How to track leads from social media and know which platform produced them.

Open your CRM and filter your last fifty leads by source. Count how many say “Direct,” “Social,” “Web,” or nothing at all. If you spend real money and time on social, that number is uncomfortable, because every one of those is a lead you cannot trace back to the post, platform, or ad that produced it.

That is the whole problem. You can see in your analytics that social sends traffic. What you usually cannot see is which of those visitors became a lead, and which platform gets the credit. The lead arrives, the source is blank, and the budget conversation that follows is mostly guesswork.

Most articles on this topic explain what a lead source is and then list social media as one bullet among organic, paid, email, and referral. That is not the question you came with. You already know social is a lead source. You want to know how to tell a LinkedIn lead from an Instagram lead from someone who copied your link into a Slack channel, and you want to know why it is so much harder for social than for any other channel.

The two questions you are actually asking

There are two separate problems hiding inside “track leads from social media,” and the methods that solve them are different.

The first is: did this lead come from social at all? That is a yes or no, and it is where most leads quietly fall through, getting mislabelled as Direct.

The second is: which platform, and ideally which post or ad? That is the granular version, and it is the one that lets you move budget with any confidence.

Underneath both sits the first-touch versus last-touch question. Someone discovers you through a LinkedIn post on Monday, thinks about it, comes back by typing your URL on Thursday, and fills in your form. Last-touch attribution calls that lead Direct. First-touch calls it LinkedIn. For social, this gap is everything, because social is almost always a first-touch, top-of-funnel discovery channel. People rarely buy straight off a post. They find you there and convert later through some other door. Track only the last step and social will look worthless on paper while quietly feeding your pipeline.

Why social media is the hardest channel to attribute

Every channel loses some data. Social loses the most, and the reasons are built into how the platforms and browsers work.

The referrer is missing far more often than you would think

When a visitor clicks from one site to yours, the browser usually passes along a referrer, the address of the page they came from. Analytics tools read that referrer to decide the source. When it is missing, the visit gets filed as Direct by default.

Social strips the referrer constantly. A 2023 experiment by SparkToro and Really Good Data sent real people to a test site through different apps and watched how each visit was recorded. The results are blunt: every single visit coming from TikTok, WhatsApp, Slack, Discord, and Mastodon was logged as direct. So were three quarters of visits from Facebook Messenger, just under a third from Instagram DMs, and one in seven from public LinkedIn posts. The traffic was real and it was from social. The analytics simply could not see where it came from. It does not help that the platforms route outbound clicks through their own redirect domains (t.co for X, lnkd.in for LinkedIn, l.facebook.com for Meta), so even when a referrer does survive, it can point back at the wrapper rather than the post that sent the visitor.

Dark social is the part you cannot see at all

A lot of social sharing never touches a public feed. Someone reads your post, likes it, and pastes the link into a team chat, a DM, or a text message. That is “dark social,” and to your analytics it is invisible. It looks identical to someone typing your URL from memory.

Nobody can give you a precise figure for your site, but the scale is not trivial. A peer-reviewed analysis of more than three million site visits estimated dark social at roughly 17 to 18 percent of all website traffic, though the authors are careful to call that a rough figure rather than a hard constant. Treat the number as soft. What it points at is solid: a real chunk of your Direct bucket is social, copied and passed around in private where no tracking code can follow.

In-app browsers change the rules again

Tap a link inside Instagram, TikTok, or LinkedIn and it often opens in the app’s own built-in browser, not Safari or Chrome. These in-app browsers behave differently, and they are a big reason the referrer data above goes missing. A visitor can come straight from a platform and still arrive looking like nobody sent them.

The journey crosses sessions and devices

Add it up and you get the typical social journey: someone sees you on their phone during a scroll, does nothing, and comes back days later on a laptop to actually enquire. Two sessions, two devices, and a referrer that was probably stripped on the first one anyway. A tracking setup that only looks at the final session sees a direct visit from a desktop and records the source as unknown.

So social lands in the Direct bucket by default. The traffic is there; the signals that would name it are exactly the ones social erases.

The methods that actually identify social leads

No single method catches everything, so the working approach layers several, each covering another’s blind spot. Roughly in order of how much ground they cover:

UTM parameters

UTM parameters are tags you add to the end of a link (utm_source=linkedin, utm_medium=social, utm_campaign=spring-guide) so that when someone clicks, your analytics records exactly where they came from. They are free, universal, and the right starting point for anything you control: your own posts, your bio links, your ads.

Where they break: UTMs only exist on links you tagged yourself. The moment someone copies your page URL and shares it, the tags are usually gone. They also live only on the landing page address, so if your tracking reads the URL at form submission three pages later, the tags have vanished from view unless something captured them on arrival. And you cannot UTM-tag a conversation, which is most of dark social.

Platform click identifiers

When someone clicks a paid ad, the platform appends its own tracking code to the URL: fbclid for Meta, li_fat_id for LinkedIn, ttclid for TikTok, twclid for X. These let you tie a visit back to a specific ad click inside that platform’s own reporting. They are automatic on paid traffic, so they are a useful backstop when a UTM is missing.

Where they break: they are mostly a paid-ads signal, they are platform-specific, and they tie back to the ad network’s numbers rather than giving you one clean cross-platform view. They also do not survive a copy-paste any better than UTMs do.

Native lead forms

Meta Lead Ads, LinkedIn Lead Gen Forms, and TikTok Lead Generation collect the lead inside the app, so the platform already knows the exact campaign and ad that produced it. The source is unambiguous because the form never left the platform. Sync these into your CRM and the attribution comes attached.

Where they break: the lead stays trapped in each platform until you connect it to your CRM, and you end up with a separate silo per network. It also only covers paid lead forms, not the organic post that sent someone to your website.

Link-in-bio and trackable short links

Your one bio link, or a short link in a post, can carry tracking and route through a page you control. That gives you a clean, countable signal for the traffic you deliberately send from a profile or a specific post.

Where they break: only as good as your discipline in using a unique link per place, and still useless once someone shares the destination URL onward.

First-party capture at the moment of submit

This is the one that addresses the root cause. Instead of trying to read the source at the end and hoping the referrer survived, you capture it when the visitor first arrives, store it on your own domain, and keep it attached to them across pages and return visits. When they finally submit a form, the original source, the landing page, and the full journey ride along with the submission, written straight into your CRM as hidden fields.

Why it survives where the others do not: it records first touch the instant it is available, before the referrer can be stripped mid-journey, and it persists through the multi-session, multi-device path that defaults everyone else to Direct. It is the same first-party approach teams already use to stop analytics being blocked, applied to your lead forms. It is also exactly what Lead Source is built to do, capture the real source first-party on every submission, so a LinkedIn lead reads as LinkedIn even when they come back four days later by typing your URL.

Where it breaks: it can capture a source only when one exists in the visit. For true dark social, where a link was pasted with no tags and no referrer, even first-party capture sees a direct visit. Which is why you need the next method too.

The “how did you hear about us?” question

A single optional field on your form, or a one-line follow-up after signup, is the only method on this list that can catch dark social. If someone heard about you in a private community and typed your URL, no code on earth will name that source. But the person will, if you ask.

The evidence for pairing it with software is strong. When Ruler Analytics tested self-reported attribution on more than 350 of their own B2B leads, 72 percent of the answers were wrong, vague, or blank on their own, hardly a ringing endorsement. But combining those self-reported answers with their first-click tracking data pushed accuracy to 81 percent. Neither method alone got near that. (It is a single company’s test, and Ruler sells attribution software, so weigh it accordingly, but the direction is sound and it matches how the mechanics work.)

Where it breaks: people give lazy answers (“Google,” “online”), and make the field optional and around a third of people skip it entirely. It is blunt. It is also the only method here that reaches dark social at all.

Promo codes, unique URLs, and QR codes

For social that spills into the offline world, or where you want a dead-simple countable signal, give each platform or post its own code, vanity URL, or QR. When it is used, the source is unambiguous because nothing else could have produced it.

Where they break: manual to set up, and they only capture the people who use the code.

Social listening

Rather than waiting for people to come to a form, monitoring tools surface public conversations where someone is asking for exactly what you sell. The lead and its source arrive together, because you found them in the post itself.

Where they break: it is a sourcing tactic more than an attribution one, it only sees public conversation (not dark social), and it takes ongoing effort.

Platform-by-platform cheat sheet

The single best method varies by platform. Best method, and the main trap, for each:

The pattern across the table: for paid, lean on the platform’s own click ID and native form. For organic, UTMs plus first-party capture do the heavy lifting. And everywhere, the “how did you hear about us” question is your net for what the rest miss.

The workflow for a non-technical marketer

You do not need an analytics team. You need five things done in order and then left running.

1. Standardise your UTMs. Pick one naming convention and never deviate. linkedin is always linkedin, never LinkedIn, li, or linkedin.com. Inconsistent names fragment your reports into nonsense. Tag every link you control: bio links, post links, ads.
2. Capture first touch, first-party. Put a snippet on your site that records the source, landing page, and journey on arrival and persists it to the form submission. This is what survives the referrer loss and the multi-session journey. Without it, steps 1 and 4 leak.
3. Add the “how did you hear about us?” field. One line on the form, or a follow-up after signup. This is your only line on dark social. Optional gets you fewer answers but cleaner data; mandatory gets more answers but more junk. For most B2B, optional plus a short list of choices works best.
4. Lock the original source in your CRM. Keep two fields: original source (first touch, locked so nobody overwrites it) and latest source. Sales reps editing the source field by hand is a top cause of garbage data. CRM data is shaky to begin with, in Validity’s 2022 survey of 1,241 CRM users, 91 percent said the data behind their decisions is at least sometimes inaccurate and 56 percent flagged missing or incomplete data. Locking the field is cheap insurance.
5. Review by platform monthly. Once the data flows, look at leads and customers by original source, not clicks. The question is never “which post got likes,” it is “which platform produced leads that became customers.”

Common mistakes that quietly wreck your data

• Trusting last touch only. It robs social of the credit it earns at first touch and makes you defund the channel that is actually feeding you.
• Inconsistent naming. “Facebook,” “facebook,” and “FB” become three sources in your reports. Pick one and enforce it.
• Ignoring dark social. If you have no self-report question, you have decided not to know about a large, invisible chunk of your best word-of-mouth.
• Trusting platform-reported numbers over your own. Every ad platform counts generously and claims credit where it can. Your first-party data, captured on your domain, is the version that is not trying to sell you more ads.

The short version

Social is the hardest channel to attribute because it destroys the very signals other channels rely on: the referrer goes missing, the sharing happens in private, the journey crosses sessions and devices. No one method fixes that. What works is a layer: standardised UTMs on what you control, platform click IDs and native forms for paid, first-party first-touch capture so the source survives to the form, and a “how did you hear about us” question to catch the dark social nothing else can. Do that, and “Direct” stops being where your social leads go to disappear.

Sources

• SparkToro & Really Good Data, “New Research: Dark Social Falsely Attributes Significant Percentages of Web Traffic as Direct” (April 2023). sparktoro.com
• Marjan, A., Graham, C., Bruce, M. & Mitchell, A., “Dark social: The biggest missed opportunity in digital marketing,” Journal of Digital & Social Media Marketing, Vol. 8(3) (2020). researchgate.net
• Ruler Analytics, “Self-Reported Attribution” (July 2022). ruleranalytics.com
• Dreamdata, “Self-Reported Attribution, Tested.” dreamdata.io
• Validity, “The State of CRM Data Management 2022” (2022). validity.com
• Statista, “Social media platforms used by B2B and B2C marketers worldwide.” statista.com