Every few weeks, a business owner opens Google Analytics, sees “(not provided)” or a blank where their keywords should be, and asks me: “Is my tracking broken?” It is not. That gap is deliberate, and it started on October 18, 2011, when Google announced it would encrypt searches for signed-in users.
Before that date, any website could see the exact words a visitor typed into Google. After it, more and more organic visits arrived with the keyword hidden. Within two years, nearly all of it was gone. This was not a ranking change, but it changed how every SEO has measured success since.
Let me explain what Google announced, why encryption removed the keyword, the controversy about ads, and how I measure SEO today without keyword-level analytics. You can see where this fits among other changes on our Google algorithm updates timeline.
Secure search and (not provided) at a glance
| Item | Details |
|---|---|
| Announced | October 18, 2011, on the Official Google Blog |
| Type | Policy and privacy change, not a ranking update |
| Confirmed by Google? | Yes, in a post by product manager Evelyn Kao |
| Who was covered first | Users signed in to a Google Account on google.com |
| What sites lost | The search term in the referrer for organic clicks |
| What sites kept | The fact that the visit came from Google |
| Replacement data | Top 1,000 queries in Webmaster Tools, last 30 days |
| Exception | Ad clicks still sent the query to advertisers |
| Expansion | September 2013: secure search extended to signed-out users |
What Google announced in October 2011
The post was called “Making search more secure”. Over the following weeks, Google would send signed-in users to the HTTPS version of google.com. HTTPS, also called SSL, is the encrypted version of a website connection, the padlock in your browser bar. Google framed the change as protection on unsecured networks such as public Wi-Fi:
“This change encrypts your search queries and Google’s results page.”
— Evelyn Kao, Google, Making search more secure
Google pointed to earlier steps in the same direction: making HTTPS the default for Gmail in January 2010, and launching an encrypted search option in May 2010.
For website owners, the important lines came later in the post. Sites would still know a visitor came from Google, but not the query. To make up for it, Google promised site owners access to “an aggregated list of the top 1,000 search queries that drove traffic to their site” in Webmaster Tools, covering the last 30 days.
Why encrypted search stripped the keyword from your analytics
To see why this happened, you need to know about the referrer. When you click a link, your browser usually tells the next website where you came from. For a Google search, that address used to include the search words, something like google.com/search?q=blue+running+shoes. Analytics tools read that address and recorded “blue running shoes” as the keyword.
After the change, Google stopped sending the search words in that address for organic clicks from secure search. Danny Sullivan described this in his Search Engine Land analysis of the change: sites could see the visit came from Google, but not the search terms. Google Analytics then grouped those visits under a new label: “(not provided).”
In simple terms, here is what changed for one visit:
- Before: Source google, medium organic, keyword “blue running shoes”.
- After: Source google, medium organic, keyword “(not provided)”.
- Still the same: Landing page, device, location, time on site and conversions.
Paid search data was not affected. The privacy argument also had a point. Sullivan noted that referrers can leak information about what people search for, including private health or money questions.
How fast (not provided) grew, 2011 to 2013
At first Google said the impact would be small. Matt Cutts estimated that even at full rollout it would affect “in the single-digit percentages of all Google searchers on Google.com,” according to Sullivan. Real data quickly came in higher.
In November 2011, Search Engine Land collected early numbers from several sites. Here is a selection:
| Site (November 2011) | Share of Google keywords “(not provided)” |
|---|---|
| Search Engine Land | 14.2% of Google-driven keywords |
| Daggle (Danny Sullivan's blog) | 13.65% |
| A non-tech site | 7.1% |
| High-traffic sites monitored by Conductor | 6.5% |
Tech sites saw more because their readers were more likely to be signed in to Google. Google's answer was that “traffic figures will naturally vary depending on a website's audience.”
Then, in September 2013, Google extended encryption to people who were not signed in. Sullivan reported in Search Engine Land's 2013 article that a tracking site covering 60 websites showed about three quarters of search terms already withheld, after a sharp jump in early September. Google's statement said: “We're now working to bring this extra protection to more users who are not signed in.” From then on, keyword data for Google organic traffic was effectively gone. Search Engine Watch summed it up with the headline “Goodbye, Keyword Data”.
The ads exception that made people angry
Here is the part that caused the biggest fight. Encryption did not apply to ad clicks. Google's post said that when a user clicked an ad, “your browser will continue to send the relevant query over the network.” Google said advertisers needed this to measure their campaigns.
Many SEOs and publishers felt this was unfair. If privacy was the reason, why was the search term private for organic clicks but available for paid ones? Sullivan made the argument directly. AdWords already reported the search terms to advertisers, so the extra referrer data was mostly redundant, and the exception treated privacy as worth protecting only when advertisers' interests were not involved. Privacy campaigners who praised the change also said ad referrers should be scrubbed too.
In 2013, Sullivan raised the same point again: publishers could still see withheld terms through AdWords, which some saw as an incentive to buy ads. Google denied that motive, saying, “The motivation here is not to drive the ads side — it's for our search users.”
My honest view: both things can be true. Encrypting search was good for users, especially on public Wi-Fi. And the ad exception was a real inconsistency that hurt publishers' ability to understand their own audience.
What site owners got instead: Webmaster Tools to Search Console
The replacement for keyword data was Google Webmaster Tools, now called Search Console. In 2011, it showed the top 1,000 queries for a site over the last 30 days. Sullivan pointed out its big weakness: the data was not linked to what visitors did on your site, such as purchases or sign-ups.
The tool has improved a lot since then. Here is how the situation compares:
| Data | Before October 2011 | Webmaster Tools, 2011 | Search Console today |
|---|---|---|---|
| Keyword per visit | Yes, in analytics | No | No |
| Query list | From analytics | Top 1,000, last 30 days | Queries with clicks, impressions, CTR and position |
| History | As long as you kept analytics data | 30 days | 16 months |
| Link to conversions | Yes, per keyword | No | Only by landing page, through GA4 |
You can link Search Console to Google Analytics 4. Google's help page on the Search Console integration explains that this adds two reports: Google Organic Search Queries and Google Organic Search Traffic. It also lists the limits. Search Console keeps 16 months of data, data appears in Analytics about 48 hours after collection, and the query report can only be broken down by Search Console dimensions, not Analytics ones. So you still cannot say “this query led to this sale.”
Search Console also has its own quirks, such as hiding some very rare queries for privacy. Our guide to Search Console data quirks during updates explains them, and our post on seeing organic keywords in GA4 walks through the setup. Beginners should start with our lesson on Google Search Console.
How I measure SEO without keyword-level analytics
Fifteen years on, “(not provided)” is just how things work. Here is the method I suggest to clients:
- Use landing pages as your unit. Each important page should target one main topic. If the page's organic traffic and conversions grow, the topic is working.
- Join the two data sets by URL. Export queries and clicks per page from Search Console, and sessions and conversions per landing page from GA4. Match them on the page URL.
- Split branded and non-branded queries in Search Console with a filter or regex. Branded growth and non-branded growth mean very different things.
- Track positions for a focused keyword set in a rank tracker, but treat it as a sample, not the whole picture.
- Annotate changes such as site launches and Google updates, so you can explain moves later.
- Report trends, not single days. Compare 28-day or 3-month periods to smooth out noise.
Here is a worked example, with hypothetical numbers. A plumbing company's page on boiler repair gets 1,200 organic sessions a month in GA4 and 40 contact form submissions. Search Console shows that page received 1,150 clicks from 310 different queries, with “boiler repair near me” and “boiler not firing” as the top two. You cannot know which query produced each lead. But you can say that page converts at about 3.3% (40 ÷ 1,200), and that the two top queries drive most of its clicks. That is enough to decide where to invest: improve the page for those two intents and build supporting content around them.
When traffic drops, rule out tracking problems before you blame Google. Our checklist on telling a tracking error from a ranking drop helps, and our guide on rankings vs traffic explains why the two can disagree.
What secure search changed for SEO reporting
The biggest long-term effect was on how SEO is judged. Before 2011, many reports were lists of keywords and their traffic. After 2013, good SEO reporting had to move to pages, topics and business outcomes. That was painful at first, but I think it made reports more honest.
- Keyword vanity metrics faded. “We rank number one for X” matters less than “this section brings in Y leads.”
- Content planning shifted to topics. Without per-keyword data, grouping related searches around one strong page became the norm.
- Search Console became essential. It went from a technical tool to the main source of query data.
- Paid search data gained value. Some teams used ad search terms reports to understand intent, the very point critics raised in 2011.
Around the same time, Google was also making search more personal, which made rankings even harder to measure. Three months later came Search plus Your World, which blended Google+ content into results for signed-in users. Two months earlier, Panda had spread to most languages with Panda 2.4.
Questions people ask about (not provided)
What does “(not provided)” mean in analytics?
It means the visitor came from Google organic search, but Google did not pass on the search term. It started with signed-in users in October 2011 and, from 2013, covered almost all Google searches.
Can I get my “(not provided)” keywords back?
Not at the visit level. You can see query data in Search Console, and link Search Console to GA4 to view queries next to landing pages, but you cannot tie a specific query to a specific visitor or conversion.
Why did Google still pass keywords for ad clicks?
Google said advertisers needed the data to measure and improve campaigns. Critics, including Search Engine Land's Danny Sullivan, argued this undercut the privacy reason, since advertisers already had the terms in AdWords reports.
Was secure search an algorithm update?
No. It did not change rankings. It changed what data websites receive. It is on our timeline because it changed how every SEO measures results.
How much traffic showed as “(not provided)” at first?
Google expected under 10% and Matt Cutts suggested single digits. Early reports collected by Search Engine Land in November 2011 ranged from about 7% to 14% of Google organic keywords, depending on the site.
Building an SEO report that works without keyword data
October 18, 2011, was the day keyword analytics started to disappear. By late 2013, it was gone for Google organic traffic. Search Console, page-level reporting and a clear link to business outcomes are how we measure SEO now.
If your reports still lean on rankings for a few keywords, or you are unsure what your organic traffic is really worth, we can help you set up reporting that answers that question. Take a look at our SEO services or get a free quote.
Google updates around the same time
Before this update:
- Panda 2.4 (August 2011): Panda Expands to Most Languages (Aug 2011)
- Google's Panda 2.0 Update (April 2011): Panda Goes Global (Apr 2011)
After this update:
- The Freshness Update (2011) and Google's Freshness Systems Today (Nov 2011)
- Search Plus Your World (January 2012): Google+ Inside Search Results (Jan 2012)
Or browse every Google update on one timeline, newest first.
Sources for this secure search and not provided history
- Official Google Blog: Making search more secure
- Search Engine Land: Google to begin encrypting searches and outbound clicks by default
- Search Engine Land: Encrypted search terms hit Google Analytics
- Search Engine Land: Google confirms moving to make all searches secure, except for ad clicks
- Search Engine Watch: Goodbye, keyword data
- Google Analytics Help: Search Console integration
- Wikipedia: Timeline of Google Search
