UTM Parameters, Fully Explained: How to Tag Your Links and 5 Mistakes Everyone Makes

For: marketers/operators hearing about UTM for the first time  ·  Format: explainer guide  ·  2026-07-11

I Opened the Report, and Facebook Had Split Into Three Rows

This actually happened on a team. They opened last month's traffic report, and where one row for the social channel should have been, Facebook, facebook, and FB sat side by side in three separate rows.

Image: a report where a channel that should have been one row splits into three because of inconsistent labeling.

With performance that should have been combined scattered across three rows, it wasn't obvious at a glance which channel was actually number one. Tracing the cause, it turned out that every time someone created an ad link, they typed the source name their own way, so capitalization and abbreviations ended up mixed together like that.

The team eventually wrote a naming-convention document, but it would drift out of sync again after a few weeks. A document exists to be followed, not enforced, after all. Eventually they went further and blocked free-text entry entirely, building a tool where you could only pick preset values from a dropdown. More on that later.

This post walks through, in order, exactly what UTM parameters (the root cause of that incident) are, how to attach them to a link, and what to watch out for, written so that even a first-timer can tag a link today by the time they finish reading.

The Shipping Label You Attach to a Link: UTM

Picture a delivery box. There's always a shipping label stuck on the outside, and it spells out where it was sent from, how it was shipped, and what event triggered the shipment.

UTM parameters play exactly that shipping-label role for a link. Attach a few short values after a question mark (?) at the end of a web address (URL), and the analytics tool records exactly "where, by what route, through which campaign" the visitor who followed that link arrived, with no server reconfiguration needed. That's because the information rides along in the link string itself.

Trace where the name came from, and you land on an unexpectedly old story. UTM stands for Urchin Tracking Module, and Urchin was the name of a web analytics software company (Urchin Software Corporation) that first appeared in 1998. That company devised the practice of attaching parameters to a URL to track visitor behavior, and that scheme carried forward into the UTM used today.

Google acquired Urchin in April 2005, and Google Analytics launched that same November. The acquisition price is said to have been somewhere around 30 million dollars, though that figure only ever repeats across secondary sources and hasn't been officially confirmed. What is certain is that the Urchin-branded product itself kept selling separately for a few more years before sales ended on March 28, 2012, with its functionality fully absorbed into Google Analytics.

So UTM isn't a proprietary feature unique to one company's product, it's a case of that company's tracking method hardening into something close to an industry standard and outliving the product. Google Analytics, of course, and other analytics tools too, still read the same rules for these parameters today.

Image: the parameter scheme from an analytics software called Urchin carried forward into Google Analytics.

The Five-Field Shipping Label: Dissecting the Parameters

Just as a shipping label has separate fields, UTM is made up of five defined fields. Here's the role of each field as officially defined in Google's documentation.

Google's official documentation states plainly that "you should always use utm_source, utm_medium, and utm_campaign when adding parameters to a URL." The remaining two fields (term, content) only need filling in when relevant.

With the move to GA4, utm_id (for campaign identification, its value doesn't show up in reports itself but is used for uploads), utm_source_platform (indicating a buying platform like Search Ads 360), utm_creative_format, and utm_marketing_tactic were added. That said, the latter three don't yet expose their values directly on GA report screens. For now, it's enough to know "these extended fields exist too."

Dissecting an Actual URL, Field by Field

Hearing it described doesn't quite make it click, so let's slice up one real URL field by field. The diagram below shows how the three required fields (dark navy) and two optional fields (dashed border) line up side by side.

A lot of people mix up the order of the three required fields, but here's an easy way to remember it. Source is "where" (place), medium is "how" (means), campaign is "for what" (reason). It maps exactly onto a shipping label's three fields: origin, delivery method, and reason for shipment.

Where Do You See That Tag: Session or First User?

The session (one chunk of a visit) and user (one person) concepts covered in Part 1 apply directly here. Depending on which of these two units you view UTM values through, the report changes.

GA4 shows UTM values through two different windows. One is Session source/medium, the UTM value attached when that session began. The other is First user source/medium, the UTM value from the very first time that person ever entered the site, and this value doesn't change no matter how many times they revisit afterward.

GA4's "Traffic acquisition" report is built around the session, and its "User acquisition" report is built around the first user. If the same UTM value shows different numbers across the two reports, there's a good chance this scope difference is why.

Say one person first came in through search last month and only signed up, then this month clicked an email link to come back and completed a purchase. In the user acquisition report, all of this person's activity gets attributed to "last month's search," since the first source is locked in. In the traffic acquisition report, though, this month's purchase gets attributed separately to "email." Neither is right or wrong, they're simply answering different questions. Ask "who first brought this person in" and you look at first user; ask "where did this result come from" and you look at session.

Image: the same UTM value shows different numbers depending on whether you view it through the session lens or the first-user lens.

Five Mistakes That Repeat, Every Time

UTM itself isn't hard. The trouble is always in how it gets attached, in practice. Here are the five most frequently repeated mistakes, in order.

First, mixing capitalization. Google's official documentation states plainly that "utm_source=naver and utm_source=Naver are different values." Because of this one line, facebook, Facebook, and FACEBOOK each land in separate rows in the report, splitting one channel's performance into three. The incident mentioned earlier was exactly this mistake.

Second, tagging internal links with UTM. UTM is meant for links coming from outside the site into it, not for use on a menu or banner inside the site. If a visitor who came in via search clicks a banner inside the site tagged with utm_source=newsletter, the original session's source gets overwritten with that value, and under the old scheme (Universal Analytics), it could even cut the session off entirely and start a new one. This gets dug into in more detail in the deep-dive post, which measured this problem directly.

Third, confusing the roles of source and medium. Source is "where," medium is "how." Mix these up (e.g., putting email in source and a channel name in medium), and the channel grouping itself breaks down.

Fourth, letting everyone name things their own way with no rule. That different team members' notation splits the same channel into multiple rows isn't spelled out in official docs, but it's the most common problem in practice. The incident described earlier ultimately started right here.

Fifth, using links that pass through a redirect without checking them. A URL shortener service or a particular redirect setup can lose parameters along the way. Not every redirect does this, it's a situationally dependent problem that varies by configuration, so it's hard to generalize and state flatly. There's one safe habit: for any link that passes through a redirect, always click it yourself after publishing to confirm the parameters are still intact in the final URL.

Building a Real Convention: Rules Get Enforced by Tools, Not Documents

Back to the team story mentioned earlier. Even after writing a naming-convention document, things drifted back out of order after a few weeks, because a document exists to be read, not to block bad input. When people get busy, they forget the rule and type whatever comes naturally to their hands.

The answer that team landed on wasn't polishing the document further, it was blocking free-text entry altogether. They predefined an allowed-value list for each of source, medium, and campaign, "only these values are used," and built a generator tool where creating a new link means picking from a dropdown of preset values instead of typing text directly.

Do this, and typos become impossible, and capitalization can't get mixed up either, since forbidden characters (spaces, special characters, non-Latin script, etc.) are never even in the options to begin with, making a rule violation physically impossible. Layer in a generation log on top of this, and later on, "who created this link and when" can be found instantly too.

There's one spot, though, where locking every field down to a dropdown actually gets inconvenient. utm_term (search keyword) is a field that only means something if the actual search term goes in as-is, so it's practical to make an exception there, allowing free text just for that field while standardizing the rest (source, medium, campaign). Remember it as the principle: "keyword-type fields stay free, everything else gets standardized."

Image: instead of asking nicely via a document, block rule violations at the source with a dropdown.

A Free Tool: Google's Official Campaign URL Builder

If you don't have the bandwidth to build an in-house generator tool, the sensible first step is trying the free official tool Google provides. It's published on the web as the Campaign URL Builder, and there's a separate GA4 version too.

The steps are simple. First, enter the landing page's full URL. Second, fill in the Campaign Source, Medium, and Name (=campaign) fields, and Term/Content too if needed. Third, copy the final URL the tool assembles automatically, and you're done.

Plenty of practical guides describe this tool as automatically lowercasing input values, but this behavior couldn't be directly confirmed in Google's own official documentation. Rather than typing carelessly and trusting the tool to sort out capitalization for you, it's safer to actually look at the resulting URL yourself the first few times you use it.

Image: even without an in-house tool, you can start with Google's official builder.

Tag Your Links Today, and Catch the Leaks in the Next Post

That covers the basics of UTM. Now it's just a matter of holding each real link you use up against it, one at a time.

If you only take one thing away, let it be this.

Don't ask people to follow the rule with a document. Force it with a tool.

Series note. This post is Part 2 of the "Intro to Digital Marketing Analytics" series. Foundational concepts like sessions, cookies, and events are covered in Part 1: Cookies, Sessions, and Events Basics, advanced techniques for capturing ad performance without a pixel are covered in Dark Funnel Tracking, and measured results on exactly where and how much UTM actually leaks are covered in the deep-dive post: UTM Tracking Measured.

Sources

• Origin of UTM, Urchin acquisition, end-of-service date: Wikipedia, "Urchin (software)"
• Official definition of the 5 UTM parameters, case-sensitivity warning: Google Analytics Help, "[GA4] URL builders"
• Google's official free URL builder tool: Google, "Campaign URL Builder"
• Session/user-scoped traffic source dimensions: Google Analytics Help, "Traffic-source dimensions"
• Mechanism by which internal-link UTM overwrites session source (legacy official explanation): Google Analytics Help, "[UA] Self-Referrals [Legacy]"

The Urchin acquisition price is an estimate that only repeats across secondary sources, so it's phrased as "said to have been." The ga-dev-tools builder's automatic lowercasing behavior is only described in practical guides and wasn't directly confirmed in official documentation, so it isn't stated flatly. Parameter loss due to redirects is treated as a situationally dependent problem that varies by configuration. The convention and generator-tool examples are generalized cases drawn from real practice, and no specific company or tool name is identified.