How UTM Parameters Decide What Google Analytics Calls Your Traffic

Every link you drop in a newsletter, a Facebook post, or a printed QR code lands somewhere — but if you don't tag it, Google Analytics has to guess where it came from. Sometimes it guesses right. More often it files the click under "Direct" or "(not set)" and your launch-day spike turns into a number you can't explain to anyone. UTM parameters are how you stop guessing. They are five plain-text labels you bolt onto the end of a URL, and they tell the analytics engine exactly which campaign, channel, and source earned that visit.

This guide walks through what each parameter actually controls, how Google Analytics 4 reads them, and the naming discipline that keeps your reports from splintering into dozens of near-duplicate rows. You can build and verify the links as you read using the UTM Link Builder.

The five parameters, and what each one really means

UTM stands for Urchin Tracking Module — a holdover from the analytics company Google bought back in 2005. The name is ancient; the mechanism still works. There are five classic parameters:

utm_source — the specific place the click came from. A named referrer: newsletter, facebook, partner_blog, poster_subway_l1. If you wrote the link for one specific publication or one specific placement, that identity belongs here.
utm_medium — the category of channel. email, social, cpc, referral, qrcode. This is the bucket the source falls into.
utm_campaign — the marketing effort the link belongs to, like spring-sale-2026 or v2-launch.
utm_term — paid-search keyword, mostly used in ad platforms.
utm_content — a tiebreaker to A/B test variants of the same link: header-cta versus footer-cta.

The distinction that trips people up most is source versus medium. Here is the rule I keep coming back to: utm_source identifies the referrer — the one named origin of the click. The newsletter is a source. Email is the medium. Facebook is a source. Social is the medium. If you can only fill one in confidently, fill in the source, because that's the level GA4 reports at most granularly.

How Google Analytics 4 attributes the traffic

When someone clicks a tagged link, GA4 reads the query string on the landing page, pulls out the utm_* values, and stamps the session with a source/medium pair. You find it under Reports → Acquisition → Traffic acquisition, where channels group by medium first and then break out by source.

GA4 honors the same five classic parameters as the old Universal Analytics, plus a sixth — utm_id — that ties a click back to a campaign record defined in Google Ads, so it can join budget and bid data server-side. If you aren't running paid Google campaigns, leave utm_id blank.

Two attribution facts worth internalizing. First, there's a reporting delay: full attribution batches over 24 to 48 hours, so don't panic when a brand-new link isn't in the standard reports yet — check the realtime view, where it should appear within about a minute. Second, UTM values are case-sensitive. Facebook and facebook are two different sources to GA4. One stray capital letter, and a single channel splits into two rows that never reconcile.

A worked example: one launch link, end to end

Say you're shipping version 2 of a product on a Monday and you want the landing page tracked when it goes out in your email list. Start with the clean base URL:

https://toolora.info/en/t/utm-builder/

Add the campaign tracking, and the finished link looks like this:

https://toolora.info/en/t/utm-builder/?utm_source=newsletter&utm_medium=email&utm_campaign=v2-launch-jun&utm_content=header-cta

Read it left to right: the click came from the newsletter (source), which is an email channel (medium), as part of the v2-launch-jun campaign, and specifically from the header-cta placement (content) so you can compare it against the footer link later. When a subscriber clicks, GA4 records newsletter / email and files it under your v2 launch. If you also post the same page on Facebook with utm_source=facebook&utm_medium=social, GA4 keeps the two channels in separate rows instead of merging them into one unattributable blob.

Notice the link has no spaces and no capital letters. That's deliberate. A space becomes %20 when the browser encodes the URL, which renders as an ugly string in Slack and breaks parameters in some email clients. Keep values lowercase, hyphenated, and ASCII. If you ever need to encode or decode a value by hand to see what a browser will actually send, the URL Encoder shows you the exact transformation.

Naming conventions are the whole game

The mechanics of UTM are simple. The discipline is where teams win or lose. Inconsistent naming is the single most common reason a clean dataset turns into noise, and GA4 will not clean it up for you — whatever you type is what it stores.

A few conventions that pay off:

Lowercase, always. email, never Email, never e-mail. Pick one spelling per concept and freeze it.
Hyphens or underscores, never spaces. summer-sale-2026 reads cleanly in every report and survives every email client.
A fixed vocabulary for mediums. Decide that paid is cpc, organic social is social, owned email is email, and offline scan codes are qrcode — then never improvise a synonym. The moment someone invents e-mail or paid-social, your channel grouping fractures.
Put placements in the source, not the campaign. A subway poster is utm_source=poster_subway_l1; a bus shelter is utm_source=poster_bus_shelter. Same utm_medium=qrcode, same campaign — and now you can tell which physical placement actually drove scans.

A common trap I've watched bite small teams: tagging internal links between your own pages. If a user clicks a UTM-stamped link from one of your pages to another, GA4 resets the session and double-counts the visitor. Only tag external entry points — ads, emails, social posts, printed codes. Never the navigation inside your own site.

How I actually run this in practice

When I'm prepping a multi-channel push, I no longer hand-type the query string — I made that mistake exactly once, shipped a utm_campaign=spring_sale on one link and spring-sale on another, and spent a Friday afternoon merging two reporting rows that should have been one. Now I draft the campaign name once, generate every channel variant from a single base URL in batch mode, and eyeball the parameter table before anything goes out. For anything physical — a poster, packaging, a business card — I generate the link, confirm it scans, and only then send the asset to print. The thirty seconds of verification has saved me from a printed QR pointing at a stale URL more than once.

The builder keeps my last several links in local storage, so when Thursday's follow-up needs Tuesday's link with one value swapped, I reload it and change a single field instead of digging through old drafts. That's the whole pitch: build it once, name it consistently, verify it before it ships, and let Google Analytics tell you a story you can actually trust.

Made by Toolora · Updated 2026-06-13