What Is a GCLID? Google's Click ID and What It Tells You

A GCLID (Google Click Identifier) is a URL parameter Google Ads adds to your landing page address when someone clicks your ad, as in ?gclid=123xyz. It identifies the click's campaign and other attributes, so conversions can be credited to it.

Bots get one too. A bot that clicks your ad arrives with a GCLID, and if it runs your tags, GA4 files the visit as google / cpc under Paid Search. You pay for the click unless Google catches it, and the bot never buys.

This guide covers how the GCLID works, where to find it, how it differs from GBRAID, WBRAID and UTM tags, the click IDs other ad platforms use, what a GCLID does and doesn't prove about a paid click, and how to use GCLIDs when you report invalid clicks to Google. For the wider problem, see what click fraud is and what ad fraud is.

What Is a GCLID?

A GCLID is Google's click ID: a parameter auto-tagging adds to your landing page URL so each ad click can be tied to its campaign and conversions.

GCLID stands for Google Click Identifier. Google defines it as "a URL parameter passed with ad clicks" that "identifies the campaign along with other attributes of the click associated with the ad for ad tracking and campaign attribution" (Google Ads Help).

It comes from a Google Ads setting called auto-tagging, which is on by default for new accounts (Google Ads Help). When someone clicks your ad, Google adds the parameter to the end of your final URL. In Google's own example, a click on an ad for www.example.com lands on www.example.com/?gclid=123xyz. Real values are much longer.

Three things about the value itself are worth knowing:

• It's case sensitive. Google says the GCLID is case sensitive, and that a server which changes its case breaks the link between the click and the session (Analytics Help).
• You can't read it yourself. Google doesn't document what's encoded in it. The campaign, ad group and keyword behind a click come from Google's own records, which is why GA4 needs your Google Ads account linked to show them.
• It isn't the only thing Google adds. Every Google ad URL also carries gad_source, and Google adds gad_campaignid to name the campaign (Google Ads Help). Those describe traffic in aggregate. Only the GCLID points to a single click.

How Does a GCLID Work?

Someone clicks your ad, Google adds a GCLID to the landing page URL, and your Google tags read it so later conversions are credited to that click.

Here is the path of one click:

1. Someone clicks your ad. Google records the click and charges you for it, unless its filters judge it invalid.
2. Google adds the GCLID to your final URL, along with gad_source.
3. Your landing page loads and your tags read it. The Google tag and GA4 pick the GCLID up from the address. If the visitor leaves before the tag runs, the GCLID never reaches Google and the click isn't tied to a session (Analytics Help).
4. Conversions are credited to the click. A purchase or a lead on your site is matched back to the click and its campaign. Google calls the GCLID "required for Google Ads website conversion tracking".
5. GA4 files the session as paid. A visit with a GCLID shows up as google / cpc in the Paid Search channel (Analytics Help). With your Google Ads account linked, GA4 also shows the campaign, ad group and keyword. Traffic from an unlinked account shows "(not set)" in those reports (Analytics Help).

One rule follows from this path, and it matters later in this guide. Google bills the click on its ad, not the page load on your site. Whatever happens to the URL after the click, from a redirect to a bookmark, changes what your analytics sees without changing your invoice.

What Is a GCLID Used For?

It credits website conversions to ad clicks, shares Google Ads data with GA4, links offline sales to clicks and points Google to suspect clicks.

• Website conversion tracking. Google says auto-tagging is needed to "track conversions on your website on all browsers" (Google Ads Help).
• Sharing data between Google Ads and GA4. It brings Google Ads campaign and cost data into GA4 reports and lets you import GA4 key events into Google Ads as conversions.
• Offline conversions. When a sale closes on the phone or in your CRM days later, you store the GCLID with the lead and upload the conversion with it (Google Ads Help). Google won't import a conversion uploaded more than 90 days after the click (Google Ads Help).
• Invalid click investigations. Google's Click Quality Form asks for the GCLIDs of suspicious clicks, which "help Google map the visit back to a specific ad interaction" (Google Ads Help).

The first three are why most marketers set it up. The fourth is why it's worth keeping in your own records: it's the identifier Google asks for when you report clicks you think it billed by mistake.

How Do You Find Your GCLID?

Look at your landing page URL after an ad click, or in your server logs. To keep it for later, save it in a hidden form field and in your CRM.

There are four places a GCLID can live:

• The address bar. When a visitor arrives from your ad, the landing page URL carries gclid= and a long value.
• Your server logs. Web servers usually log each requested URL with its query string, so each ad visit's GCLID sits next to its time, IP address and user agent. That's the record Google asks for in an invalid click investigation.
• GA4's BigQuery export. Standard GA4 reports don't show the GCLID, but the BigQuery export stores it on each event as collected_traffic_source.gclid (Analytics Help).
• Your forms and CRM, if you capture it. Google's offline conversion guide describes the setup: a hidden GCLID field on each form, a script that keeps the value in a cookie or local storage so it survives a visit across several pages, and a CRM field that stores it with the lead (Google Ads Help).

Test That Your Site Keeps It

Google's own test takes a minute. Open your landing page with a test value added, ?gclid=TeSter-123, or &gclid=TeSter-123 if the URL already has a question mark, and check that the parameter is still in the address once the page has fully loaded (Analytics Help).

If it disappears, your site or a redirect is dropping it. The mixed case in the test value also shows whether your server changes upper and lower case, which breaks the match between click and session.

What Is the Difference Between GCLID, GBRAID and WBRAID?

A GCLID points to one click. GBRAID and WBRAID are Google's parameters for iOS traffic, built for Apple's privacy rules where a GCLID can't be used.

Since iOS 14, Google no longer uses the GCLID for iOS users who haven't given consent, and it added two parameters "to help comply with Apple's policies" (Analytics Help):

• GBRAID is present when someone clicks an ad on the web and is sent to your iOS app.
• WBRAID is present when someone clicks an ad in an iOS app and is sent to your website (Google Ads API docs).

Google also recommends GBRAID for web campaigns where "the Google Click ID is at risk of being dropped", and says it "measures conversions in a non-unique fashion (like Campaign ID) without linking them to individual users or events" (Google Ads Help). So a click can arrive with a GCLID, a GBRAID, or both. When both are present, Google recommends sending both with an offline conversion.

That last row has a practical edge for click fraud. Google's investigation process asks for GCLIDs, so a suspicious click that arrived with only a GBRAID or a WBRAID gives Google no single click to look up. Keep every parameter you receive, but expect your evidence to rest on the GCLIDs.

GCLID vs UTM Parameters: Which Should You Use?

Keep auto-tagging on, because GA4 gives the GCLID priority. Add UTM tags as well when other tools need campaign names or for other ad platforms.

UTM parameters (utm_source, utm_medium, utm_campaign and the rest) are tags you write yourself. A GCLID is written by Google and points to Google's own record of the click. Google Ads doesn't add UTM tags for you.

For Google Ads traffic, GA4 settles any conflict between the two: "auto-tagging is prioritized over manual tagging due to the absence of an override option" (Google Ads Help). There's one exception. When the GCLID can't be used and any UTM parameter is on the URL, GA4 takes every traffic source value from the UTM tags alone, and a missing one shows as "(not set)" (Analytics Help). So if you add UTM tags to Google ads, add the full set.

Use both. Auto-tagging handles Google Ads, and full UTM tags cover every other ad platform and any analytics tool that doesn't read the GCLID.

What Are the Click IDs on Other Ad Platforms?

Microsoft adds an MSCLKID and Meta an fbclid. Only the GCLID tells GA4 on its own that a visit was paid; the others need your UTM tags.

Most ad platforms add a click ID of their own. Next to Google, two matter most for US advertisers:

• MSCLKID (Microsoft Advertising). Microsoft describes it as "a 32-character GUID that is unique for each ad click", and auto-tagging of it is on by default for new accounts (Microsoft Advertising API docs).
• fbclid (Meta). Meta passes its click ID with your URL when someone "clicks an ad on Facebook and/or Instagram". It's case sensitive, and Meta recommends keeping it in its _fbc cookie for 90 days (Meta for Developers).

Here is the difference that matters in GA4. Its default channel rules recognize Google Ads traffic, but none of them mentions fbclid or msclkid (Analytics Help). A Meta or Microsoft click counts as paid in GA4 only through its UTM tags. Untagged, the referrer decides: a visit from facebook.com can land in Organic Social, and one with no referrer lands in Direct.

If you run Meta or Microsoft ads without UTM tags, that paid traffic, and any bots in it, can sit in Organic Social or Direct, where nobody looks for ad spend. Our guide to Facebook and Meta ad fraud covers the checks inside Ads Manager.

Does a GCLID Prove a Click Was Paid?

No. It proves the visit came through a Google ad link. Google bills the click, not the page load, so an old GCLID in a bookmark isn't charged again.

A GCLID tells you a visit started from a Google ad link. It doesn't tell you that this visit was a click you paid for. Google counts and bills the click on its ad, and your site and GA4 only see the page load that follows. Google's own help pages show where the two part ways (Analytics Help):

• Invalid clicks. Google filters the clicks it judges invalid out of your bill, but "Analytics reports all sessions". A filtered click that ran your tags is a paid-looking session you didn't pay for.
• Bookmarks. If someone bookmarks your page with the GCLID still in the URL, Analytics records later visits from that bookmark as Google Ads traffic, but "Google Ads doesn't record the clicks and advertisers are not charged for these sessions since they're not actual clicks on the ads."
• Visitors who leave early. A click whose visitor leaves before your tag runs is billed but never becomes a GA4 session.

This is why GA4 paid sessions and Google Ads clicks rarely match exactly. It's also why a claim should count each GCLID once, on its first visit, and leave out the clicks Google already filtered.

What Do Bots Do With Your GCLID?

A bot that clicks your ad gets a GCLID like anyone. If it runs your tags, GA4 files it under Paid Search. It costs you the click and never buys.

A bot that clicks your ad goes through the same link a person does, so it lands with a GCLID. What happens next depends on the bot and on your conversion goal.

• It costs you the click. Google charges for it unless its filters catch it.
• It shows up as paid traffic. If it runs your tags, GA4 files it as google / cpc in Paid Search, not Direct. That makes paid traffic the first place to look for it, and our guide to detecting bot traffic shows how.
• It never buys. Every bot session is a visit without a sale, so your conversion rate falls and your cost per acquisition rises. Illustrative: at $5 a click, 100 bot clicks that Google misses cost you $500 and add nothing to your sales.
• It can fire early-step goals. If a campaign counts page views, add to carts or form fills as conversions, a bot that runs your tags can fire them, and Smart Bidding, which optimizes "for conversions or conversion value", counts them as results (Google Ads Help). Lead generation teams see this as form spam.
• It can join remarketing lists built from page views. How often an ad then reaches it isn't published.

Simple click bots that don't run JavaScript never fire your tags. You still pay for their clicks unless Google catches them, but they never appear in GA4, which widens the gap between Google Ads clicks and GA4 sessions.

Want a directional read on how much of your paid traffic is real? Run the free GA4 check. Read-only, no signup required.

How Do You Use GCLIDs to Report Invalid Clicks to Google?

Send the GCLIDs of suspect clicks with your server logs through Google's Click Quality Form within 60 days. Google maps each back to its ad click.

If you believe Google billed you for invalid clicks its filters missed, you can request an investigation through the Click Quality Form for activity in the last 60 days (Google Ads Help). GCLIDs sit at the center of what Google asks for:

1. Your 10-digit Google Ads customer ID.
2. The dates, campaigns and keywords involved.
3. Web server logs with the IP addresses, devices and platforms behind the suspicious clicks, and "the Google click identifiers associated with the suspicious clicks".
4. For fake leads, a spreadsheet with the GCLID of each lead and your assessment of it.

Google says the GCLIDs "help Google map the visit back to a specific ad interaction". An IP address can be shared by a whole office or a mobile network. A GCLID points to one click Google can find.

Make the GCLIDs Count

• Log the full URL. If your logs drop the query string, the GCLID goes with it.
• Send each GCLID once. A bookmark can bring the same GCLID back, and Google doesn't bill that later visit. Claim the first visit only.
• Leave out what Google already caught. Check the Invalid clicks column first. Google warns that third-party tools may flag traffic it already filtered, and that it "cannot evaluate third-party reports" because it doesn't know their detection criteria.
• Stay inside 60 days. Check every month rather than every quarter.
• Expect no click-by-click answer. Google says an investigation "won't be able to confirm if specific clicks were marked as valid or invalid". It emails you its findings and decides any credit.

Our guide to Google Ads click fraud walks through the whole claim, and what invalid traffic is covers how Google and the industry define it.

Cut the sources that send bot clicks and put that budget into campaigns that really sell. Hyperguard scores every visit while it happens, shows bot share by source and campaign, and keeps a per-click file with each click's GCLID, time, IP address and user agent for a Google claim (Google decides any credit). Run the free GA4 check first, then see how Hyperguard works.

Why Is the GCLID Missing From Your URL?

Usually auto-tagging is off, a redirect dropped it, or your site strips unknown parameters. On iOS, Google may send a GBRAID or WBRAID instead.

Work down this list:

• Auto-tagging is off. Check Admin, Account settings, Auto-tagging. Without it, paid clicks can land in GA4 as organic, direct or "(not set)" (Analytics Help).
• A redirect drops it. A 301, 302 or JavaScript redirect that doesn't pass the query string along loses the GCLID on the way.
• Your server rewrites or rejects parameters. Some sites strip unknown parameters, change their case or serve an error page when they see one. Google's fix is to let the server pass parameters through. If your site can't accept them at all, Google says to turn auto-tagging off (Google Ads Help).
• The visitor is on iOS. Without consent on iOS 14 and later, Google doesn't use the GCLID and may send a GBRAID or WBRAID instead.
• Apple removed it. Apple's Link Tracking Protection removes tracking information from links shared in Messages and Mail, and from links in Safari Private Browsing (Apple). Apple doesn't publish which parameters it removes. Google's own help says the GCLID can be "at risk of being dropped" and offers GBRAID for that case.
• It's an App campaign. Google says App campaigns don't respect auto-tagging.
• The visitor left first. If someone leaves before your tag runs, the GCLID never reaches Google.

What Should You Check First?

Turn auto-tagging on, test landing pages with Google's test GCLID, log full URLs, capture GCLIDs on forms and tag other ad platforms with UTMs.

1. Confirm auto-tagging is on, under Admin, Account settings, Auto-tagging.
2. Open each main landing page with ?gclid=TeSter-123 and check the value survives the page load and any redirect, in the same case.
3. Link Google Ads and GA4, so paid sessions show campaign and keyword instead of "(not set)".
4. Make sure your server or hosting logs keep the full requested URL, GCLID included.
5. Capture the GCLID in a hidden form field and store it with each lead in your CRM, along with the click date.
6. Tag Meta, Microsoft and every other ad platform with a full set of UTM parameters.
7. Once a month, compare Google Ads clicks with GA4 paid sessions, and gather the GCLIDs behind any suspicious pattern while they're inside Google's 60-day window.

Steps 1 to 3 fix your reporting. Steps 4, 5 and 7 give you evidence Google can check. For the settings that cut bad clicks at the source, see our ad fraud prevention guide, and for choosing a tool, our guide to click fraud software.