Tracking & analytics11 min readUpdated October 14, 2026

Cross-Domain Tracking: Keep One Session From Ad to Order

Cross-domain tracking for stores with a checkout on another domain: GA4 linker setup, GTM, Meta Pixel, payment-provider referrals, and how to test it.

Nick Bonnassies, CMO at Tagada · checked against 10 sources

Article summary

TL;DR

Cross-domain tracking keeps one shopper, one session and one traffic source when the journey moves from your store to a checkout on another domain. In GA4, you list your domains in the web data stream, and the Google tag passes the visitor's IDs in a _gl URL parameter. Payment providers that send shoppers back go in the unwanted referrals list.

You need it when the checkout runs on a different domain from the store, not between subdomains of the same domain.
GA4 passes the visitor's IDs in a _gl URL parameter that expires two minutes after the click. Every domain needs the same G- tag ID.
Redirects that drop query parameters and JavaScript-triggered navigation are the two usual reasons _gl never arrives.
PayPal, 3D Secure pages and other payment providers belong in the unwanted referrals list, not in the cross-domain list.
Meta's _fbp and _fbc cookies stay on each domain. Pass the click ID forward and send server events with the same event ID.

Want to go further? Ask

On this page

Your store runs on one domain, the checkout on another: a funnel builder, a hosted payment page, a separate cart. Each domain keeps its own cookies, so analytics sees the shopper arrive at checkout as a new visitor, and the order is credited to your own store instead of the ad that paid for it. Cross-domain tracking fixes that border, and a second setting stops payment providers from stealing the sale on the way back.

What cross-domain tracking is, and when an ecommerce store needs it

Analytics and ad tags identify a browser with first-party cookies. A cookie set on yourstore.com can't be read on checkout-tool.com. When the shopper clicks "Checkout", the second domain sets a new ID, starts a new session, and records the click on your store as the referral source.1

Fig. 1The same shopper, with and without the linker

No cross-domain setup

Ad clickLands on yourstore.com, ID A
clicks CheckoutCheckout domainNew cookie, ID B, new session
PurchaseSource: yourstore.com / referral

Two users, two sessions. The order is credited to a referral from yourstore.com, and the ad gets nothing.

Cross-domain measurement on

Ad clickLands on yourstore.com, ID A
URL carries _glCheckout domainReads _gl, keeps ID A
PurchaseSource: the ad campaign

One user, one session. The purchase keeps the ad as its source.

One order, two stories

Illustrative example. Mechanism from Google Analytics Help, Set up cross-domain measurement.

You need it when the journey crosses two registrable domains you control:

a storefront on one domain and a checkout or cart hosted by a funnel tool on its own domain;
a landing page or advertorial on a separate domain that sends traffic to the store;
a members' area, a subscription portal or a regional store on another domain.

You don't need it for subdomains of the same domain, and you can't use it for domains you don't control, like PayPal or a bank's 3D Secure page. Those are handled differently, as the diagram below shows. The steps of a typical funnel are in our guide to building a funnel, and the payment side of each step in checkout flow.

Fig. 2Which setting each domain needs

Your funnel crosses to…Pick the case for each domain in the journey

A subdomain of your sitecheckout.yourstore.com: cookies already shared, nothing to do by default
Another domain you controlcheckout-tool.com: same G- tag, add both domains to the cross-domain list
A domain you don't controlPayPal, 3D Secure page, hosted payment page: add it to unwanted referrals

Three cases, three fixes

Sources: Google for Developers, Configure and customize cookies; Google Analytics Help, Set up cross-domain measurement and Identify unwanted referrals.

How GA4 cross-domain measurement works

When a visitor has consented, the Google tag stores a user ID and a session ID in first-party cookies. With cross-domain measurement on, the tag adds those IDs to links and forms that point to your other listed domains, in a URL parameter called _gl. The tag on the destination reads _gl and writes the same IDs into its own cookies.1

Three details from Google's documentation matter for a checkout:

Two-minute life. The linker parameter expires two minutes after it's created, so it's only added at the moment of the click.3 A checkout link copied and opened later starts a new session, which is what you want.
Clicks and forms only. The linker listens for clicks on the page. Navigation triggered by JavaScript, like a "Buy now" button that runs window.location after an API call, isn't decorated.1 Forms that post to another domain need form decoration.3
One tag ID. Every page on every domain must use the same G- ID from the same web data stream. A checkout tool that loads its own GA4 property on its pages breaks the chain.1

Checkout link after the clickWhat the URL looks like when the linker worked

Destination: https://checkout-tool.com/c/summer-bundle
Linker: ?_gl=1*abcde5*_ga*…*_ga_XXXXXXX*…
Your UTM tags: Not needed on internal links: the session keeps its original source
Created: At the click, valid for two minutes

Illustrative record. The _gl value is shortened.

Never put UTM tags on links between your own domains

UTM tags tell analytics which campaign a visit came from. On the link from your store to your checkout, they declare your own store as the campaign and replace the ad that brought the shopper, which is the exact problem you're trying to fix.

How to set up cross-domain tracking in GA4

The domain list lives in the Google tag settings, and Google recommends this route over configuring the linker in code.3 5

Tag every domain with the same G- ID. Store, landing pages, checkout, upsell and thank-you pages, all from one web data stream.
Open the domain list. Admin, then Data collection and modification, Data streams, your web stream, Configure tag settings, Configure your domains.
Add each domain. Accept the ones Google detected under Recommendations, or click Add condition, pick a match type and enter the domain, for example checkout-tool.com. Include your store's own domain.
Save. The setting applies to links and forms from then on. Past data isn't rewritten.
List payment providers separately. Configure tag settings, Show all, List unwanted referrals (next section).

Source: Google Analytics Help, Set up cross-domain measurement. You need the Editor role or above.

The same domain list also serves Google Ads and Campaign Manager 360 through the Google tag, and links to those domains stop counting as outbound clicks in enhanced measurement.5 1

With Google Tag Manager

If GA4 runs through a Google tag in Tag Manager, the tag reads the domain list you set in GA4: there's no linker to configure inside the container. Two cases still need a look in GTM:

Setup	Where cross-domain is configured	Watch out for
GA4 via the Google tag in GTM	GA4 Admin, Configure your domains	The same G- ID on both domains, the same container or one container per domain with the same tag
Google Ads via the Conversion Linker tag	GTM, Conversion Linker, "Enable linking across domains", Auto Link Domains	"Decorate Forms" only works with URL Position set to Query Parameter
gtag.js in code	`gtag('set', 'linker', {'domains': […]})`	Add `accept_incoming` on the destination when needed; keep it in sync with the Admin list

Sources: Tag Manager Help, conversion linker tag; Google for Developers, cross-domain measurement.6 3

When the linker can't work: pass the IDs yourself

If the checkout is reached through a JavaScript redirect or a server-side redirect you can't change, Google documents a manual method: read client_id and session_id with the gtag get command on the first domain, add them to the destination URL, and set them in the config command on the second domain.1 It's more work, and it's the reliable fix for funnels where the "Buy" button never produces a real link.

Payment providers, PayPal and 3D Secure: the referral trap

The second break comes on the way back. PayPal checkout, a hosted payment page or a 3D Secure challenge page that redirects send the shopper to a domain you don't control, then back to your thank-you page. Your own cookie is still there, so GA4 still knows the visitor. What changes is the referrer: the return looks like a visit coming from paypal.com, and the purchase can be credited to it. Google names this case directly: users who come back to your site after checking out on a third-party domain.2

Fig. 3Where the return visit goes wrong

Your checkoutShopper picks PayPal
redirectpaypal.comApproves the payment
returnsThank-you pageReferrer: paypal.com, new source
once listedUnwanted referralignore_referrer=true, ad keeps the credit

The referrer is the problem, not the ID

Illustrative example. Fix from Google Analytics Help, Identify unwanted referrals.

The fix is the unwanted referrals list: Admin, Data streams, your web stream, Configure tag settings, Show all, List unwanted referrals. Add the domains that send buyers back. GA4 then marks matching events with ignore_referrer=true and doesn't show that referrer as a traffic source. A stream holds up to 50 unwanted referrals.2

Find the domains in your own data rather than guessing: in the Traffic acquisition report, look at session sources over the last 30 days for payment providers, banks' authentication pages, your checkout tool and your own domains. Each one is either a missing cross-domain entry or a missing unwanted referral. The payment authentication guide explains when a 3D Secure challenge appears in the first place, and hosted payment gateways compares redirect and embedded payment pages.

Practical rule

Cross-domain list: domains where you can install your tag. Unwanted referrals: domains you can't. Adding your own checkout domain only to unwanted referrals hides the symptom: the visitor still gets a new ID, and the order loses the ad source.

Meta Pixel and other ad pixels across domains

The Meta Pixel doesn't use _gl. It stores two first-party cookies on the website domain:8

_fbp: the browser
A browser ID the Pixel saves for the website domain. A second domain gets its own _fbp value.
_fbc: the ad click
Built from the fbclid parameter Meta adds to ad URLs. The Pixel stores it once fbclid is in the URL. On a domain where fbclid never appears, there's no _fbc.
event_id: the purchase
The ID that lets Meta count a Pixel event and a Conversions API event once, when the event name also matches, within 48 hours.

Meta's documentation describes both cookies per domain and doesn't give a way to share them across domains. So for a store and a checkout on different domains, the work is:

Run the same Pixel ID on both domains, including the thank-you page.
Carry the click ID. If the landing URL has fbclid, pass it to the checkout URL, or set it yourself on the checkout domain in the format Meta specifies (fb.subdomainIndex.creationTime.fbclid, with a 90-day cookie if you write it server-side). The value is case-sensitive.8
Send the purchase server-side too. Meta recommends sending fbc and fbp with every Conversions API event when you have them, and pairing the Conversions API with the Pixel.8 9
Share one event ID. The Pixel's eventID and the server's event_id must match, and so must the event names, for Meta to deduplicate them.9

Other ad platforms follow the same pattern: a click ID in the landing URL and a first-party cookie on the domain. Check each platform's own documentation for the parameter names. How browser pixels work is covered in what is pixel tracking, and sending events from your server in server-side tracking for ecommerce.

How to test cross-domain tracking

Test it like a payment: one real path, end to end, after every change to the checkout.

Fig. 4A 10-minute test

Start in Tag Assistanttagassistant.google.com, open your store with a test UTM
Click to checkoutDestination URL must contain _gl=
Pay, incl. PayPalUse a test order or a low-value product
Check DebugViewAdmin, DebugView: one device, every event
Check sourcesDays later: no own domains or payment providers

One path, ad click to thank-you page

Sources: Google Analytics Help, Set up cross-domain measurement and Monitor events in DebugView.

The _gl check. Click the link or submit the form, and look at the destination URL: it should contain _gl=. If it's missing, check that the domain you link to matches the list, then look for redirects and scripts that stop the click.1
DebugView. Turn on debug mode with Tag Assistant, or debug_mode in the Google tag. DebugView, under Admin, then Data display, shows the last 30 minutes of events for each debug device.7 The events from the store and from the checkout should sit under the same device.
Meta. In Events Manager, check that the Purchase event arrives from both the browser and the server, with the same event ID on both.
Reports. After a few days, filter session source for your own domains and payment providers. Anything left there is a gap.

Common cross-domain tracking failures

What you see	Likely cause	Fix
Your store's domain as referral on checkout sessions	Checkout domain missing from the list, or a different G- ID there	Same tag ID everywhere, add both domains to Configure your domains
`_gl` appended, but not in the final URL	A redirect drops query parameters	Make the redirect keep `_gl`, or link straight to the final URL1
No`_gl` at all on the checkout	JavaScript navigation, or a script calling `stopPropagation()` on clicks	Use a real link, or pass `client_id` and `session_id` manually1
paypal.com or a bank page as purchase source	Return from a provider you don't control	Add it to unwanted referrals2
Self-referrals between subdomains	Subdomains set cookies on different cookie domains	Keep the default cookie domain, or list them4 1
Checkout tool reports its own conversions in another property	The tool loads its own GA4 tag	Use your G- ID in the tool, remove the duplicate tag
Meta purchases credited to the wrong campaign or not at all	NoFbclid on the checkout domain, no server event	Carry fbclid, send CAPI with fbc, fbp and event_id8
Data still split after the fix	Older data isn't reprocessed	Compare from the change date onward

Verdict

Most broken setups come from two places: a checkout domain that isn't in the list, and a "Buy" button that redirects with JavaScript. Check those two before anything else.

Subdomains vs separate domains

By default, the Google tag sets its cookies on the highest-level domain it can. Cookies set on blog.example.com live on example.com, and activity is measured across subdomains without extra configuration.4 That's why moving a checkout to checkout.yourstore.com is often the simplest fix: one cookie, no linker.

Google still recommends adding subdomains to the setup in one case: when they use a different cookie domain, self-referrals can appear between them.1 If someone set cookie_domain by hand on one subdomain, that's where to look.

Note that a branded subdomain only helps if the tool lets you serve the checkout on it. Ask your checkout provider which domain the pages, the upsells and the thank-you page actually run on.

Cross-domain tracking passes identifiers, so it follows your consent setup:

GA4 only sets its user and session IDs in cookies when there is consent.1 Without consent, there is nothing to pass in _gl.
With consent mode, url_passthrough can pass ad-click and session information through URLs between pages when storage is denied, without cookies.10
Most consent tools store the visitor's choice per domain. If your checkout runs on another domain, it needs a banner too, configured the same way, or the choice made on your store won't carry over.
In Europe, consent rules apply to reading and storing identifiers on the device. Have your consent setup reviewed before you pass identifiers in URLs or move them between domains.

The cookie side of ad measurement is covered in more depth in conversion tracking tools and attribution modeling.

Where Tagada fits

How Tagada helps

Checkout and server-side tracking in one place

Tagada runs the checkout with one-click upsells, order bumps, A/B tests, Apple Pay and Google Pay, and sends server-side tracking events to Meta, Google and TikTok. Server events don't depend on a browser cookie surviving the jump between domains, which is where cross-domain setups usually break. Whatever checkout you use, the checks in this guide still apply to the browser tags. Pricing is on the pricing page.

Start free

Whatever tools run your funnel, keep a one-line map of every domain in the journey and its setting: cross-domain list, unwanted referral, or nothing. Recheck it each time you add a landing page, a payment method or a checkout tool.

Updated on October 14, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

What is cross-domain tracking?

It's the setup that lets an analytics tool recognize the same visitor on two domains you own, for example a store on one domain and a checkout on another. Without it, each domain sets its own cookie, the visitor gets a new ID at the border, and the sale is credited to your own store as a referral instead of to the ad that brought them.

Do I need cross-domain tracking for subdomains?

Usually not in GA4. By default, the Google tag sets its cookies on the highest-level domain possible, so shop.example.com and checkout.example.com share them and are measured together without extra setup. Google still recommends listing them if your subdomains use different cookie domains, which is when self-referrals between subdomains appear.

Should I add PayPal or Stripe to the unwanted referrals list?

Add the domains that actually send shoppers back to your site: PayPal for a PayPal checkout, a hosted payment page, a 3D Secure page that redirects. GA4 then stops showing them as the traffic source of the return visit. Don't add them to the cross-domain list: you can't put your tag on their pages, and the linker is only for domains you control.

What is the _gl parameter in my URLs?

It's the Google tag's linker parameter. When a visitor clicks a link to a domain in your cross-domain list, the tag appends _gl with the visitor's client and session IDs, and the tag on the destination reads it and keeps the same IDs. It expires two minutes after the click, so it can't be bookmarked or shared to merge two people.

Does cross-domain tracking work with the Meta Pixel?

Not the GA4 way. The Pixel's _fbp and _fbc cookies are first-party cookies tied to each website domain. To keep an ad click attributed across domains, carry the fbclid value to the checkout domain, run the Pixel there too, and send the purchase through the Conversions API with the fbc and fbp values and the same event ID as the browser event.

Why does my own domain show up as a referral in GA4?

Because the visitor crossed from one of your domains to another and the second one didn't recognize them: the domain is missing from the cross-domain list, the tag uses a different G- ID there, a redirect dropped _gl, or the click was a JavaScript redirect the linker couldn't decorate. Fix the cause first; the unwanted referrals list only hides the label.

Sources

Checked October 14, 2026

Tagada

Checkout on another domain? Keep every order attributed

Funnels, one-click upsells, subscription billing and payment routing, on one customer record.

Start free See pricing

01Create your free account
02Connect your store or build a checkout
03Launch funnels, upsells and subscriptions