Why Your Link Clicks Don't Match GA4 Sessions

Three tools, three numbers, and only one is filtered

Send a campaign on Tuesday. The ESP reports 512 clicks. The link tool reports 400. GA4 reports 120 sessions. Same campaign, same day, three numbers that refuse to reconcile, and the usual response is to quietly pick the biggest one for the client deck and hope nobody asks.

The part that gets missed is that these aren't three measurements of one thing at three levels of accuracy. They're counts taken at three different points in the chain, and one of them is deleting data before you ever see it.

Machines clicked your links before any human did

Corporate mail security follows every link in every email before it reaches an inbox. Microsoft Defender for Office 365 does it through Safe Links. Proofpoint and Mimecast do the same thing. The scan opens the URL, checks where it lands, and decides whether the message is safe to deliver.

That visit is a real HTTP request. Your redirect fires. Your click counter increments. Nobody has read the email.

M3AAWG (the anti-abuse working group the big mailbox providers and ESPs all sit in) studied click data from large and small ESPs and found consumer lists "generally experienced less than 10% impact." Business lists were far worse, at "between 20-80%."

Now read the qualifier that every blog quoting that range drops. M3AAWG says the B2B data was "collected but not published," and the document is from November 2020. So the honest version is "B2B is much worse, and nobody has measured it precisely in years." Not a number to put on a slide.

Your ESP already hides this. Your link tool doesn't.

Here's the actual reason two of your numbers disagree, and I rarely see anyone say it plainly.

Mailchimp filters bot activity by default, and its help page is blunt about the consequence: "Your open and click metrics will drop significantly when you turn bot filtering on. This is expected and indicates that you're viewing more accurate data with bot filtering on." Klaviyo does it too. Their wording: "By default for all new accounts email and text message bot clicks are excluded from attribution and reporting."

Your ESP hands you a pre-filtered number.

A shortener or redirect engine, ours included, counts redirects. A redirect is a redirect whether a person or a scanning appliance asked for it, so unless the tool runs its own filtering, that count contains every machine that touched the link. Two tools, two philosophies, and the gap between them is mostly Proofpoint.

Separating scanner noise from real loss

You don't have to guess which part of the gap is bots. Two signals pull them apart.

Time since send. Scanner traffic arrives in a tight cluster in the first minutes after delivery, often sooner than a human could plausibly have opened the thing. Sort the click log by timestamp. If a third of the day's clicks landed inside the first four minutes, those are machines.

Click-to-session ratio. Scanners request the URL. They rarely run JavaScript on the landing page. A click with no matching session is therefore a candidate, and a batch of them arriving in the same second is close to a confirmation. (Same trick we suggest for newsletter sponsor reporting, where scanners surface as inflated engagement.)

Whatever survives both tests is genuine loss, and its causes are boring: the page never finished loading, the reader bailed during a redirect, a consent banner or ad blocker stopped the tag from firing before it could register anything. That half of the arithmetic we've already covered in why Meta and GA4 never agree, where 10-30% of paid clicks failing to become sessions is just the weather.

The opposite failure exists too, which is worth holding in your head at the same time. Ghost sessions from Measurement Protocol spam inflate GA4 while your click count stays honest. Same word, "bots," shoving the two numbers in opposite directions.

Which number answers which question

I'll rule on this, because everything else written on the topic explains the discrepancy and then declines to decide.

Clicks answer "did the message work." Subject line, creative, send time, offer. Use the ESP's filtered number, since it's the closest thing to a human count you get for free.

Sessions answer "was any of it worth anything." Engagement and revenue. Use GA4 and accept that it undercounts.

Raw redirect counts answer neither on their own. They're the audit trail. Useful for proving a link fired at all, and for catching the 04:31 cluster that tells you a security appliance is doing its rounds.

The error I see most often in monthly reports is reach taken from raw clicks and conversion rate taken from GA4, then one divided by the other. That rate is fiction. Both halves have to come off the same counter or the ratio means nothing at all.

One more finding from that M3AAWG document, because it's genuinely useful and nobody repeats it: emails that mix secure and non-secure links "appear to be disproportionately targeted" by scanning. Serve every tracking link over HTTPS. Cheap fix, real effect.