What counts as a “session”? Every tool defines it differently

A session — some tools say 'visit' — is one continuous sitting on your site: a person arrives, reads some pages, and leaves. Most tools end it after 30 minutes of inactivity, so a visitor who leaves and comes back 31 minutes later counts as two sessions. That's roughly where the agreement ends. Google Analytics 4 no longer splits sessions at midnight or when campaign parameters change; Matomo still splits on both. Fathom uses a 24-hour window instead of 30 minutes. And a few privacy-first tools don't track sessions at all.

The practical consequence: the same day of traffic produces different session counts in different tools, and none of them is wrong — they're counting by different rules. If you've ever run two tools side by side and watched the numbers disagree, session definitions are one of the quiet reasons; the full list of reasons is here. (If you're still untangling sessions from visitors and pageviews, start with that explainer — this post is about how tools disagree on one of the three.)

The 30-minute inactivity timeout is nearly universal. GA4, Plausible, Adobe Analytics and Matomo all use it as the default. The logic: after half an hour of silence, the visitor has probably left, so whatever happens next is a new sitting.

The timeout is usually adjustable — GA4 allows anything up to 7 hours 55 minutes, and Matomo and Adobe's virtual report suites have their own knobs — but almost nobody changes it, which is good news: it's one of the few session rules you can assume is the same across tools.

The notable exception is Fathom, which uses a 24-hour window. A visitor who reads one page at 9 AM and comes back for another at 5 PM is one session there, two sessions everywhere else. The visible side effect is bounce rate: the afternoon return 'undoes' the morning bounce, so Fathom's bounce rates run noticeably lower than other tools' for identical traffic. Neither number is broken — they disagree about what a sitting is.

Universal Analytics — the Google Analytics that most published advice still describes — ended sessions on three triggers: the 30-minute timeout, the stroke of midnight, and any change in campaign parameters. GA4 dropped the last two: sessions aren't restarted at midnight or when new campaign parameters arrive.

The midnight rule sounds like trivia until you have late-night traffic. A reader active from 11:40 PM to 12:20 AM was two sessions in Universal Analytics and is one in GA4. For news sites, entertainment sites, and anything with an audience spread across time zones, the old rule manufactured extra sessions every single night.

The campaign rule mattered even more. In Universal Analytics, a visitor who arrived from a Google search and then, ten minutes later, clicked one of your retargeting ads — new UTM parameters, new session, immediately. One person, one sitting, two sessions in the report. GA4 keeps that person in a single session and records the new campaign as an event within it.

This is why session counts moved for everyone who migrated from UA to GA4, even with stable traffic — Google itself says session discrepancies of up to 20% are expected between the two. The traffic didn't change. The definition did.

Matomo still behaves the way Universal Analytics did: sessions split at midnight, and a campaign change starts a new visit by default (it's configurable). A visitor browsing across 11:59 PM becomes two visits; a visitor clicking through from a second campaign becomes a new visit on the spot.

Run the same site in GA4 and Matomo and the divergence is visible: with late-night audiences or several concurrent campaigns, Matomo reports more sessions, reliably. Not a bug in either tool — a design disagreement that neither dashboard mentions.

Some privacy-first tools took a different route: they got rid of the machinery sessions require. Cloudflare Web Analytics uses no cookies, no localStorage, and no fingerprinting — and without a way to recognize the same browser twice, it can't stitch pageviews into sessions. Its dashboard is about pageviews, referrers and performance. Simple Analytics is cookieless too, and derives its visit numbers by estimation rather than by tracking anyone across pages.

The trade is honest: a smaller privacy footprint in exchange for not knowing how many discrete sittings your traffic represents or what a journey through the site looked like. If you're using one of these tools, 'sessions' as the other tools mean it simply isn't a metric you have — you're reading traffic patterns, not visits.

On top of redefining the session, GA4 added a filter other tools mostly haven't: the engaged session — one that lasted 10+ seconds, or included a conversion, or viewed at least two pages. Sessions that clear none of those bars — the four-second bounces, the misclicks, some of the bots — still count as sessions, but not engaged ones.

It's a useful idea wearing a confusing label, because GA4 reports both numbers and they can be far apart: 1,000 sessions of which 600 engaged is an unremarkable ratio. When you compare GA4 to a tool that counts every session equally, make sure you're holding GA4's total sessions next to the other tool's count — and when you care about whether visits were any good rather than how many there were, the engaged number is the one to watch. What sessions were worth is really a question about time and attention, and that metric has problems of its own.

Session counts aren't comparable across tools, and nobody's dashboard warns you. The rules that differ — midnight splits, campaign splits, timeout length, whether sessions exist at all — are each defensible, all quietly different, and enough to move your numbers by double-digit percentages without any change in real traffic.

So use sessions the way they're safe to use: within one tool, over time. This month against last month in the same tool is a real comparison; your GA4 sessions against a competitor's claimed Matomo sessions is not. If you switch tools, expect the session count to jump or dip at the switchover and resist diagnosing it — check a source you trust if you need reassurance the traffic itself is steady. And write down which tool and which definition your reports use; six months from now, mid-anomaly, you'll be glad the note exists.