Mastering UTM tracking: the complete guide to clean campaign attribution in GA4

Where the name comes from, and what a parameter is

A UTM parameter is a short label you add to the end of a web address so that your analytics tool knows where the click came from. Nothing on the page changes. The only thing that changes is that the address now carries a note, and Google Analytics 4 (GA4) reads the note when the page loads.

The name is older than most of the people using it. Urchin Software Corporation was started in 1998 by Paul Muret and a few colleagues, and sold software that read web server logs and turned them into reports.¹ Google agreed to buy the company, then based in San Diego, on 28 March 2005, and said it planned "to make these tools available to web site owners and marketers".² The hosted version became Google Analytics. Urchin itself lived on as installable software until Google stopped selling it at the end of March 2012.¹ The labels kept the old company's initials: UTM stands for Urchin Tracking Module.³ So every time you type utm_source you are quoting a piece of software that has been retired for well over a decade. Few things in marketing last 25 years.

The mechanics are plain. A web address can carry extra information after a question mark, as pairs of a name and a value, joined with ampersands. Google's documentation agrees: separate the parameters from the address with a question mark, join the pairs with an ampersand, and the order does not matter.⁴ GA4 looks for pairs whose name starts with utm_ and files the values away as the origin of the visit.

Worked example: one link, taken apart

An invented shop will carry us through the article. Salthill Candles sells hand poured candles from a small unit in Galway, ships across Ireland, and is run by Aoife, who does the marketing herself on Tuesday evenings. Here is one of her links:

https://salthillcandles.example/autumn?utm_source=newsletter&utm_medium=email&utm_campaign=autumn_sale_2026&utm_content=hero_button

Everything up to the question mark is the page, her autumn landing page. After it come four notes. The source is newsletter, so GA4 knows which list sent the click. The medium is email, so GA4 knows the type of channel. The campaign is autumn_sale_2026, so this click is filed with every other click from the same push, whichever channel it came through. The content is hero_button, so Aoife can see later whether the big button or the text link lower down did the work. Delete all four and the page still loads, no bother. Keep them and the report at the end of the month can tell her where €5,290 came from. That is the whole trick.

The nine parameters GA4 recognises

Most guides list five. Google's documentation for GA4 lists nine.⁴

Parameter	What Google says it is for	Example values
utm_source	The referrer, where the click came from	google, newsletter, facebook
utm_medium	The marketing medium, the type of channel	cpc, email, paid_social
utm_campaign	The product, slogan or promotion	autumn_sale_2026
utm_term	The paid keyword	soy_candles
utm_content	To tell creatives apart	hero_button, carousel_2
utm_id	The campaign ID, matching any campaign data you upload	aut26
utm_source_platform	The platform that sent the traffic	Google Ads, Meta
utm_creative_format	The type of creative	display, video, search
utm_marketing_tactic	The targeting applied	remarketing, prospecting

Google says you "should always use" the first three, source, medium and campaign, and recommends adding utm_id and utm_source_platform as well.⁴ The last two, creative format and marketing tactic, are accepted but, in Google's words, each "isn't currently reported", so I set them only where a cost data import might use them later.⁴ Two warnings in the same document cause most of the damage I see. Parameter values are case sensitive: "utm_source=google is different from utm_source=Google".⁴ And a missing parameter does not vanish quietly. It shows up as "(not set)" in the report.⁴

Google provides a Campaign URL Builder that assembles the link for you from a short form.⁵ I use it for the first link of a campaign and then copy the pattern, because typing the pairs by hand is how the typos get in.

Worked example: the same campaign, three channels

Aoife runs the autumn sale through three channels. The campaign label stays identical on all three. Only source, medium, content and term change.

Channel	utm_source	utm_medium	utm_campaign	utm_content	utm_term
Google Ads search	google	cpc	autumn_sale_2026	rsa_1	soy_candles
Meta ads	facebook	paid_social	autumn_sale_2026	carousel_a	lookalike_buyers
Newsletter	newsletter	email	autumn_sale_2026	hero_button	(none)

For the Meta ads she also sets utm_id=aut26 and utm_source_platform=Meta. The Google Ads line gets special treatment, in its own section, because Google Ads tags itself.

How a click travels from the ad to the report

It helps to see the journey, because every breakage I describe later is a break in one of these steps.

The link is written once, in the ad or the email, and the parameters ride along in the address bar when the page opens. Then comes the step most guides skip: the consent banner. In Ireland an analytics cookie needs consent, full stop, and I return to that in the section on what breaks. If the visitor agrees, the GA4 tag fires, reads the parameters and sends a session_start event. Google says that event "carries the information that determines the attribution of the session".⁶ A session, in GA4's words, "ends or times out after 30 minutes of user inactivity".⁶ GA4 then applies its channel rules to the source and medium and the visit lands in the report. If a purchase follows, the attribution model decides which source gets the credit.

Worked example: one Tuesday evening click

A reader in Limerick opens Aoife's newsletter at 7.40pm and taps the hero button. The address that opens carries newsletter, email, autumn_sale_2026 and hero_button. She accepts the cookie banner. GA4 records a session_start with source newsletter, medium email and campaign autumn_sale_2026, and because the medium is email the visit is filed under the Email channel. She browses for 12 minutes and buys two candles for €46. The purchase event sits inside that session, and under GA4's default settings the €46 is credited to the newsletter. Had she put the phone down for 35 minutes and come back by typing the address, that second visit would have been a new session, arriving as Direct.

How GA4 turns your words into a channel

GA4 does not only report your medium as you typed it. It also sorts every visit into a default channel group, using rules on source, medium and campaign name that you cannot edit.⁷ Most people never read the rules, which is why a reasonable medium can end up in a bucket called Unassigned.

The rules that matter for a shop, from Google's definition of the default channel group:⁷

• Paid Search: the source is on Google's list of search sites and the medium matches the pattern ^(.*cp.*|ppc|retargeting|paid.*)$. So cpc, ppc, paid_search and paidsearch all qualify, as long as the source is google or bing.
• Paid Social: the source is on Google's list of social sites and the medium matches the same paid pattern. So facebook with paid_social is Paid Social. Facebook with social is Organic Social.
• Organic Social: the source is a social site, or the medium is one of social, social-network, social-media, sm, social network or social media.
• Email: the source or medium matches email, e-mail, e_mail or e mail.
• Display: the medium is display, banner, expandable, interstitial or cpm.
• Referral: the medium is referral, app or link.
• Affiliates: the medium is affiliate.
• Direct: the source is exactly (direct) and the medium is (not set) or (none).
• Unassigned: nothing else matched.

Two details. The channel definitions themselves are not case sensitive, so Email and email both reach the Email channel, but the dimension values in the report are case sensitive, so Email and email still appear as two rows.⁴⁷ And the paid pattern is wide: any medium containing cp counts as paid. That catches cpc and cpm as intended, and it also catches a medium you might invent, such as recap or landscape.

Worked example: three mediums, three outcomes

Aoife's first attempt at the Meta ads used utm_medium=social. The sessions arrived, GA4 saw facebook and social, and filed €1,100 of sales under Organic Social. Her report said the paid campaign had done nothing and the organic posts were flying. Her second attempt used utm_medium=paidsocial. That matches paid.* and the source facebook is a social site, so it landed in Paid Social, which is right, but it sat in a different row from the paid_social she used on the second ad set. The fix was one line in her vocabulary: the medium for Meta ads is paid_social, always. The third attempt used utm_medium=newsletter for the email, because it felt descriptive. Newsletter matches no rule, so the email revenue went to Unassigned. The medium for email is email. Nothing else.

One vocabulary, written down once

Clean attribution is not a tool problem. It is a vocabulary problem. Every parameter is free text, and three people writing free text produce five spellings. The cure is a short document, owned by one person, that lists every allowed value, and a rule that nobody types a link without it.

My rules, in the order I would write them on the first page of that document.

Lowercase everything. GA4 is case sensitive, so Google and google are two sources.⁴ Lowercase removes the whole class of error.

No spaces or special characters. A space or an ampersand in a web address has to be URL encoded, and different tools do it differently.⁸ Use an underscore between words.

Source answers where. The site or list the click came from: google, bing, facebook, instagram, linkedin, newsletter, or a partner's name.

Medium answers how. The type of channel, chosen from GA4's own patterns so the channel group comes out right: cpc for paid search, paid_social for paid social, email for email, display for banners, affiliate for affiliates, referral for a link on another site.⁷

Campaign answers why. The push, the sale, the launch. Use the same label across every channel, so one campaign is one row when you group by campaign. Put the year in, because you will run the autumn sale again.

Content answers which. The creative, the button, the placement. This is where A/B comparisons live.

Term answers for whom. In search it is the keyword. In social I use it for the audience name.

One owner. In the shops I have worked on, the vocabulary dies the moment two people can edit it. One person approves new values, and new values are rare.

Worked example: the Salthill Candles vocabulary

Aoife's page lists five sources: google, bing, facebook, instagram, newsletter. Mediums: cpc, paid_social, email, organic_social, referral. Campaign format: the push and the year, so autumn_sale_2026, christmas_2026, always_on. Content: a creative name and a number, so carousel_1, rsa_2, hero_button, footer_link. Term: the keyword group in search, the audience name in social. When her part time helper Seán wants to tag a post in a Galway community group on Facebook, he does not invent community_fb. He looks at the page, chooses facebook and organic_social, and asks Aoife which campaign it belongs to. Thirty seconds, and an hour of untangling saved.

Google Ads tags itself, so treat it differently

Google Ads adds its own identifier to every click, a parameter called gclid, short for Google Click Identifier. Google says auto tagging is "turned on by default for new accounts", and that in GA4 it "is prioritized over manual tagging due to the absence of an override option".⁹ In plain words: when GA4 sees a gclid, it takes the campaign, ad group and keyword from the linked Google Ads account and ignores your UTM values for those dimensions.

So why tag at all? Two reasons. First, not every tool is GA4. Your own database, a Rails app, an email tool or a consent gated server side setup can read UTM values but cannot decode a gclid. Second, Google's own guidance on manual tagging recommends values that match what auto tagging would report, so the two agree when the gclid cannot be used: source google, medium cpc, campaign set to the Google Ads campaign name, utm_id set to the campaign ID and utm_source_platform set to Google Ads.⁸ Keep auto tagging on and add those parameters in the final URL. It costs nothing, and on the day the gclid fails the visit still has a name.

Worked example: the final URL in Google Ads

Aoife leaves auto tagging on. Her final URL for the autumn sale ad group reads:

https://salthillcandles.example/autumn?utm_source=google&utm_medium=cpc&utm_campaign=autumn_sale_2026&utm_id=aut26&utm_source_platform=Google%20Ads&utm_content=rsa_1&utm_term=soy_candles

In GA4 the Google Ads rows take their names from the linked account, which is what Google says will happen.⁹ In her own Rails database, where she stores the first landing address of every order, the same click is readable without any Google account at all.

What breaks, and how to spot it

Every one of these has cost someone a month of data. In my experience they appear in this order.

Typos in the parameter name. utm_mediun is not a parameter, so GA4 sees no medium and reports "(not set)". Google's own page on that value says it appears for "URLs with incomplete or incorrect parameters" and points you at the URL builder as the fix.¹⁰ A row with a source but a (not set) medium is nearly always a typo, so look for it first.

Inconsistent values. Email, email and e_mail all reach the Email channel, but they are three rows when you look at source and medium, and the campaign totals split with them.⁴⁷ Lowercase and the vocabulary page cure this.

UTM parameters on your own internal links. A banner on your homepage that links to /autumn?utm_source=homepage looks harmless. It is not. GA4 reads the parameters from the page address on every page view, not only the first, so the events after that click carry homepage as their source. In the shops I have worked on the result was always the same: purchases credited to the shop's own banner instead of to the ad that brought the buyer. Never tag a link from one of your pages to another. Use a plain link and, if you need to measure the banner, send an event.

Redirects that drop the parameters. A short link, a redirect from an old address, a jump from http to https, or a "link in bio" tool can all rebuild the address without the part after the question mark. I test every tagged link once on a phone and check that the parameters survive.

Email clients and forwarding. Most email tools wrap links in their own click tracking redirect and pass the parameters through, which is fine. The trouble starts when a reader copies the link out of the email and pastes it into a WhatsApp group. Every click from that group now arrives as newsletter and email, because the tag travels with the address. It is one reason email sometimes looks larger than the list could explain. I write more about that in the piece on dark social.

Consent, and the visits you never see. In Ireland the rule sits in Regulation 5(3) of the ePrivacy Regulations 2011, S.I. No. 336/2011 in full. Nobody may use a network to "store information, or to gain access to information already stored in the terminal equipment of a subscriber or user" unless that person has given consent and has been given "clear and comprehensive information" about the purpose.¹¹ Regulation 5(5) allows two exceptions only: storage for the sole purpose of carrying a communication over the network, and storage "strictly necessary in order to provide an information society service explicitly requested by the subscriber or user".¹¹ The Data Protection Commission (DPC) reads that narrowly. Its guidance on cookies and other tracking technologies asks "Do analytics cookies require consent?" and answers in one word: "Yes."¹² It adds that analytics limited to the site's own aggregated statistics are unlikely to be a priority for enforcement, while analytics carried out by another party "may be considered to represent a greater privacy risk to the user".¹² A standard GA4 setup stores an identifier that follows a person across visits, and the measuring is done by Google, so for a typical shop it sits firmly on the consent side of that line, and the consent has to meet the EU GDPR standard: the DPC says it "requires a clear, affirmative action on the part of the user" and that "Silence or inaction by the user cannot constitute their consent".¹² When a visitor declines, Google says "events are not associated with a persistent user identifier".¹³ GA4 can fill part of the gap with behavioural modelling, but only for properties that collect "at least 1,000 events per day with analytics_storage='denied' for at least 7 days" and have "at least 1,000 daily users sending events with analytics_storage='granted'" on seven of the previous 28 days.¹³ A shop of Aoife's size does not meet that bar. So her GA4 numbers are the consenting share of the truth, and every UTM count in her report is a sample. I wrote about the engineering side of this in event tracking and consent mode and in the guide to server side tracking.

That last point deserves a formula.

$$S_{\text{seen}} = S_{\text{all}} \times c$$

Here $S_{\text{seen}}$ is the number of sessions GA4 reports for a campaign, $S_{\text{all}}$ is the number of visits the campaign actually produced, and $c$ is the share of visitors who accepted analytics cookies. Turn it round and $S_{\text{all}} = S_{\text{seen}} / c$ gives you an estimate of the real figure. The same ratio applies to every campaign if consent behaves the same across them, which is why comparisons between campaigns survive consent far better than absolute counts do. The idea is a plain rate, and the Foundations page covers it under Foundations: ratios and rates.

Worked example: the Monday audit

Aoife opens the traffic acquisition report every Monday and sorts by session source and medium. In the week of 12 October she finds, besides her three clean rows, four more: facebook / paidsocial with 310 sessions, Facebook / paid_social with 88 sessions, newsletter / (not set) with 41 sessions and homepage / banner with 522 sessions. The first two are Seán's early ad sets, from before the vocabulary page, and she fixes the ads. The third is a utm_mediun typo in one footer link, and she fixes the template. The fourth is the internal banner, and she removes the parameters from it. Her consent rate, read from her banner tool, is 61%. So when GA4 shows 2,300 email sessions she writes 2,300 / 0.61, about 3,770, in the real column of her spreadsheet, and does the same for every row. The comparisons do not move. The totals do.

From a label to a credit: how UTMs feed attribution

A UTM tells GA4 where a visit came from. Attribution is the separate question of which visit gets credit for the purchase, and GA4 answers it three times over, at three different scopes.¹⁴

The first user source is the channel that brought a person to the shop for the first time, and it never changes on later visits. The session source is the channel that started this visit, and it is assigned afresh each time a person returns. Both use a last click model that ignores direct visits, and neither is affected by the attribution setting.¹⁴ The event scoped source, the one with no prefix, is the one that credits the purchase itself, and it follows whichever attribution model the property uses.¹⁴

GA4 offers three models. Data driven attribution "distributes credit for the key event based on data for each key event", using the property's own converting and non converting paths. Paid and organic last click gives all the credit to the last channel clicked before the purchase and ignores direct, which is why Google also calls it last non direct click. Google paid channels last click gives everything to the last Google Ads click, if there was one.¹⁵ Direct visits are excluded from credit under every model "unless the path to key event consists entirely of direct visits".¹⁵ Data driven is the default for the event scoped dimensions.¹⁴ The window GA4 looks back through is 30 days for acquisition events such as first_visit and 90 days for everything else, and both can be changed.¹⁶

The labels decide what the paths are made of. If the Meta ad was tagged social instead of paid_social, the data driven model is weighing Organic Social against Email, and it will do so correctly and uselessly. Attribution can only be as clean as the vocabulary feeding it. The same holds for anything you do after GA4, from a BigQuery export to a media mix model, and for a Smart Website that reads the campaign from the address and changes the page to match the ad.

Two more ratios belong next to every campaign row, because a count of sessions tells you nothing about money.

$$\text{ROAS} = \frac{R}{A}, \qquad \text{CPO} = \frac{A}{N}$$

$\text{ROAS}$ is the return on ad spend, $R$ is the revenue GA4 credits to the campaign, $A$ is the amount spent on it, $\text{CPO}$ is the cost per order and $N$ is the number of orders credited. Both are rates in the sense of Foundations: ratios and rates, and both need the revenue figure to come from the same attribution model each time, or a change in the model will look like a change in performance.

Worked example: Salthill Candles, October in the report

Aoife's traffic acquisition report for October, once the vocabulary is in place, in euro. GA4 does not know her spend unless she imports it, so the spend, ROAS and CPO columns are hers, written in from the ad accounts.

Session source / medium	Campaign	Sessions	Purchases	Conversion	Revenue	Spend	ROAS	CPO
google / cpc	autumn_sale_2026	4,200	126	3.0%	€5,418	€1,850	2.93	€14.68
facebook / paid_social	autumn_sale_2026	6,800	102	1.5%	€4,080	€1,400	2.91	€13.73
newsletter / email	autumn_sale_2026	2,300	115	5.0%	€5,290	€90	58.8	€0.78
Total		13,300	343	2.6%	€14,788	€3,340	4.43	€9.74

The arithmetic for the first row: 126 purchases out of 4,200 sessions is 126 / 4,200 = 0.03, so 3.0%. Revenue of €5,418 over spend of €1,850 is 2.93. Spend of €1,850 over 126 orders is €14.68 per order. The €90 on the email row is the monthly fee for her email tool, which is the honest number to put against it.

The horizontal axis lists the three tagged sources, named exactly as GA4 takes them from Aoife's parameters. The height of each bar is the revenue GA4 credits to that source under the session scoped last click view, in euro. The takeaway is that the three channels are closer than their spend suggests: the newsletter, costing €90, brought in almost as much as the search ads at €1,850. That is not a reason to switch the ads off. It is a reason to ask the next question.

The next question is who sent those email buyers in the first place. Aoife switches the report to the event scoped source, which uses the data driven model, and the same 343 purchases redistribute: Google 131, Meta 124, newsletter 88. The newsletter loses 27 orders because a good few of the people who bought from the email had clicked a Meta carousel the week before and had joined the list from the landing page. Nothing about the parameters changed. The model did, and the vocabulary made the comparison possible. Under last click the Meta ads look like the weakest channel. Under data driven they are earning their keep by filling the list that the email then converts. Both views are true. The second one is the one to plan next month on.

Offline, partners and anything without a click

The old version of this article made much of QR codes, and the point stands, with one correction. A QR code is only a link, so it can carry parameters like any other. The medium you choose decides where the visits land. Google's default channel group has no channel for print or offline, so a medium such as qr or print matches no rule and the visits go to Unassigned.⁷ That is not an error, it is honest, and if the row matters you can build a custom channel group in GA4 to name it. The same applies to a partner who links to you from their own site: give them one link with the source set to their name and the medium set to referral, and the visits take their place in the Referral channel without any guesswork.⁷

Worked example: a postcard at the Galway Market

Aoife prints 200 postcards for her Saturday stall at the Galway Market with a QR code. The code opens salthillcandles.example/market with the source market_postcard, the medium print and the campaign autumn_sale_2026. Over October, 164 people scan it and 11 buy, for €473. In the default report the row sits under Unassigned, so she adds a custom channel group with one rule, medium exactly print, named Print. The row now reads Print, 164 sessions, 11 purchases, €473, against €60 of printing. Fair play to her: she knows exactly what a stack of postcards is worth. Very few shops do.

What to do this week

Write the vocabulary page, one side of paper: lowercase, underscores, five mediums chosen from GA4's own patterns, one campaign format with the year in it. Build the first link of each campaign in Google's URL builder and copy the pattern. Leave Google Ads auto tagging on and tag anyway. Remove every UTM from every internal link. Test each link once on a phone. Then read the traffic acquisition report every Monday and delete the rows that should not be there. Attribution gets clean one deleted row at a time, and it stays clean because one person owns one page.

Footnotes

1. Paul Muret, The End of an Era for Urchin Software, Google Analytics Blog, 2012, https://analytics.googleblog.com/2012/01/end-of-era-for-urchin-software.html

2. Google, Google Agrees To Acquire Urchin, Google press release, 28 March 2005, https://googlepress.blogspot.com/2005/03/google-agrees-to-acquire-urchin_28.html

3. Wikipedia, UTM parameters, Wikimedia Foundation, 2026, https://en.wikipedia.org/wiki/UTM_parameters

4. Google, [GA4] Collect campaign data with custom URLs, Google Analytics Help, 2026, https://support.google.com/analytics/answer/10917952

5. Google, Campaign URL Builder, GA Demos and Tools, 2026, https://ga-dev-tools.google/campaign-url-builder/

6. Google, [GA4] About Analytics sessions, Google Analytics Help, 2026, https://support.google.com/analytics/answer/9191807

7. Google, [GA4] Default channel group, Google Analytics Help, 2026, https://support.google.com/analytics/answer/9756891

8. Google, [GA4] How traffic source dimensions are updated, Google Analytics Help, 2026, https://support.google.com/analytics/answer/15593651

9. Google, About auto tagging, Google Ads Help, 2026, https://support.google.com/google-ads/answer/3095550

10. Google, [GA4] What the value (not set) means in your reports, Google Analytics Help, 2026, https://support.google.com/analytics/answer/1009667

11. Government of Ireland, S.I. No. 336/2011, European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, Regulation 5, Irish Statute Book, 2011, https://www.irishstatutebook.ie/eli/2011/si/336/made/en/print

12. Data Protection Commission, Guidance note: Cookies and other tracking technologies, DPC, April 2020, https://www.dataprotection.ie/sites/default/files/uploads/2020-04/Guidance%20note%20on%20cookies%20and%20other%20tracking%20technologies.pdf

13. Google, [GA4] Behavioural modelling for consent mode, Google Analytics Help, 2026, https://support.google.com/analytics/answer/11161109

14. Google, [GA4] Attribution and traffic source dimensions, Google Analytics Help, 2026, https://support.google.com/analytics/answer/11080067

15. Google, [GA4] About attribution models, Google Analytics Help, 2026, https://support.google.com/analytics/answer/10596866

16. Google, [GA4] Attribution settings, Google Analytics Help, 2026, https://support.google.com/analytics/answer/10597962