Why your CRM is lying to you about lead source
The polite fiction that "Direct Traffic" is — and what to actually do about CRM lead attribution.
Most CRMs over-attribute paid leads to "Direct Traffic" because their tracking cookies forget the original ad source after one or two return visits. The fix isn't more UTMs — it's owning the click-ID capture yourself, outside the CRM's cookie. About three weeks of work, and it works on any CRM (HubSpot, Salesforce, Marketo, Pipedrive). Read on for the why and the how.
I knew the numbers HubSpot was showing me weren't true. Most of our leads, it said, came from "Direct Traffic." Direct Traffic means someone typed the URL into their browser. We weren't running brand campaigns. Nobody was typing the company name into Chrome. They were clicking ads.
HubSpot was just… lying.
Not lying intentionally. Lying because of how it tracks.
Here's what's actually happening, and why your CRM is probably doing the same thing to you.
The thing nobody told you about CRM tracking cookies
Most CRMs — HubSpot, Salesforce, Marketo, Pipedrive — same story. They drop a tracking cookie the moment a visitor arrives via an ad. The cookie remembers the source: "this person came from a Google search ad on the keyword 'compounding pharmacy NJ.'" Great.
The catch: that cookie has a job description.
It records the first touch. And only the first touch.
So here's the path that breaks it:
- Day 1: Person clicks your Google ad. Cookie set. They don't fill the form. They leave.
- Day 4: Person sees your retargeting ad on Instagram. Doesn't click. Just remembers your name.
- Day 7: Person types your URL directly into the browser. Fills the form.
What does your CRM say about this lead?
"Direct Traffic."Because by Day 7, the original cookie either expired, got cleared, or — worse — got overwritten by a new "direct" session. The Google ad that actually brought them in gets zero credit.
This is called the multi-session attribution gap. And it eats about 30-50% of your true ad-driven pipeline, every single quarter.
Why "more UTMs" won't fix it
When I figured this out, my first move was to obsess over UTM tagging. Every single ad got ?utm_source=google&utm_campaign=brand-search&utm_medium=cpc. Tagged everything.
Two weeks later, attribution coverage moved from ~10% to ~18%. Still mostly broken.
Why? Because the tags were perfect. The CRM cookie was the problem. UTMs live in the URL — once a visitor returns via a different path, the URL has no UTMs anymore, and the cookie gets reset.
You can't tag your way out of this. The bottleneck isn't tagging. It's session memory.
What actually fixes CRM lead source attribution
You take ownership of the pipe.
The pattern is the same for any website + CRM + form combination:
- Capture every UTM and ad click ID the moment a visitor lands. Not just in the CRM cookie. In your own cookie or local storage. Persistently — at least 90 days.
- When the form fires, read your stored values back and write them into hidden form fields.
- Pass them to the CRM as custom contact properties —
original_utm_source,gclid(Google),fbclid(Meta),li_fat_id(LinkedIn). - Build your "real source" report off those custom properties — not the CRM's built-in attribution. The built-in report is the thing that was wrong in the first place.
That's it. Not magic. Honest plumbing. About three weeks to ship.
The day-one win isn't the dashboard. It's the conversation with finance. You can finally answer: "Of the budget we spent on LinkedIn last quarter, what came back?" Real number. Not a guess.
Common mistakes to avoid
- Trusting the CRM's attribution UI. It was built around 2010-era assumptions about cookies. The internet has changed.
- Relying on first-touch only. Build a record of every touch — first AND last — so you can compare attribution models when finance asks.
- Storing values in
sessionStorageinstead oflocalStorage. Session storage clears the second the tab closes. Useless for multi-day journeys. - Forgetting iOS Safari. Apple aggressively expires cookies via ITP. Your "30-day" first-touch becomes a 7-day first-touch on Safari. Test on a real iPhone, not just Chrome DevTools.
- Not validating the click IDs at the CRM end. A blank
gclidfield on a paid lead means the capture broke. Build a daily check.
The honest lesson
Most attribution problems aren't measurement problems. They're memory problems. The tools have rules about what they remember and when. Once you understand the rule, you stop fighting it and start engineering around it.
If your CRM's "Direct Traffic" segment is bigger than your "Brand Search" segment, you're being lied to. Not by your CRM. By the limits of how it was designed.
Build the memory yourself.