What a UTM actually does — and what it doesn’t
A UTM parameter is a label you attach to a link before anyone clicks it. Five parameters do the work: utm_source (where the click comes from), utm_medium (how they got there), utm_campaign (why), and the optional utm_term and utm_content for keyword and creative. Google Analytics reads them off the URL and files the session accordingly.
The reason to bother is that the alternative — referrer data — is unreliable and getting worse. Referrers are stripped by in-app browsers, rewritten by email clients, and withheld by privacy settings. Even when a referrer arrives intact, it cannot tell a paid placement apart from an organic post on the same platform. Both arrive as facebook.com.
What a UTM does not do is create attribution. It labels the click. Everything after that — whether the session is credited, how long the lookback window is, which conversion it gets attached to — is decided by your analytics configuration, not by the link. A perfectly tagged URL in a badly configured property still tells you very little.
How GA4 turns two parameters into a channel
This is the part most UTM guides skip, and it is where the money is lost. GA4 does not store your utm_medium and show it back to you in the channel report. It runs your source and medium through a fixed, ordered list of nineteen rules and assigns the session to the first one that matches. Everything that matches nothing lands in Unassigned.
The order is what catches people. Paid Social is rule 5 and requires a medium matching ^(.*cp.*|ppc|paid.*)$. Organic Social is rule 10 and matches a medium of simply social. So a Meta campaign tagged utm_source=facebook&utm_medium=social fails the paid test at rule 5, falls through, and is captured by rule 10 as Organic Social. The link is valid. The traffic is counted. The spend is simply not in your paid reporting, and nothing anywhere raises an error.
The near-misses are worse, because they look deliberate. social-paid reads like a sensible medium and fails, because paid.* is anchored to the start of the value and there is no cp in it. newsletter is the obvious medium for a newsletter and matches no rule at all. The reference table above is the full list worth memorising; the checker at the top of this page is faster.
The five mistakes that make a channel report lie
- Using social for paid social. The single most expensive one. Use paid-social or cpc and keep the platform in the source.
- Capital letters. GA4 dimensions are case-sensitive. Facebook and facebook are two rows that never sum, and one teammate capitalising a brand name fragments a quarter of data.
- Spaces. They encode as %20 — or as + if a platform re-encodes the link — which is how one campaign becomes two rows you reconcile by hand.
- Inventing a medium. newsletter, partner, qr, print all sound reasonable and all resolve to Unassigned.
- Tagging internal links. A UTM on a link between two pages of your own site starts a new session and overwrites the original acquisition source — the visitor Google sent you gets re-attributed to your own campaign.
A naming convention you can actually enforce
The rule that survives contact with a team is three words long: source is where, medium is how, campaign is why. The platform goes in the source. The channel type goes in the medium, chosen from GA4’s recognised list rather than invented. The thing you are promoting goes in the campaign, spelled identically everywhere.
Then two mechanical rules: lowercase everything, always; and pick one separator and never deviate. Hyphen or underscore is genuinely arbitrary — mixing them is not, because every split-column formula in your reporting sheet then needs two cases.
The reason to write this down once is that UTM hygiene degrades by accretion. No single link breaks a report. Thirty links built by four people over a quarter, each slightly differently, produce a channel report nobody trusts and everybody quietly works around.
Tagging social ads versus organic posts
Same platform, same link, two different jobs. An organic post is utm_source=facebook&utm_medium=social — here social is correct, because the traffic genuinely is organic social. A paid placement is utm_medium=paid-social. The source stays the same; the medium is what separates the ad account from the content calendar.
Two platform-specific things worth knowing. In-app browsers on TikTok and Instagram are aggressive about stripping parameters, so test the finished link from a phone rather than from your desktop. And Meta, LinkedIn, and Pinterest all append their own click IDs (fbclid, li_fat_id, epik) — those sit alongside your UTMs rather than replacing them, so both survive.
Tagging email newsletters
The medium is email. Not newsletter, not e-blast, not the name of your ESP — those all land in Unassigned. The publication or list belongs in the source, and the individual send belongs in the campaign.
The complication is that most email platforms want to tag links themselves. Klaviyo, Mailchimp, and HubSpot all offer automatic UTM appending, and running that alongside hand-built links produces duplicate utm_ keys on the same URL — GA4 reads the first occurrence and silently ignores the rest, so which one wins depends on ordering you do not control. Pick one system and turn the other off.
One privacy note: Mailchimp’s mc_eid identifies an individual subscriber. Keep it out of anything you publish or share, and never put an email address in a UTM value — Google prohibits sending personally identifiable information to Analytics, and sustained violations can cost you the property’s data.
utm_id, cost data, and the join you actually want
utm_id is the parameter almost nobody sets and the one that unlocks the most. It is the join key GA4 Data Import matches your spend against, which is what puts cost, sessions, and conversions in the same report — and therefore what lets you calculate a real ROAS or cost per lead without exporting two systems into a spreadsheet.
utm_term is the paid-search keyword slot and belongs nowhere else; on a social campaign it becomes a mystery column three months later. utm_content is where creative names, audiences, and placements go — and it is what stops two otherwise identical links collapsing into a single row.
When not to tag at all
Internal links. Never. A UTM between two pages of your own site starts a fresh session and overwrites the original source. If you need to measure an internal promotion, use an event.
Google Ads with auto-tagging on. The gclid parameter overrides manual UTMs in GA4 entirely, so hand-tagging an auto-tagged URL changes nothing — and if auto-tagging is ever switched off, you get a silent attribution change instead of a visible error. The same applies to Microsoft Ads and msclkid.
Anything containing personal data. No email addresses, no phone numbers, no customer IDs — not in the campaign, not in the content.
If links are already live and the report looks wrong, paste one into the Audit tab above. It runs the same rules over an existing URL and shows you the channel group it is actually reporting into, which is usually the fastest way to explain a month of traffic that went missing.