analytics
UTM Parameters, Explained Properly (Not Just What They Stand For)
What each UTM parameter is actually for, how GA4 reports it, and the gotchas — case sensitivity, internal linking, dropped redirects, taxonomy drift — that quietly corrupt campaign attribution.
A UTM-tagged link that gets pasted, forwarded, or run through the wrong redirect is worse than no tag at all — it reports confidently, and it lies. Everyone knows UTMs are “the tracking bits you add to a link.” Fewer people know which of the five actually matter, what breaks attribution silently, or why the parameter names look like they were designed by committee in 2003. They kind of were.
The five parameters
Only three are structural. Two are optional refinements that most links never need.
| Parameter | What it’s for | Example value | Where it shows up in GA4 |
|---|---|---|---|
utm_source | The specific referrer — the property sending the traffic | newsletter-jul26, google, instagram | Session source |
utm_medium | The general channel/category that source belongs to | email, cpc, social | Session medium |
utm_campaign | The specific initiative this link belongs to | summer-sale-2026 | Session campaign |
utm_term | Paid keyword (mostly legacy, for search ads) | lunchbox+ideas | Rolled into campaign details, rarely surfaced in default GA4 reports |
utm_content | Differentiates two links pointing at the same place from the same campaign (A/B creative, button vs. text link) | header-cta, footer-cta | Rolled into campaign details, rarely surfaced in default GA4 reports |
utm_source, utm_medium, and utm_campaign are the ones you should always set — Google’s own guidance for custom campaigns is explicit that these three are required for a link to be treated as a proper tagged campaign. In GA4, they land in the Acquisition → Traffic acquisition report as Session source, Session medium, and Session campaign — note “session,” not “user”: traffic acquisition reflects the source of the current session, not the visitor’s first-ever touch. utm_term and utm_content are there when you need finer granularity — a paid keyword, or which of two ad creatives drove the click — but plenty of solid tracking setups never touch them.
Why they’re called UTM
UTM stands for Urchin Tracking Module — and the name predates Google Analytics itself. Urchin Software Corporation built a web analytics product called Urchin Traffic Monitor in the early 2000s, and its custom-URL tagging scheme used exactly these parameter names. Google acquired Urchin in 2005 and turned it into Google Analytics. By then, utm_source and utm_medium were already an informal industry standard with links tagged all over the web, so Google kept the naming rather than rebrand it. Every campaign link you tag today is technically still using a 20-plus-year-old third-party analytics vendor’s URL scheme — Google just inherited it.
The tool most people reach for to build these links, Google’s Campaign URL Builder, is still live and is still Google’s own official tool for it — it’s part of the “GA Demos & Tools” site Google maintains alongside GA4’s documentation.
The gotchas that actually cost you data
Attribution rarely breaks loudly. It breaks by quietly misfiling traffic until a report looks wrong and nobody can say when it started.
Case sensitivity. GA4 treats Facebook and facebook as two different source values — Google’s own documentation is explicit that differently capitalized values, like Meta and meta, are treated as separate entries. Tag once with Newsletter and once with newsletter and you’ve split one channel into two rows in every report forever. Fix: lowercase every parameter value, no exceptions, and enforce it before a link ships.
Tagging your own internal links. Putting a UTM parameter on a link from your homepage to your pricing page can overwrite the campaign that actually brought the person to your site with your own homepage as the “source,” corrupting attribution for that visit. Never put UTM parameters on links between pages on your own domain — only on links coming from somewhere else.
Redirects that drop the query string. A shortened link, an old-school 301 rule, or a CDN redirect that doesn’t explicitly forward the query string will silently strip everything after the ? — the click still lands on the right page, but the UTM tags never arrive, and GA4 reports it as direct or unattributed traffic. Before you publish a tagged link that goes through any redirect (a link shortener, a vanity domain, a tracked ad URL), run it through the Redirect Checker and confirm the query string survives every hop to the final URL.
Inconsistent taxonomy across a team. email, e-mail, newsletter, Email — four different people, four different values, one channel fragmented into four rows nobody can roll up without a manual spreadsheet fix. This isn’t a technical problem, it’s a process one: write down your source and medium values once, put the list somewhere the whole team can see it before they build a link (a shared doc, a wiki page, whatever survives), and don’t let anyone invent a new value on the fly.
Pasting tagged links into places that strip or rewrite query parameters. Some platforms (certain email clients, some social schedulers, link-in-bio tools) rewrite outbound links through their own redirect layer, and not all of them forward query strings faithfully. If a channel is a known offender, verify a real tagged link through it before trusting its numbers — the same Redirect Checker works here too, since the problem is identical to a broken redirect chain.
Source and medium reversed. The rule of thumb: utm_medium is the channel category, utm_source is the specific property inside it. utm_medium=social with utm_source=instagram is right. utm_medium=instagram with utm_source=social breaks every medium-level rollup, because now “social” isn’t a medium at all — it’s buried as a source value alongside dozens of other sources. Same logic for email: utm_medium=email, utm_source=welcome-series — not the other way around.
Encoding. UTM values sometimes need spaces or special characters, and browsers can’t put a raw space in a URL — it has to become %20 or +. Which encoding style you use matters far less than being consistent about it: what actually protects your data is avoiding spaces and special characters in the first place. Use hyphens instead of spaces and you sidestep the whole question. One more thing worth knowing: it’s the parameter values that get encoded (summer%20sale), never the parameter names (utm_campaign) — those are always plain ASCII. (The full %20-vs-+ story, and which JavaScript function to use, is in URL encoding explained.)
A naming convention worth stealing
Pick one, write it down, and never deviate. This is a reasonable default:
| Good | Bad | Why |
|---|---|---|
utm_source=newsletter | utm_source=Newsletter | lowercase, always |
utm_medium=email | utm_medium=e-mail | no variants of the same word |
utm_campaign=summer-sale-2026 | utm_campaign=Summer Sale! | hyphens not spaces, no punctuation, dated so it doesn’t collide with next year’s |
utm_content=header-cta | utm_content=button1 | descriptive enough to mean something six months later |
Dating campaign names (-2026, -jul26) matters more than it looks — without it, a recurring promotion reuses the same campaign value every year and its historical performance blurs together in reporting.
QR codes are a legitimate UTM use case
A printed flyer, a poster, a product insert — anywhere a scannable code links back to a page — is one of the few places UTMs genuinely earn their keep, because there’s no other way to know a physical print run drove a visit. Build the tagged URL first (utm_source=flyer, utm_medium=print, utm_campaign=...), then encode that full URL, not the bare page URL, into a QR code with the QR Code Generator.
Where UTMs end
Two limits worth knowing before you rely on them for anything important:
- They don’t survive a copy-paste. If someone forwards your tagged URL by pasting just the base link, or a chat app previews and re-shortens it, the tags are gone and that visit shows up as direct traffic in GA4 — one of the most common (and least fixable) sources of “direct” traffic pollution.
- They’re visible in the address bar. Anyone who looks at the URL sees every value you put in it. Don’t put anything in a UTM parameter you wouldn’t want a recipient, a screenshot, or a support ticket to expose — internal codenames, discount logic, or anything embarrassing if read literally.
Check the link before you ship it
Build it right the first time with the UTM Builder — it validates the URL, encodes the values for you, warns if the link already carries UTM tags (so you don’t double-tag it), and generates a QR code of the finished link in the same step. If you’re auditing a link someone else built, the URL Parser breaks down every existing parameter, and the Redirect Checker confirms the tags actually survive to the final destination. Getting the on-page side right matters too — once traffic lands, the on-page SEO checklist covers what keeps that visitor converting instead of bouncing.