# Cross-domain tracking is configured if multiple domains are in use

- **Pattern:** `ab-001701` (`marketing-analytics.core-analytics.cross-domain-tracking`)
- **Severity:** low
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-001701
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-001701)

## Why it matters

When marketing traffic lands on `www.example.com` and converts on `app.example.com`, missing cross-domain configuration resets the session at the subdomain boundary. The user who clicked your Google Ad and signed up is recorded as two separate visitors: one that bounced on the marketing site, one that appeared from `(direct) / (none)` on the app. Campaign ROI gets understated, paid channels look unprofitable, and budgets move away from the channels that actually work.

## Severity rationale

Low because the issue only surfaces when multiple domains exist and affects attribution rather than core tracking.

## Remediation

Configure the GA4 linker in your gtag config so both domains share a measurement cookie:

```js
gtag('config', 'G-XXXXXXX', {
  linker: { domains: ['example.com', 'app.example.com'] }
})
```

In the GA4 UI, add both domains under Admin > Data Streams > Configure tag settings > Configure your domains. For Stripe checkout redirects, fire the conversion event on your post-redirect thank-you page, not inside Stripe's domain.

## Detection

- **ID:** `cross-domain-tracking`
- **Severity:** `low`
- **What to look for:** Check if the project spans multiple domains or subdomains that need to share analytics sessions. Signals: multiple domain references in config files, references to a separate `app.` subdomain alongside a marketing `www.` domain, Stripe checkout redirects (a separate domain), or explicit cross-domain linking in navigation components. For GA4: look for `linker` configuration. For other SDKs: look for cross-domain session handling config.
- **Pass criteria:** Count every unique domain and subdomain referenced in config files, navigation, and external redirect targets. Either no cross-domain tracking is needed (1 domain only), OR cross-domain tracking is configured for all 2 or more domains in the relevant SDKs.
- **Fail criteria:** At least 2 domains are detected (e.g., marketing site on `example.com` and app on `app.example.com`) with no cross-domain linking configured, meaning sessions will reset when users navigate between domains.
- **Skip (N/A) when:** The project is a single-domain, single-subdomain project with no external checkout or cross-domain flows.
- **Detail on fail:** `"App subdomain (app.example.com) referenced in config but no GA4 cross-domain linker configured — users who navigate from the marketing site to the app will appear as new sessions"`
- **Remediation:** For GA4, configure cross-domain measurement in your GA4 property settings (Admin > Data Streams > Configure tag settings > Configure your domains). In code, add the linker configuration:

  ```js
  gtag('config', 'G-XXXXXXX', {
    linker: { domains: ['example.com', 'app.example.com'] }
  })
  ```

  For Stripe checkout: GA4 does not automatically follow users into Stripe's domain — configure your conversion events to fire on the thank-you page after redirect, not inside Stripe's checkout.

---

Taxons: observability, data-integrity

HTML version: https://auditbuffet.com/patterns/ab-001701