Layer A of the rating is the fastest and the most underrated: what the browser knows about the lead in the second they press "send". It needs no CRM and no waiting for anyone; it instantly separates bots and the merely curious from someone who has read, compared and typed calmly. This lesson takes it apart signal by signal.
The snippet and the GCLID
A piece of JavaScript on the site (a WordPress plugin or a few lines in the template) that:
- Reads the GCLID from the URL on the first visit and stores it (cookie or local storage, 90 days) along with the campaign/channel if they come in the parameters.
- Watches the session: time, scroll, pages, interactions.
- On form submission, adds the fingerprint and the GCLID to the submission (hidden fields or a call to a collector).
- Respects consent: the behavioural fingerprint does not identify the person; the GCLID is treated as measurement data under Consent Mode (and without consent, the lead is still scored but not tied to Google).
The lead's personal data (name, email, phone) goes to the CRM and to the client's spreadsheet; all that travels to Google is the GCLID with a value.
The behavioural signals
| Signal | What it measures | Bot / rubbish | Interested human |
|---|---|---|---|
| Fraud score inverted | Visitor Shield's probability of being non-human, the other way round: 40 × (1 − score/100) is the base |
Base ≈ 0 | Base ≈ 40 |
| Time on page before the form | Seconds of reading | < 3 s | 30 s – several minutes |
| Real scrolling | Scrolling with a human cadence | None, or perfectly linear | Irregular, with pauses |
| Pages viewed in the session | Session counter | 1 (the ad's page) | 2+ (pricing, case studies, contact) |
| Returning visitor | Has been here before (local storage) | No | Yes, adds points |
| Typing cadence | Speed and variance of keystrokes | Pasted or perfectly uniform | With natural variance |
| Time of day | Business hours vs the small hours | 3-6 AM | Human hours |
| Device / user agent | Coherence | Headless, odd UAs, impossible resolutions | Normal |
| Honeypot | Hidden field filled in | Filled in → 0 | Empty |
The field coherence signals
These are not personal data stored for scoring; they are validations done at the moment:
- A valid phone number for the country (mobile or landline in a real format).
- An email on a serious domain: corporate or a mainstream free provider; disposable ones (public lists) subtract points.
- A plausible name: two or more words, no keyboard patterns ("asdf", "qwerty").
- A message / optional fields filled in at a reasonable length.
- Delivery confirmed (the confirmation email arrived): a strong signal of a human with a real inbox.
The weighting
Layer A is worth around 40 of the 100 points, built on the fraud score as its base and adjusted by the signals (in the Lead Rating design the behavioural and coherence signals add into layer B of "positive signals"; in practice, A and B are read together as "what we know instantly", around 70 points). Two rules:
- A floor of zero for a filled-in honeypot, an extreme fraud score or a form submitted in under 2 seconds: no positive signal can rescue it.
- Transparency: the breakdown for each lead (why it scores what it scores) is stored in a note next to the rating. Sales and you can both see the reason; the calibration (lesson 5) uses it.
What layer A does not know
Whether the lead needs what you sell and whether they can pay for it. That comes from their later actions (layer B: they answered, they booked, they downloaded) and from the CRM (the truth). Layer A is the immediate filter: it removes what is certainly worthless and sorts the rest by probability. That is far more than Google knows, and it is instant.
💡 Ninja trick: the Lead Rating snippet is the same one that feeds Visitor Shield: a single piece on the site measures the fingerprint for fraud and for lead quality alike. And it has an important design consequence: the lead never leaves the client's spreadsheet — the collector writes into their sheet, the rating is worked out there, and all that travels to Google is the GCLID with its value. The client's DPA remains valid exactly as it is.
What you should remember
- Layer A is instant: the session fingerprint plus field coherence, captured by the snippet alongside the GCLID.
- The signals: fraud score inverted (the base), time, scroll, pages, returning visits, typing, time of day, device, honeypot; phone, email, name, message, delivery.
- A floor of zero for the unambiguous cases; a transparent breakdown per lead.
- It knows nothing about need or ability to pay: that comes from B and from the CRM.