Strange query strings in appearing in Analytics

[NickMNS]

I am seeing strange query strings being appended to my URL's by Google or possibly Apple.

https://example.com?back=https://www.google.com/search?client=safari&as_qdr=all&as_occt=any&safe=active&as_q=keyword+used+in+search&channel=aplab&source=a-app1&hl=en

Each instance was for user on iPhone iOS14, and in each instance "back" parameter is always [google.com...]

It seems to me that this may be the Google App on iOS that is doing this, although client param shows "Safari" which suggest that this coming from the browser and not an app. A bug? These parameter reveal the keyword, which in Analytics appears as (not set). This makes this a privacy issue.

[NickMNS]

Some added info:
On my website's end each instance is for a unique page, and the users are unique, from a globally diverse set of cities.
I haven't taken the time to check my raw logs, to see if there is anything additional to see.

Edit. more info:
The first instance was around August 21st with very few occurrences, then on September 20 it picked up in frequency. But to put this in perspective, at it's peak the total number of hits including these param is still less than 1% of the daily PV's.

[ClosedForLunch]

I've been getting these too. I remove the query string before the requested page is served to the user.

[not2easy]

I've read that Safari tracking reports are new in iOS 14 and you can see a list of all tracking cookies on any visited site by tapping the AA button on the left of the browser address bar, then select Privacy Report. From there you should be able to block unwanted tracking.

Edited to add: I read about this in an iOS 14 Security article on the Popular Science site: [popsci.com...]

[NickMNS]

@not2easy, if this is the case then someone messed up because now instead of not providing data such as keywords, Safari is displaying them directly in plain text, in the URL itself. Note that this does not apply to all iOS 14 users, only a subset.

[NickMNS]

To get the keyword data go to Analytics => Behavior => Site Content => All pages then apply a filter to include "back=" and this should display all the PV's in the date range that have the query params, including the keywords used.

In my case, the number of keywords provided by Google is about 50% more than those provided by this bug. BUT!, and this is a big but, huge. What is evident is that the keywords provided by Google are not statistically representative of the keywords used. Instead, it appears that Google tries to provide you with a greater diversity of keywords.

That is, if 5 out of 10 of your user come to your website using "Blue Widget" and the others and the others use "Green Widget" or "Red Widget" Google will show you Blue Widget = 1, Green Widget = 1 and Red Widget =1, instead of of showing Blue Widget = 3 (assuming that they show keywords for 30% of total traffic, which they don't more like less than 10%).

Essentially what this means is that the Apple data will provide you with immediate insight on the search terms for which you are really ranking for, as opposed to keywords provided at random by Google.

This is big, with this bug (if it is one) Apple is revealing information that Google doesn't want you to have.

[lucy24]

with this bug (if it is one) Apple is revealing information that Google doesn't want you to have

But it’s information that we want us to have, so let’s hope neither A nor G notices.

Too late now, I suppose.

[NickMNS]

Too late now, I suppose.

I'm pretty sure that they would realize the problem with or without this thread.

[Jonesy]

... from a globally diverse set of cities.

Probably TOR exit portals, then.

[NickMNS]

Probably TOR exit portals, then.

Not likely,
The request where for completely different unrelated pages, and as per query params are referred from Google search using completely different keywords. These requests fit perfectly the normal pattern of regular users. Not to mention that a user that goes through the trouble of using a TOR browser would also likely block tracking scripts, and thus the request would not appear in Google Analytics.