UTM

UTM parameters are short tags appended to a URL — utm_source, utm_medium, utm_campaign, utm_content, and utm_term — that tell GA4 exactly where a click came from. Without them, paid, email, and partner traffic gets misclassified into Direct or generic Referral. This guide covers the five standard parameters, how Google Analytics 4 reads them, tagging conventions that survive across teams, common mistakes that pollute reports, the privacy trade-off of long URLs, the source-attribution hierarchy (UTM vs gclid vs Referer), and a FAQ answering the questions analysts actually get asked.

What Are UTM Parameters?

UTM parameters — the acronym is short for Urchin Tracking Module, after the analytics product Google acquired in 2005 — are key/value pairs appended to a destination URL after a question mark. When a visitor clicks the tagged link, the analytics platform reads those values from the URL and stores them with the session, making the traffic self-identifying.

A tagged link looks like this:

https://example.com/pricing?utm_source=newsletter&utm_medium=email&utm_campaign=spring2026

UTMs are platform-agnostic. They work in GA4, Plausible, Matomo, Adobe Analytics, Fathom, and any tool that reads URL query strings. They’re also human-readable, which makes them useful for QA — you can paste a tagged URL into the address bar and immediately see what attribution it should generate.

The Five Standard UTM Parameters

GA4 (and every analytics tool that follows the Urchin convention) recognises exactly five UTM keys. Three are required for clean attribution; two are optional and only useful in specific scenarios.

The required trio answers the three questions every acquisition report needs: who (source), how (medium), why (campaign). Drop any one and GA4 will fall back to whatever it can infer from the Referer header — usually wrong for paid and email traffic.

How GA4 Reads UTM Parameters

When a tagged URL loads, the GA4 tag captures the query string, parses out the utm_* keys, and writes their values onto the session_start event. From there, GA4 stores them as session-scoped dimensions:

• utm_source → session_source
• utm_medium → session_medium
• utm_campaign → session_campaign
• utm_content → session_manual_ad_content
• utm_term → session_manual_term

GA4 then runs session_source / session_medium through its Default Channel Group rules to bucket the visit into Email, Paid Search, Organic Social, Referral, and so on. The medium value drives that classification — utm_medium=email always becomes the Email channel, cpc always becomes Paid Search, and so on.

Two attribution scopes matter: session (last non-direct touch on this visit) and user (first-touch acquisition). Both read the same UTM values but apply different time-window rules. For per-session analysis use Traffic Acquisition; for understanding which channels discover new users use User Acquisition.

UTM Tagging Best Practices and Conventions

The single biggest cause of broken UTM reports isn’t missing tags — it’s inconsistent tags. Email, email, e-mail, and EMAIL generate four separate rows in GA4. A naming convention fixes that before it starts:

1. Lowercase only. GA4 treats UTM values as case-sensitive. Pick lowercase as your standard and stick to it across every team and tool.
2. No spaces. Use underscores (spring_sale) or hyphens (spring-sale). Pick one separator and apply it consistently — mixing them creates the same fragmentation as inconsistent case.
3. Use the standard mediums verbatim. email, cpc, social, display, affiliate, referral. These map directly to GA4’s Default Channel Group; custom mediums like e-mail-blast end up in “Unassigned”.
4. Maintain a tag dictionary. A shared spreadsheet listing approved source and campaign values for the year. Anyone building a link checks the dictionary first.
5. Build links through a tool, not by hand. Google’s Campaign URL Builder or our own UTM Builder enforces the convention and prevents typos.
6. Tag every external promo. Ads, partner posts, sponsored content, emails, QR codes, podcast show notes, in-app links from your mobile app to your web property.
7. Never tag internal navigation. A UTM on an internal link starts a new session and overwrites the original acquisition data. This is the most common self-inflicted attribution wound in GA4.

For a deep dive into running this discipline at scale across 50+ campaigns per quarter, our pillar guide on UTM parameters that actually track walks through dictionary structure, naming conventions, and team rollout.

Building UTM URLs Manually vs With Tools

You can construct a UTM URL three ways:

• By hand — fast for one-off tests, error-prone for production. Typos are invisible until they show up as duplicate rows three weeks later.
• Spreadsheet template — one row per link, columns for each UTM parameter, a CONCATENATE formula that builds the final URL. Decent for small teams; scales poorly past a few hundred links.
• Builder tool — a form that validates inputs, enforces lowercase, and outputs a copy-paste-ready URL. Examples include Google’s Campaign URL Builder, utmbuilder.net, and our own UTM Builder.

For high-volume programs, layer in a URL-shortener (Bitly, Rebrandly) so the long tagged URL becomes a clean branded short link in customer-facing creative — the UTMs still resolve when the redirect fires.

Common UTM Mistakes

Most “UTM problems” trace back to one of these patterns:

• Case-sensitivity drift. Facebook and facebook are two different sources. Lowercase everything, always.
• Tagging internal links. Adding ?utm_source=homepage&utm_medium=internal to a button on your own site forces a new session and erases the visitor’s actual acquisition. Internal links should never carry UTMs.
• Double-tagging via redirects. A short link that redirects to an already-tagged URL can cause the second set of UTMs to overwrite or merge unpredictably. Tag once, at the final destination.
• Parameter pollution. Stuffing PII (email, phone) or session IDs into utm_content creates millions of unique values, blows out reports, and risks GDPR violations.
• Inconsistent mediums. email on Monday’s send, e-mail on Tuesday’s, newsletter on Wednesday’s. Three reports where one should exist.
• Missing the required trio. Only tagging utm_source and skipping utm_medium means GA4 can’t bucket the channel — it falls into “(not set)” or generic referral.
• Tagging organic search. Don’t add UTMs to your own SERP listings or canonical links. GA4’s organic detection works fine without them, and UTMs override the natural attribution.

UTM and Privacy — Long URLs vs Short Links

UTMs are visible. They sit in the URL bar, in browser history, in shared bookmarks, and in any logs that capture the full request line. That’s a privacy-conscious surface to design carefully:

• Never put PII in UTMs. No email addresses, customer IDs, names, or phone numbers. They’re visible to the user and to anyone they share the link with.
• Avoid session-uniqueness. Don’t generate per-user UTM values. Beyond the privacy concern, it explodes cardinality in GA4 and makes reports unusable.
• Use a URL shortener for customer-facing creative. Long UTM-heavy URLs look spammy in social posts and email previews. A branded short link (yourdomain.link/promo) hides the parameters until the click resolves.
• Strip UTMs server-side after capture. Many sites use a 301 or JavaScript replaceState to remove UTMs from the address bar after GA4 records them — keeps shared URLs clean and prevents accidental re-tagging if a visitor copies the URL.

UTM vs gclid vs Referer — Source Attribution Hierarchy

GA4 has three signals it can use to attribute a visit. They run in a strict priority order, and earlier signals override later ones:

1. UTM parameters or click identifiers (gclid for Google Ads, fbclid for Facebook, msclkid for Microsoft Ads). If any of these are in the URL, GA4 uses them and ignores everything else.
2. Referer header. If no UTM/click-id, GA4 reads the browser’s Referer to identify the previous domain. This drives Organic Search detection (Google, Bing, etc.), Organic Social detection, and the referral traffic fallback.
3. Direct. If the URL has no UTM and no Referer, GA4 classifies the visit as direct traffic — typed URL, bookmark, app open, or stripped Referer.

This hierarchy is why any UTM tag wins over Referer. If a partner blog tags its outbound links with ?utm_medium=email, GA4 treats those clicks as Email even though the Referer says blog.com. The medium is whatever the link tells it to be.

For a deeper look at when each channel applies, see our guides on source, medium, campaign, referral traffic, direct traffic, and affiliate.

Frequently Asked Questions

Related Terms

• Source — the specific publisher or platform sending traffic
• Medium — the channel category that GA4 maps to Default Channel Groups
• Campaign — the marketing initiative a tagged link belongs to
• Referral traffic — fallback channel for external clicks without UTMs
• Direct traffic — visits with no UTM and no Referer
• Organic search — search-engine clicks attributed via Referer
• Affiliate — partner-driven traffic with affiliate-specific tagging
• Pillar guide: UTM parameters that actually track

Bottom Line

UTM parameters are the single most reliable way to make external campaign traffic self-identifying in GA4 and every other analytics tool. Tag every external promo with the required trio (utm_source, utm_medium, utm_campaign), enforce a lowercase naming convention through a builder tool, never tag internal links, and respect the source-attribution hierarchy where UTMs win over Referer. Get those four habits right and your acquisition reports will tell you the truth.