Google’s goto Tracking URLs: What Happens to Attribution

Google’s google.com/goto tracking URLs are, right now, one of the stranger unconfirmed sightings in search: a small number of SEO practitioners have observed some search-result links routing through a Google-owned passthrough URL before redirecting to the destination site — a pattern first reported by Search Engine Roundtable on July 8, 2026, and acknowledged by no one at Google.

The stakes explain the attention. Organic attribution in GA4 leans on signals that arrive with the click — the referrer, campaign parameters, click IDs. A passthrough hop that rewrites or strips those signals before your page loads could reclassify organic sessions as (direct) / (none), quietly deflating the channel that most SEO teams are judged on. That is a real mechanical risk worth understanding — and it is attached to an observation so thin that the reporter who broke the story says he cannot reproduce it himself.

This playbook does both jobs. It lays out exactly what was observed and by whom, why the evidence deserves heavy hedging, how the passthrough mechanism would interact with GA4’s documented attribution fallbacks if it ever spread, and a concrete audit you can run this week to baseline your data — so that if goto ever moves from curiosity to reality, you will see it in your numbers instead of reading about it later.

The observable facts fit in a paragraph. For roughly the week or so before July 8, 2026, a few SEO practitioners noticed that on some Google search results, clicking a result did not navigate directly to the destination site. Instead, the browser was sent to a URL of the form google.com/goto?url=[encoded destination], which then redirected to the actual page. The pattern was first reported by Search Engine Roundtable on July 8; the sites that covered it afterward cite that article rather than adding independent sightings of their own.

The earliest public sighting predates the report by just over two weeks. On June 23, 2026, Alex Greenland posted on X: “New for Google Search: google•com/goto to fight AI and SEO scrapers... Result link URLs are now being rewritten to google•com/goto?url=[custom base64-like encoding of URL or Google ID]. Upon click, they redirect to their proper destination.” One important caveat travels with that quote: the “fight AI and SEO scrapers” motive is Greenland’s own interpretation, not anything Google has said. Brodie Clark of SERPAlerts independently posted about the same pattern, and separately noted that Ahrefs’ toolset is now picking up and highlighting the URL pattern in its data — the one signal so far that a major commercial platform can see it, not just individual practitioners.

That timeline is the entire public record. Fifteen days separate the first sighting from the only report, and everything published since — including the aggregator summaries that spread the story — resolves back to the same Search Engine Roundtable article. “For the past week or so, I have heard a few folks notice that Google is appending tracking URLs to the search results,” is how Barry Schwartz opened the piece; the framing never gets firmer than that, and neither should yours.

Most coverage chasing this story will lean toward rollout language, because rollouts get clicks. The primary source does the opposite, and the hedges in it are the most load-bearing sentences of the whole story. Schwartz is explicit that this is a small-sample observation he cannot verify with his own eyes — and he is the one person with the strongest incentive to verify it.

Even the secondary coverage reinforces the hedge rather than eroding it. The aggregators that picked the story up characterize the observed sample as only “a handful of individuals” and note the behavior “hasn’t achieved universal confirmation across multiple accounts” — their words, summarizing the same single source. Schwartz himself frames the open question directly: “I wonder if this is just a test or if Google is slowly rolling out this new click URL behavior for the search results? If so, this may affect your tracking and analytics.” He offers no resolution, because none exists.

Our read: the honest interpretation of three observers, one non-reproducing reporter, and zero vendor acknowledgment is a limited experiment — the kind Google runs constantly and abandons quietly. The reason it earns a playbook anyway is asymmetry. If the test dies, the cost of having baselined your attribution data is a couple of hours. If it spreads, the cost of not having baselined it is that your organic reporting degrades and you cannot prove when or why.

Mechanically, the observed pattern is a passthrough, or interstitial, URL. Instead of the search result linking straight to yoursite.com/page, the link target becomes google.com/goto?url=[encoded destination]. The click lands on Google’s own endpoint first, which then redirects the browser to the real page. Per Greenland’s observation, the destination is not even human-readable in the wrapped form — he described it as “a custom base64-like encoding of URL or Google ID.”

Two properties of that design matter for measurement. First, the redirect hop gives Google a server-side observation point for every wrapped click, independent of the JavaScript-based click tracking search results already use. Second — and this is the part that puts attribution in play — the hop sits between the SERP and your site, which means the referrer and any URL-borne signals your analytics reads arrive shaped by whatever the redirect passes through. What it actually passes through is unknown: nobody outside Google has published a header-level analysis of the live behavior, and with so few people able to see it, nobody reliably can yet.

There is also a hint that some version of this behavior is older and narrower than the current sighting. Developer Derek Perkins replied to the discussion on July 3 saying: “We’ve been seeing that for months. It’s similar to before when you had js disabled, they would wrap all the links in server side redirects to get analytics. This is just a new form of that. We just throw away those SERPs and fetch new ones.” If server-side redirect wrapping has long existed for JavaScript-disabled sessions — the kind scraper tooling produces far more often than real users do — then the population most likely to encounter goto early is bots and SERP tools, not typical searchers. That would be consistent with both the anti-scraper speculation and with why almost no humans have seen it.

None of the following requires speculation, because it is how GA4 documents its own behavior. GA4 derives the Session source / medium dimension primarily from three inputs on the landing pageview: the HTTP referrer, campaign parameters such as UTMs, and click IDs like gclid. When none of those are present or recognizable, GA4 falls back to (direct) / (none). Every attribution failure mode in this story reduces to that fallback firing when it should not.

The redirect connection is documented too. Google’s own guidance on direct traffic names redirects as a cause of stripped signals — and a passthrough URL is precisely a redirect inserted between the SERP and your landing page. If the goto hop preserves a clean google.com referrer, GA4 classification likely survives intact. If it drops the referrer, organic clicks land as (direct) / (none). And if it surfaced google.com in a form GA4 maps differently than the standard search referrer, you could see referral-shaped noise instead. Which of the three happens is exactly the unknown that nobody can test at scale yet — which is why the honest posture is monitoring, not remediation. If your source / medium reporting is already messy for ordinary reasons, fixing that first matters more than this test; our guide to fixing fragmented GA4 source / medium attribution covers the standing failure modes.

GA4 does ship a general-purpose lever adjacent to this problem: referral exclusions, branded “unwanted referrals” in the current UI. The feature appends ignore_referrer=true to matching events so a listed domain is not counted as a new referring source. It lives under Admin → Data collection and modification → Data streams → Configure tag settings → List unwanted referrals, and it carries two constraints worth knowing before you ever need it: a maximum of 50 entries per data stream, and no retroactivity — exclusions only reshape traffic collected after the rule is saved. To be clear, this is not a purpose-built fix Google has issued in response to goto; it is an existing tool that could in principle apply if google.com ever started appearing as an unwanted visible referrer, and misusing it preemptively could distort attribution you currently rely on.

Existing coverage stops at “this may affect your tracking.” The table below is our attempt to make that sentence useful: each row pairs one measurement surface with its normal behavior today, what changes if clicks route through google.com/goto, the detection signal that would show it in your data, and the lever you actually have. Every mechanism cell traces to the primary report or to Google’s documented GA4 behavior; every “if goto spreads” cell is conditional by construction, because the test itself remains unconfirmed.

The pattern across the rows is worth naming: every failure mode is a silent one. Nothing errors, nothing alerts, no report goes blank. Organic sessions would simply re-label themselves as direct, rank-tracker URLs would arrive encoded, and reconciliations would drift — each individually explainable by a dozen mundane causes. That is exactly why the detection column matters more than the mitigation column today: with no baseline, a slow referrer degradation is indistinguishable from seasonality.

Nobody has published a detection walkthrough for this — coverage so far reports the sighting and stops. Here is the checklist we would run on any property where organic attribution matters. It costs an hour or two, changes no configuration, and leaves you with the one thing you cannot create retroactively: a dated baseline.

1. Baseline your organic-vs-direct split

In GA4, pull Session source / medium for the last 90 days, segmented weekly. Record the ratio of google / organic to (direct) / (none) sessions, per week, for your top landing pages. This is the number a referrer-stripping passthrough would move — and the movement is only provable against a recorded baseline.

2. Check raw referrer data at the server

If you have access to server logs or edge analytics, search the Referer header for google.com/goto. As of today the expected result is zero hits — which is itself the data point. Schedule the same search monthly. Log-level referrers are the only place you would see the passthrough directly rather than inferring it from GA4 side effects.

3. Set up a GSC-to-GA4 reconciliation ratio

Search Console counts clicks at the SERP; GA4 counts sessions at your site. A passthrough that strips referrers would leave GSC clicks intact while GA4 organic sags — a one-directional divergence. Track the weekly ratio of GSC clicks to GA4 organic sessions; investigate when it moves without a corresponding ranking or indexing change. Search Console itself shipped measurement updates this same week, so keep an eye on Search Console’s own July reporting changes when comparing periods.

4. Ask your rank-tracker vendor the direct question

Per the primary report, Ahrefs’ systems are already picking up the goto URL pattern. Ask whichever tools you rely on whether they have observed it, whether they unwrap the encoded destination, and whether wrapped SERPs are excluded or re-fetched. Perkins’ “we just throw away those SERPs and fetch new ones” comment suggests tool vendors have quietly handled variants of this for a while.

5. Reduce your dependence on the referrer where you can

The durable lesson is bigger than this test: any measurement stack whose organic attribution depends entirely on a clean browser referrer is exposed to every future change of this kind. First-party signals you control — properly parameterized internal campaigns, server-side tracking that doesn’t depend on a clean browser referrer, and consent-durable measurement — degrade more gracefully. If you want a second set of eyes on how exposed your setup is, our analytics and tracking services start with exactly this kind of dependency audit.

Redirect-wrapped search links are not new territory for Google. SEO practitioners who have been around long enough remember organic results passing through Google-owned redirect URLs in earlier eras of the SERP, before click measurement moved toward JavaScript-based approaches — loose industry history rather than a dated citation, but useful context. Combined with the months-of-JS-disabled-wrapping precedent Perkins describes, the most plausible reading of goto is not an anti-marketer move at all: it looks like infrastructure aimed at scrapers and automated SERP consumption, of which analytics side effects would be collateral. That is one early observer’s speculation plus circumstantial precedent — hold it loosely.

Looking forward, the scenarios worth planning for sort cleanly by what your data actually shows. This is where the measured position pays off: each response has a trigger you can observe, so you never act on someone else’s screenshot.

One more forward-looking note. The measurement environment this test lands in is already privacy-constrained — consent gating, modeled conversions, and browsers trimming referrers on their own. A Google-side passthrough would be one more subtraction from an already-shrinking signal, which is why the teams that handle it best will be the ones that treated referrer dependence as debt before it broke. If your stack still leans on defaults there, a Consent Mode v2 implementation for privacy-first measurement is the more urgent project than anything goto-related — and it hardens you against this scenario as a side effect.