the people who bother to answer may not be typical of everyone who asked. Even so, it captures a signal that clickstream data cannot, and it collects nothing about anyone beyond what they choose to type.

Worked example: a scheduling tool in Leeds

Kirkgate Rota is an invented staff scheduling tool for cafés and restaurants, based in Leeds, at kirkgaterota.example. Nobody real, every figure made up. Its marketing lead, Hannah, adds an optional open text field to the demo request form at the start of a quarter.

Over the quarter, 180 demo requests come in. Google Analytics, counting the last channel before each request, says 76 came from Direct, 52 from Organic Search, 34 from Paid Search, 10 from Referral and 8 from Organic Social. Hannah sorts the free text answers by hand. 150 people answered, 30 left the field blank. Of the 150, 63 named a person or a private conversation (a colleague, another café owner, a group chat), 42 said they searched, 24 mentioned an ad and 21 something else, such as a trade show.

The share of answers naming a private recommendation is a simple proportion, the basics of which are in the Foundations section on percentages:

$\hat{p} = \frac{w}{n}$

Here $\hat{p}$ is the estimated share of answers naming a private recommendation, $w$ is the number of answers that did and $n$ is the number of people who answered.

With Hannah's figures that is $\hat{p} = 63 / 150 = 0.42$.

A sample of 150 leaves room for chance, so Hannah puts a range around it. The usual approximation for a proportion, explained in the Foundations section on confidence intervals, is:

$\hat{p} \pm 1.96\sqrt{\frac{\hat{p}(1-\hat{p})}{n}}$

where $\hat{p}$ is the observed share, $n$ the number of answers and $1.96$ the multiplier for a 95% interval.

With her figures that is $0.42 \pm 1.96\sqrt{0.42 \times 0.58 / 150} = 0.42 \pm 0.079$.

So somewhere between about 34% and 50% of the people who answered first heard of Kirkgate Rota through a private recommendation, while analytics credits no channel at all with that. The range is the honest part. It says roughly four in ten, not 42.0%. It also holds only for the people who answered: if those who skip the field are, say, more often ad clickers, the true share is lower. The Foundations section on sampling covers why that matters.

The cross check is just as useful. Of the 76 requests that analytics put in Direct, 41 named a person in the free text. Direct, at Kirkgate Rota, is mostly word of mouth wearing a disguise. Of the 34 that analytics credited to Paid Search, 9 named a colleague first: the ad caught people who already had the name.

Tag the share buttons you control

You cannot tag a link someone copies from the address bar. You can tag the links your own share buttons produce. If the WhatsApp, email and copy link buttons on an article add campaign tags, the visits those links bring back are counted in their own channel instead of Direct. A WhatsApp share might carry utm_source=whatsapp&utm_medium=social&utm_campaign=article_share, and an email share utm_source=share_button&utm_medium=email&utm_campaign=article_share. Google Analytics 4 sorts a medium of social into Organic Social and a medium of email into Email,⁵ and anything it does not recognise into Unassigned, so the naming matters. The full convention, and how to keep it consistent, is in mastering UTM tracking for your online campaigns.

Two limits apply. The tags describe the campaign and the button, never the person: the same tag for everyone who presses it. A link that carries a personal identifier, so that the person who shared can be recognised on the other end, is what the UK guidance calls navigational tracking, and the rules on storage and access technologies apply to it.⁶ And a tagged link is a longer link. In a chat it looks less tidy than a clean address, which is a small cost against a clear gain in measurement.

Read the direct traffic you already have

Without collecting anything new, you can split Direct by landing page. People do type your home page or your pricing page. Hardly anyone types a deep article address with nine words in it. When direct sessions to such pages rise on the day an article goes out, the obvious explanation is that someone is passing it around. That is the same reasoning Madrigal used in 2012,¹ applied to aggregated reports you already have, with no extra data about anyone.

What not to do

There is a temptation to close the gap by recognising people across visits without cookies, by combining the details a browser reveals about a device into a fingerprint. Do not. The UK regulator, the Information Commission (formerly the ICO), says the consent rules apply to fingerprinting where it stores or reads information on a device,⁶ and called fingerprinting "not a fair means of tracking users online" because it relies on signals people cannot easily clear.⁷ Fingerprinting someone who declined cookies is exactly what that consent was meant to prevent. Server side tracking is a legitimate way to make measurement more reliable for people who agreed, but it is not a back door for people who did not, and it is never a basis for retargeting without consent. The broader approach, building on data people give you knowingly, is in cookieless marketing and a first party data strategy for 2026.

How to make private sharing more likely

You cannot measure dark social precisely, but you can make it more likely to happen and more likely to lead back to you.

Write things worth forwarding to one person

The test is simple: would someone send this to a colleague with "thought this might help"? Private shares go to content that solves a specific problem for a specific kind of person. "How to cut no shows for a 40 cover restaurant" travels through the hospitality group chats. "Ten marketing tips" does not, because nobody can think of the one person who needs it. Depth helps too. People protect their reputation with the colleagues they send things to, so they forward what is substantial and leave out what is fluff.

Make the link look good when it lands

When a link is pasted into WhatsApp, Slack, Teams or iMessage, the app builds a preview from the page's Open Graph tags: a title, a description and an image.⁸ That preview is your first impression in the chat. A missing image or a generic site title makes the share look like spam. Set the tags on every article, and paste a few links into the apps your audience uses to see what they really show.

Offer the private channels as buttons

Most share widgets still offer only the public networks. Add the channels where sharing actually happens: WhatsApp, email and a copy link button. Each one removes a step between the impulse and the share, and, tagged as above, each one gives you a measurable trace. Build them as plain links rather than the networks' embedded widgets, which usually load third party code that can fall under the consent rules before anyone has shared anything.

Give people a sentence to repeat

A recommendation needs words. If someone cannot say what you do in one accurate sentence without opening your website, they will not recommend you, however much they liked you. Specific outcomes travel better than categories: "they set up our rota so it fills itself" beats "a workforce management solution".

Make the good parts screenshot friendly

People share screenshots of charts, figures and short passages, often without a link. Put your name or domain on the charts and key figures, so that the picture still says where it came from when it travels on its own.

Be useful where your audience already talks

Slack communities, trade association forums and owner groups on WhatsApp are where many recommendations happen. Showing up there to promote yourself gets you removed quickly. Answering questions well, over months, makes you the name people mention when the question comes up again.

Rethinking attribution when the biggest channel is invisible

Your attribution data is incomplete in a predictable direction. It overstates what it can see and understates word of mouth. That does not make it useless. It means reading it alongside other evidence: the free text answers, a handful of conversations with recent customers about how they found you, and the trend in direct visits to deep pages. Where those sources agree, you can act with some confidence. Where they disagree, the disagreement is the finding.

It also means accepting that some of the most valuable work will never show a return in a dashboard: content that someone forwards, a product moment that makes someone tell a colleague, service good enough to be mentioned. These are slow, and they are hard for a competitor to copy, because a recommendation cannot be bought.

What I do on the sites I build

On the sites I build, the demo or contact form gets an optional open text field asking how people heard of the business, and the answers are read and coded every month. Share buttons cover WhatsApp, email and copy link, each with campaign tags that describe the button and never the person. Open Graph tags are set per page and tested in the apps the audience uses. Analytics runs behind a consent banner, with basic consent mode by default in Ireland, Germany and Austria, and nothing on the site fingerprints visitors or follows people who declined. Direct traffic is reported by landing page, so the deep pages that people pass around are visible.

If you want to know how much of your direct traffic is really word of mouth, I run a free workshop, and the first two weeks of work are on me. Book it on the contact page.

Related reading

• Zero click content: how to win when nobody visits your website
• Community led growth: how to win by actually being helpful
• Server side tracking: the technical guide to fixing your broken analytics