Since 21 September Google Analytics can lock out foreign domains. What is locked out once does not come back.

What is new since 21 September

On 21 September 2026 Google announced a new data filter in the What’s new in Google Analytics: a list of allowed domains. Since June you could exclude individual domains. Now you can turn it around and say that only events from the domains you list count. Everything else Google discards before it is processed.

Two sentences from the announcement matter. First: events without a hostname are blocked by the filter on its own, because a missing hostname almost always means spam. Second: the filter is not applied to events that arrive from the server through the Measurement Protocol. What your own server reports keeps arriving. What a foreign server reports with your ID does too.

The ground rules are in the help article on data filters. A property can have up to ten data filters. All active filters for allowed domains are applied first as a group, followed by the exclude filters. And the sentence this article is about: once a data filter is active, its effect on the data is permanent.

Why this filter exists

Almost every property that is a few years old holds data that does not come from your website. An agency copied your theme for another client and forgot the ID. A developer ran the test environment with the same tag. A spam script sends events to thousands of IDs in the hope that someone clicks the referral.

You see the result in the numbers without knowing where it comes from: visits that never complete an order, pages that do not exist on your website, a bounce rate that looks worse than it is. Whoever feeds Google Ads from Google Analytics passes that data on. The new filter cleans it up at the only place where it is safe to do so: before the data lands in the property.

Why it is dangerous

The problem is the permanence. A filter for allowed domains locks out everything not on the list. And the list is almost always too short, because a website consists of more domains than its owner thinks.

• The checkout of a payment provider or a shop system when it runs on its own domain.
• A booking or appointment tool on a subdomain.
• The English version on a different domain or the old domain that still redirects and briefly measures while doing so.
• Landing pages that live in a landing page software and carry your property’s ID.
• Your agency’s preview on a test domain, which you deliberately no longer want to see, but whose events were in your numbers until now.

Every domain that is missing is gone from the moment of activation. Not hidden, but never processed. The report shows a gap no button closes. If the checkout is missing, the orders are missing. That then looks like the Shopify cut, only self-inflicted.

Google has not yet documented whether subdomains automatically belong to a listed domain. Until that is clear: list every subdomain separately and check in testing mode what gets through.

How to go about it

Google gives data filters three states: Testing, Active and Inactive. The first is the one that saves you from the mistake.

1. Get your own domains from the data, not from memory. In Explorations, build a table with the dimension Hostname and the event count for the last 90 days. What is listed there has measured in the last three months. For every row you decide: belongs to me, does not belong to me, do not know. The third group is the one that holds the filter back until it is cleared up.
2. Create the filter in testing mode. Under Admin, Data collection and modification and then Data filters. List all domains that belong to you and leave the state on Testing.
3. Wait a week and look. In testing mode Google marks every event the filter would lock out with the dimension “Test data filter name”. A table with that dimension and the hostname shows you what you would have lost. A week because some domains only measure on weekends or at month end.
4. Only then set it to Active. And note the date in your calendar. If something is missing in the reports from that day on, you know where to look.

What the filter cannot do: tell server events apart. Everything that comes through the Measurement Protocol bypasses the filter. That is intended, so your own reports from the server do not get lost. But it also means spam keeps arriving by that route. The only defence is the Measurement Protocol’s secret key, which you rotate when it has become public somewhere.

On the side: conversion windows since August

Since 11 August 2026 you can set in Google Analytics how long after a click an order is still attributed to the ad. For clicks any value from one to 90 days is now possible, before there were only fixed steps. For viewed video ads it is one to 30 days, before it was fixed at three. The setting sits under Advertising, Conversion management and then Settings.

Two things about it. The setting changes attribution in the advertising reports of Google Analytics, not in your ad account. There every conversion action has its own window. And whoever changes the window can no longer compare the months before with the months after. That belongs in the calendar too.

What you can do now

• Look at the hostnames of the last 90 days in a table and assign every row. It takes a quarter of an hour and shows you how much foreign data sits in your property.
• Create the filter for allowed domains, but leave it in testing mode. After a week check the dimension “Test data filter name”.
• Only activate when nothing that belongs to you was locked out in that week. Note the date.
• If you do not know which domains, subdomains and tools measure into your property at all: the tracking check lists every place data comes from, together with the question of which of them belong to you. Within two working days you get a report with which you can activate the filter without loss.