Website Traffic USA: Why Analytics Shows Less Than Arrived

Google Analytics 4 records a US visit only when four things happen in order: the page loads, your tag loads, the visitor's consent state lets the tag send a normal hit, and GA4 doesn't throw the visit out as a known bot. Only then does it file the visit under a country worked out from the IP address. A real US visit can drop out at every one of those steps, so if your USA website traffic looks smaller in GA4 than you expected, start with these rows.

For visits that start on a Google results page, Google Search Console gives you a second ledger none of these rows touch. It counts a click when someone leaves the results page for your site (how Search Console defines a click), which happens before your page, your banner or your tag has loaded.

There are no percentages in that table, and that's deliberate. The share each row takes depends on your audience, your consent tool and your tags, so an industry average would only be a guess about your site. The worked example below measures yours instead. Start with the three rows your own configuration decides (the default, the banner rules and the privacy signal), because they're the part of the US undercount you can actually change.

Consent rules are regional, and so are the controls that apply them. Google's tag lets you give each region its own default consent state, and Google's setup guide is plain about how to use that: "It is best practice to scope the default consent settings to the regions where you are surfacing consent banners to your visitors." The sentence after it is the one that matters for US traffic: "You also prevent any loss of measurement where there are no consent banners or consent banners don't apply" (Set up consent mode on websites).

Read the other way round, that's the problem. A consent setup built for visitors in one region and switched on for everyone treats a visitor in Ohio exactly like a visitor in Madrid. Whatever it costs you in measurement there, it now costs you in the US too.

Whether US visitors, or visitors in particular states, should see an opt-in banner is a legal question, and the answer can change with the state and with what your tags do. We sell traffic, not legal advice, so take that one to counsel. What isn't a legal question is whether your tags actually follow the answer you chose. You can check that in an afternoon, and the next three sections show where to look.

Before a visitor answers anything, Google's tag applies a consent default. Google's guide spells out how regions work: "A gtag consent default command without a region parameter sets the default for all visitors not covered by another region-specific command." So this, on its own, covers every visitor you get:

// No region list: every visitor starts with analytics storage denied, US included
gtag('consent', 'default', {
  'analytics_storage': 'denied'
});

Now suppose your banner only appears in some countries. A US visitor starts denied and never sees anything that could change it. In advanced consent mode the tag still sends that visitor's hits, just without cookies, and GA4 handles them like a visitor who declined (more on that in the next section). Nobody decided to stop counting US visitors. A missing region list did.

Google's own example of a scoped default happens to name a US state:

// Google's example: denied for Spain and Alaska, then a separate rule for all users
gtag('consent', 'default', {
  'analytics_storage': 'denied',
  'region': ['ES', 'US-AK']
});
gtag('consent', 'default', {
  'ad_storage': 'denied'
});

Region values follow ISO 3166-2, so a rule can cover the whole country (US) or a single state (US-CA). When rules overlap, the more specific region wins. Google's illustration sets ad_storage to granted for US and denied for US-CA, and says "a visitor from California will have the more specific US-CA setting take effect." That's how one site can treat California differently from Texas without treating the whole country like its strictest state. Which regions go in the list, and whether any US state belongs there, is your counsel's call. The code only makes sure your tags follow the answer.

How to check yours. Search your page source, or your tag manager's consent settings, for gtag('consent', 'default'. If the command that sets analytics_storage to 'denied' has no region list, and your banner doesn't show for US visitors, you've found an undercount nobody chose. If a consent tool's template sets the default for you, the same choice sits in the tool's region rules rather than in your code. Reading the configuration beats testing from a US address, because it shows you the rule for every region at once.

If your banner does ask US visitors first, what happens to the ones who say no, or never answer, depends on which of Google's two consent modes you run (Consent mode overview).

• Basic consent mode holds the tags back. In Google's words, with basic mode "you prevent Google tags from loading until a user interacts with a consent banner", and when the user doesn't consent, "no data is transferred to Google at all".
• Advanced consent mode loads the tags as soon as the page opens and, while consent is denied, sends measurements without cookies. Those hits carry no persistent identifier, so GA4 can't tell whether ten of them came from one visitor or from ten (Behavioral modeling for consent mode).

Here's what that means for each kind of US visitor:

Don't count on modeling to close the gap. Google says outright that with a consent banner "Analytics will be missing data for users who decline consent," and that modeling only steps in with enough data on both sides of the banner: "if there isn't enough consented traffic to inform the model, then events triggered by users who decline consent aren't reported." The eligibility thresholds, and how the same banner quietly filters browser bots, are in our breakdown of the bot traffic GA4 filters out.

If your counsel wants US visitors asked first, keep the banner. The undercount is then the price of a decision you made on purpose, which is fine as long as you know the size of it. The worked example below gives you that number.

Global Privacy Control (GPC) is a browser or extension setting that, in the GPC project's words, is "intended to communicate a Do Not Sell or Share request under the California Consumer Privacy Act, and similar state privacy laws" (globalprivacycontrol.org). In California it carries legal weight. The Attorney General's CCPA page says consumers can ask businesses to stop selling or sharing their personal information "including via a user-enabled global privacy control," and that businesses "cannot sell or share your personal information after they receive your opt-out request" (California Consumer Privacy Act).

Some US visitors send it without touching a setting. The GPC project lists "Brave and DuckDuckGo (on by default) and Firefox (available in settings)" among the browsers that support it natively.

The measurement question is what your consent tool does when the signal arrives. The signal is framed around selling data and "the use of their data for cross-context targeted advertising." A tool that maps it to "reject all" switches off analytics storage as well, and every GPC visitor then behaves like a decliner in the table above. Whether first-party analytics has to stop for a GPC visitor is a question for counsel. Whether your tool stops it is a question you can answer yourself, and if nobody on your team chose that mapping, it's worth finding out who did.

How to test it. Open a fresh Firefox profile with no extensions and switch the GPC setting on. Load your page, open developer tools, go to the Network panel, filter for collect and reload. Google's documentation says the gcs parameter on that request transmits the ad_storage and analytics_storage choices, so note its value. Switch GPC off and reload again. If the value changes, or the request only fires with GPC off, your consent tool is reading the signal as a refusal of analytics.

Three caveats. Google says these fields "may be subject to change", which is why comparing on against off beats decoding the value. If no request fires either way, something else is stopping the tag, so fix that first. And if you're outside the US, your consent tool applies your own region's rules to the test, so read its US configuration instead.

A visitor can also send GPC and block your tag outright, in which case your consent tool never gets a say. That's the next section.

Some US visitors stop your tag before consent comes into it. Blockers and privacy browsers stop scripts they classify as trackers, and your analytics tag qualifies: EasyPrivacy, a tracker filter list published at easylist.to, carried rules matching googletagmanager.com and google-analytics.com in its September 10, 2026 version. Brave's own page says "By default, Brave Shields are on for every site you visit," and lists blocking third-party trackers among what Shields do (Brave Shields).

There's no fix here that respects the visitor, so don't look for one. A blocked visit still asked your server for the page, which makes your server log the place to count it.

Capture rate is the share of the US page loads your server delivered that GA4 recorded as page views. It's one number, you can work it out for your own site in an afternoon, and it tells you how much of your US traffic your reports can actually see. Every figure below is an example for illustration, not SparkCliks data and not a study result.

Step 1: fix the window and write down your setup. Take seven full days that ended a couple of days ago, so the latest GA4 data has settled. Note your consent mode, whether the banner shows in the US, how your consent tool treats GPC, and whether CDN bot protection is on. Your log's clock and your GA4 property's time zone may differ, and a whole week keeps the edges from mattering much.

Step 2: count US page loads in your server or CDN log. Keep successful GET requests for HTML pages only: no images, scripts, stylesheets or feeds. Keep US visitors, using the country field if your CDN logs one or a geolocation lookup on the addresses if it doesn't. Remove user agents that declare themselves bots, spiders or crawlers. If a CDN serves cached pages, count at the CDN, because your origin server never sees those requests.

Step 3: count GA4 US views for the same days. Open the Pages and screens report (Reports, then Engagement), add a filter for Country exactly matches United States, and read the Views total.

Step 4: take the consent share from your consent tool. You want the share of US visitors who allowed analytics. If the tool reports choices by country, use the US figure. If it only reports a global rate, use that and treat the result as rough. If no banner shows in the US and your default is scoped, the share is 100%.

Step 5: do the arithmetic.

Reading it. In this example GA4 sees about half of the site's US page loads. The banner accounts for 5,208 of the 6,250 missing views, so it's by far the bigger lever, and unlike a blocker it's one you set. Now suppose counsel concludes US visitors don't need an opt-in, and the banner is scoped away from the US. If the after-banner loss holds at the same rate (1,042 of 7,192, about 14.5%), the same week would show about 10,600 GA4 views: 12,400 × 0.855. Same visitors, roughly 72% more of them visible.

Know the method's limits. Logs overcount a little: bots that don't announce themselves, prefetches, reloads. A consent share is a share of visitors, not page loads, and people who decline may view fewer pages. So treat the capture rate as a baseline rather than an audit. Its real use is as a trend: a capture rate that drops in the week a new banner or tag release shipped is a measurement change, not a traffic drop. The same reasoning applied to Search Console clicks against sessions is in our piece on click signal measurement limits.

Step 6, for search traffic: a ledger your banner can't touch. In Search Console, open Performance, then Search results, set the same seven days, open the Countries tab and click United States to filter the report to it. Set its clicks beside GA4's Organic Search sessions from the US for the same days. They never match exactly, but if the gap widens in the week your consent setup changed while clicks hold steady, the cause is measurement, not rankings.

Two things not to do. Don't route your tags around blockers or consent to push the number up: beyond overriding a choice the visitor made, it breaks the comparison between this month and last. And don't read a recovered count as growth. Fixing the count changes your reports, not your traffic.

Paid US visits go through the same gates as organic ones, and some of the gates close harder on them. The products themselves are covered in what arrives when you buy USA traffic. Here's how the gaps above change what you'll see.

Human search clicks. SERP Clicks come from paid people who search your keyword and click your listing. They meet your banner like any other visitor, and one who declines it or runs a blocker drops out of your GA4 numbers the same way. Search Console records the click on the results page first, which makes it the better delivery ledger for search clicks.

Automated visits. A Website Traffic visit loads your pages and waits: it doesn't scroll or click. A Realistic Traffic visit scrolls, moves the pointer and clicks a link, internal or external. Neither is built to answer a consent banner. So if your banner holds the tag back until a visitor responds, GA4 alone is the wrong place to judge an automated campaign: count the campaign URLs in your server log beside it. Our delivery policy asks you to check after 24 hours and send any mismatch to support@sparkcliks.com, which is the right move when the log shows visits GA4 doesn't.

The same policy carries two conditions that bite on US campaigns. Website Traffic and Realistic Traffic are delivered from data center IP addresses only, and for sites running Cloudflare's proxy with bot detection switched on, "we do not support bypassing these features." Bot protection that blocks data center traffic stops those visits before your page loads, and no GA4 setting brings them back. The policy also warns that "sometimes Google Analytics might show different countries in the report," which is the filed-elsewhere row from the top of this page.

One more honest line. If your counsel wants an opt-in banner for US visitors, keep it, and accept that an automated campaign may not register in GA4 on those pages. A campaign you can't measure is money you can't judge, so test before you buy. The free NANO tier of Website Traffic needs no card and shows whether automated visits get past your setup at all. It can't test your US rules, though: country targeting is a paid feature, so free visits aren't sent from a country you pick, and your consent tool applies whichever region's rules match each visit's address. To read a gap between what was sent and what GA4 shows, what a US traffic guarantee can and cannot promise sets out the three shapes a mismatch takes, and how to spot bought traffic in analytics covers the remaining forensic checks.