How to Set Up Cross-Domain Tracking in GA4 Using Google Tag Manager (Full Guide)

In Universal Analytics (UA), setting up cross-domain tracking required complex custom JavaScript listeners, manual auto-linker plugins, and frustrating regex rules inside Google Tag Manager. In Google Analytics 4 (GA4), the technical framework has completely shifted: domain linking is managed at the tag configuration level, relying on a unified _gl query parameter to pass client and session identifiers across browser boundaries.

1. What Is Cross-Domain Tracking (And When Do You Actually Need It)?

Web browsers enforce a strict security policy known as the Same-Origin Policy. This policy prevents cookies created on domain-a.com (such as GA4's first-party _ga and _ga_CONTAINER_ID cookies) from being accessed by scripts running on domain-b.com.

Without an intentional technical bridge, the second domain cannot read the visitor's existing Client ID (device identifier) or Session ID. It generates brand-new cookies, resetting the visitor journey, splitting user engagement metrics, and destroying multi-touch attribution.

2. Subdomains vs. Cross-Domains: Do Not Make This Common Mistake

Before writing configuration rules, you must distinguish between a subdomain and a separate domain. Thousands of marketers misconfigure GA4 because they confuse the two:

3. How Cross-Domain Tracking Works Under the Hood (The '_gl' Linker)

Since cookies cannot cross domain borders directly, GA4 solves the problem via URL query parameter appending.

When a user on domain-a.com clicks a hyperlink leading to domain-b.com, GA4's measurement script listens for the click, intercepts the destination URL, and dynamically appends the _gl linker parameter:

https://www.domain-b.com/checkout/?_gl=1*1s2a3bc*_ga*MTE4OTYyNzM4OS4xNzEwODk3Mjgx*_ga_W1XYZ8910*MTcxMDg5NzI4MS4xLjEuMTcxMDg5NzI5Mi4wLjAuMA..

Deconstructing the _gl String:

• 1*1s2a3bc*: A cryptographic hash and timestamp used to verify that the parameter was generated legitimately and within an active, unexpired browsing window (typically valid for 2 minutes).
• _ga*MTE4OTYyNzM4OS...: The encoded primary Client ID (identifying the unique browser instance).
• _ga_CONTAINER_ID*MTcxMDg5...: The encoded Session ID, session timestamp, and session counter.

When the landing page on domain-b.com executes the Google Tag, it reads the _gl parameter from the URL bar, unpacks the encoded Client ID and Session ID, and writes them into its own first-party cookies. The session continues uninterrupted.

4. Step-by-Step Implementation: Configuring GA4 & GTM

To implement cross-domain tracking properly, both domains must share the exact same GA4 Measurement ID (e.g., G-XXXXXXXXXX) and deploy the Google Tag through Google Tag Manager.

5. Advanced Edge Cases: Forms, iFrames, and JavaScript Redirects

Automatic linker decorators work flawlessly on standard HTML text links. However, custom web architectures often require special handling:

A. Form Submissions (POST Requests Across Domains)

If your site transitions users between domains using an HTML form (e.g., a search widget or booking wizard submitting data via POST or GET), standard link click listeners will not append the _gl parameter automatically.

Ensure your form tag allows parameter passing, or use GTM to decorate the action target attribute before submission using the official Google Tag linker API:

// Retrieve active linker string and append to custom redirect
if (typeof google_tag_manager !== 'undefined') {
  var destinationUrl = "https://www.domain-b.com/checkout/";
  
  // Use GA4 gtag linker API to decorate URL
  gtag('get', 'G-XXXXXXXXXX', 'client_id', function(clientId) {
    gtag('get', 'G-XXXXXXXXXX', 'session_id', function(sessionId) {
      // Build dynamic redirect with clean parameters
      window.location.href = destinationUrl;
    });
  });
}

B. Embedded iFrames Across Domains

If domain-b.com is embedded as an <iframe> inside domain-a.com, the iframe source URL must have the _gl parameter appended upon creation. Furthermore, Safari's ITP blocks third-party iframe cookies by default. For seamless tracking, route parent-to-iframe communication using window.postMessage() to pass the parent's Client ID to the child container.

6. How to Test & Verify Cross-Domain Tracking

Never assume cross-domain tracking is functional without rigorous staging verification:

1. Inspect the Address Bar: Open an incognito browser window. Navigate to domain-a.com and click a link to domain-b.com. Verify that the URL bar on domain B immediately shows the ?_gl=1*... query string.
2. Verify Cookie Persistence: Open Chrome Developer Tools > Application > Cookies. Compare the _ga cookie value on domain A with domain B. The numerical client ID (e.g., 1189627389.1710897281) must match identically.
3. Check GA4 DebugView: In GA4 Admin > DebugView, navigate across both domains. The session must register under a single timeline with a continuous ga_session_id and zero new session_start events triggered upon the transition.

7. 7-Point Technical Cross-Domain Audit Checklist

Before signing off on your deployment, audit your setup against these enterprise standards:

• ✔
  Single Measurement ID Verified: Confirm that both domains load the exact same GA4 Measurement ID (G-XXXXXXXXXX).
• ✔
  Domain List Configured in GA4: Ensure all connected domains are listed inside Configure tag settings > Configure your domains.
• ✔
  Unwanted Referrals Active: Verify that participating domains are added to the List unwanted referrals table to eliminate self-referrals.
• ✔
  Server Redirect Parameter Preservation: Test server-side 301/302 redirects on the destination domain. Ensure your Nginx, Apache, or Cloudflare rules do not strip out the _gl parameter upon redirect.
• ✔
  Consent State Synchronization: Ensure your Consent Management Platform (CMP) does not block the Google Tag on the destination domain before the _gl parameter can be parsed.
• ✔
  Form Submission Pass-Through: If moving between domains via forms, verify that the action attribute receives the linker parameters.
• ✔
  Clean Session Continuity in DebugView: Confirm that the transition does not generate a secondary session_start or first_visit event in GA4 DebugView.