UTM Attribution

/

UTM stands for Urchin Tracking Module, and it is not really a technology at all but a pattern, a naming convention for URL parameters that virtually every analytics platform on earth has agreed to recognize.

There is no UTM specification body, no API, no library to install. You append a few query string parameters to any link pointing at your site, and whatever analytics software is listening on the other end reads them and attributes the visit accordingly. That simplicity is exactly why the pattern has survived for over two decades, and also why it can turn into a mess without some discipline. This post covers what each parameter is for, how the data flows through your analytics stack, and the practices that keep years of attribution data clean instead of convoluted.

The Parameters

A fully tagged URL looks like this:

https://example.com/landing-page/
  ?utm_source=linkedin
  &utm_medium=social
  &utm_campaign=q4-launch
  &utm_content=profile-link

Here is each parameter and what actually belongs in it:

  • utm_source (required) – Where the click physically came from. Use the platform or referrer identity: google, linkedin, newsletter, clutch. This should answer “what site or app was the person on when they clicked?”
  • utm_medium (required) – The channel type, not the platform. Stick to a small controlled set: cpc for paid clicks, email, social, referral, display. GA4 maps medium values to its default channel groups, so inventing creative mediums actively breaks your channel reports.
  • utm_campaign – The specific initiative or promotion: q4-launch, black-friday-2026, webinar-series. This is where your internal campaign naming convention lives.
  • utm_term – Originally the paid search keyword. Outside of search campaigns it is mostly useful for audience or targeting identifiers.
  • utm_content – The differentiator within a campaign: which ad variant, which button, which placement. hero-cta vs footer-link, or creative IDs for A/B testing.
  • utm_id – A campaign ID for joining against external systems, useful when your campaign names are human-readable but your ad platform or data warehouse keys on IDs.

GA4 also recognizes three newer additions (utm_source_platform, utm_creative_format and utm_marketing_tactic), but support outside Google’s ecosystem is thin, so treat the six above as the universal set.

How the Data Flows

UTM parameters sit at the top of the attribution food chain. As I covered in Google Analytics Attribution & Traffic Source, GA4 assigns a session’s traffic source through a priority system, and UTM parameters win outright: if they are present in the URL, they take precedence over referrer detection, auto-tagging and everything else. That post walks through how the values land in BigQuery’s collected_traffic_source and session_traffic_source_last_click records if you want to see the plumbing, but the practical takeaway is simple: when you tag a link with UTMs, you are not hoping the analytics platform figures out where the visit came from, you are telling it. That certainty is the entire value proposition, and it is why the best practice is to never leave an external link’s attribution to referrer guesswork when you control the link.

A Short History

The “Urchin” in the name is Urchin Software Corporation, a web analytics company whose Urchin product analyzed server logs and, later, JavaScript-tagged pageviews. Urchin introduced these parameters so its customers could label inbound campaign links, and the utm_ prefix was simply its product’s namespace.
Google acquired Urchin in 2005 and rebuilt the product into Google Analytics, keeping the parameter names intact (the original GA tracking script was called urchin.js, and the long-running __utma family of cookies carried the same lineage). Because Google Analytics became the default analytics tool for most of the web, every competing platform had an incentive to read the same parameters rather than invent their own, and a vendor’s internal naming convention quietly became a universal standard.

Universal Recognition

This is the part that makes UTMs worth the effort: nearly every analytics and marketing platform parses them natively, with no configuration. Google Analytics 4 reads them as its highest-priority source data. HubSpot captures them on contact records and threads them through its attribution reports. Mixpanel stores them as user and event properties for funnel analysis. Beyond those three:

  • Adobe Analytics maps them into campaign and channel processing rules
  • Matomo reads them out of the box as campaign parameters
  • Amplitude attaches them to users and sessions automatically
  • Segment captures them into context.campaign and forwards them to every connected destination
  • Salesforce Marketing Cloud and Marketo use them for campaign influence and lead source tracking
  • Plausible and Fathom, the privacy-focused tools, parse them despite rejecting most other tracking

Tag a link once and every tool in your stack gets the same answer about where the visit came from. No other attribution mechanism offers that.

Best Practices

Tag every link you place outside your own site, paid or not. UTMs are commonly treated as an ads-only concern, and that leaves a lot of attribution on the table. Any link you have deliberately placed on an external property sends traffic you should want to identify. On kevinleary.net, for example, the website link on my LinkedIn profile carries UTM parameters, and so does the profile link on Clutch.co. Neither is paid placement, but both send real visitors, and without tags those visits would blur into generic referral traffic (or Direct, when an app strips the referrer). Tagging them costs nothing and permanently answers the question of what those profiles actually produce.

Never tag internal links. A UTM-tagged link from one page of your site to another restarts the session’s attribution and overwrites the real source with your own. UTMs are for inbound links from external properties only.

Keep values lowercase, hyphenated and boring. Analytics platforms are case-sensitive: LinkedIn, linkedin and Linkedin are three different sources in your reports. Lowercase everything, use hyphens instead of spaces, and prefer the platform’s canonical name over abbreviations.

Keep utm_medium to a fixed vocabulary. Source can grow as new platforms appear, but medium should be a closed list that maps cleanly to your channel definitions.

Why a Strict Pattern Matters

The freeform nature of UTMs is their biggest strength and their biggest liability. Nothing validates the values, nothing rejects a typo, and every value ever used lives in your data forever.
I have worked with organizations that moved from ad agency to ad agency over the years, and every agency arrived with its own UTM house style. One tagged paid social as LinkedIn with a capital L, the next used linkedin, another wrote Facebook while its successor used meta and the one after that used fb. Individually each choice is defensible, but stack up several years of data and your attribution reports now need a translation layer just to answer “how much traffic did paid social send?” You can normalize it downstream, and I usually do exactly that in BigQuery with mapping tables and lowercase casts, but normalization is a patch over a governance problem. It is far cleaner to manage the values at the point of creation than to repair them in every report that follows.

The fix is ownership. Someone internal should dictate the allowed values and audit what agencies actually ship, because the moment taxonomy enforcement is left to whoever builds the campaign, drift is guaranteed. The honest difficulty is that UTMs are freeform, so you cannot technically prevent a rogue value, and nobody can monitor every link an agency creates by hand.
The most effective ask I have found is this: require your agency to use a tracking template for everything, with no individually defined tracking URLs, and hand them a rigid written guide for the values the template allows. Ad platforms support account and campaign-level tracking templates precisely so parameters are assembled from structured fields instead of typed by hand into each ad. With templates in place, auditing stops being “check every URL” and becomes “check the template,” which you can actually do. You should still spot-check live ads and query your own data for new unexpected values now and then, but a template plus a written standard plus an internal owner is realistically the best control you can put on a system that was never designed to enforce anything.