Most analytics setups undercount real visitors. Not by a small margin, for some audiences the gap between actual traffic and reported traffic is substantial. The causes are well understood, and knowing them changes how much you should trust the numbers you're making decisions from.
Ad blockers are the biggest factor
Browser-level ad blockers, uBlock Origin, Brave's built-in shields, Firefox's Enhanced Tracking Protection, block Google Analytics by default. DNS-level blockers do too. Google Analytics appears on every major block list, which means any visitor running one of these tools simply doesn't appear in your GA4 data. No error, no warning, just missing traffic.
Global ad blocker usage sits at around 30% of internet users, with significantly higher rates among technical and professional audiences. If your site targets developers, designers, marketers, or anyone who works in tech, a realistic estimate is that 40–60% of your actual visitors may be invisible to GA4. You could be making content, product, and channel decisions based on half your real data.
This is one of the structural arguments for switching to a privacy-first analytics tool. Cookieless analytics tools that don't use Google's infrastructure are far less likely to appear on block lists. Palace Analytics, for example, is cookieless by design and doesn't route data through any advertising company's infrastructure, which means it isn't on the block lists that filter GA4.
Consent banners remove a second layer of visitors
For analytics tools that use cookies, a consent banner is a legal requirement in the EU and increasingly elsewhere. The problem is that a meaningful percentage of visitors decline. Estimates vary, but opt-out rates on consent banners commonly run between 20–40% depending on how the banner is designed and where the audience is located.
Visitors who decline don't appear in your analytics at all. They're not miscategorised or estimated. They're gone. Which means that for a GA4 installation with a consent banner, the total gap from ad blocking and consent refusals combined can easily exceed 50% of real traffic for certain audiences.
Cookieless analytics tools don't require a consent banner because they don't collect personal data. Every visitor is counted regardless of browser settings or consent choices. The complete visitor count is one of the clearest practical advantages of switching, and It directly affects the reliability of every downstream metric: conversion rates, bounce rates, campaign attribution, all of which improve when the denominator is accurate.
The tracking script itself can fail silently
Even when visitors aren't blocking your analytics, the script that sends data may not be running correctly. This happens silently: no error appears in your dashboard, you simply receive less data than you should.
Common causes include the script being installed in a template that doesn't apply to all pages, a Content Security Policy header blocking the script from loading, a JavaScript error earlier on the page preventing subsequent scripts from running, or a CDN serving a cached version of a page before the script was added. If your analytics numbers dropped suddenly after a site update, one of these is almost always the explanation.
To verify the script is firing, open browser developer tools, go to the Network tab, and reload the page. Filter by your analytics provider's domain. You should see outgoing requests with 200 responses. If you see nothing, the script isn't running on that page.
Bot and crawler traffic inflates numbers in the other direction
While most gaps result in undercounting, bot traffic pushes in the opposite direction. If your numbers look too high, particularly sessions from unfamiliar geographic locations, zero-second visits, or referral sources you don't recognise, bot traffic or referral spam is usually the cause.
Good analytics tools filter known bots automatically. Palace Analytics excludes bot and crawler traffic by default, so the visitor numbers you see reflect real human visits only. For GA4, bot filtering is enabled by default too, but newer crawlers and spam referrals still slip through and require manual exclusion.
How to get a more accurate picture
The most reliable way to sense-check your analytics numbers is to compare them against your server logs for the same period. Server logs record every HTTP request regardless of JavaScript execution or ad blocking. They'll show more traffic than your analytics, as bots, crawlers, and blocked visitors all appear in server logs, but a large, sustained gap between server log traffic and analytics traffic is a useful signal of how much you're missing.
For most websites the practical answer is to move to a cookieless, privacy-first analytics tool. It doesn't eliminate every gap, as dark social misattribution and direct traffic issues exist regardless of which tool you use, but it removes the two largest sources of undercounting: ad blocking and consent refusals. What remains is a much more accurate picture of your actual audience.
Palace Analytics counts every visitor: cookieless by default, no consent banner required, bot traffic filtered automatically. Free up to 100,000 events per month, no credit card required. Try it free.