UTM parameters: the reference

A chunk of your paid traffic is sitting in (direct) / (none), and you know those visitors came from a campaign. The tags that were supposed to say so, the UTM parameters, either weren't there or broke on the way. UTM parameters are the query-string tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content, plus utm_id and utm_source_platform) that GA4 reads to attribute a session to the campaign that drove it. Source, medium, and campaign carry the attribution; the rest add detail.

This page is a lookup reference, not an essay: the parameter table, the anatomy of a tagged URL, what GA4 does with each field, the precedence rules against Google Ads auto-tagging, and the failure-case registry, the ways tags silently break that you only discover when a channel's numbers stop making sense. UTM values are also match keys: Buron's datasets match spend to sessions on exactly these fields, which is why every failure case below is one we've seen in real client data, not hypothesized.

#The parameter table

The table is the page. Seven parameters, what each answers, and where it lands in GA4 (per Google's custom-URL documentation):

Parameter	Answers	GA4 dimension (session-scoped)	Required	Value guidance
`utm_source`	Where did the click come from?	Session source	Yes	A referrer you'd recognize: `google`, `newsletter`, `linkedin`, `partner-site`. Never a campaign name.
`utm_medium`	What kind of channel?	Session medium	Effectively yes: without it, channel grouping degrades	From the controlled list your channel groups expect: `cpc`, `paid_social`, `email`, `referral`, `organic_social`. Inventing media breaks channel grouping (see the registry).
`utm_campaign`	Which campaign?	Session campaign	For any paid or planned send	Your campaign name, ideally from a naming convention, not improvised per link (utm naming conventions).
`utm_term`	Which keyword?	Session manual term	No	Paid-search keyword. Rarely useful outside search; leave it off rather than repurpose it.
`utm_content`	Which ad, link, or variant?	Session manual ad content	No	Distinguishes two links in one email or two creatives in one ad set: `header-cta`, `variant-b`.
`utm_id`	Which campaign ID?	Session campaign ID	Only for cost-data import	Stable ID rather than display name; the match key for cost-data import.
`utm_source_platform`	Which buying platform dispatched it?	Session source platform	No	E.g. `Google Ads`, `Manual`. Mostly set by platforms themselves.

First-user-scoped twins exist for every dimension above (First user source, First user medium, …): GA4 stores the campaign that acquired the user separately from the campaign that drove each session. When a report looks "wrong," check which scope you're reading first.

#Anatomy of a tagged URL

One ?, then key=value pairs joined by &. That's the whole grammar:

https://example.com/pricing
  ?utm_source=newsletter
  &utm_medium=email
  &utm_campaign=june-launch
  &utm_content=header-cta

Build rules that prevent 90% of breakage:

The first parameter follows ?, every later one follows &. A second ? in one URL produces a malformed query string; if your page URL already contains ?, append UTMs with &.
Lowercase everything. Values are case-sensitive downstream: the single biggest self-inflicted failure (registry, below).
No spaces. Use dashes or underscores; a space becomes %20 and "june launch" and "june-launch" become different campaigns.
Tag the final destination URL, after any shortener or redirect, not the URL that redirects to it.

Hand-building is fine for one link. For a team, an enforcing builder beats discipline. That's what our utm builder is for: it validates values against your naming scheme instead of just concatenating strings.

#What GA4 does with them

GA4 reads UTMs once, at the session's first event, and three things happen:

Dimension mapping. Each parameter populates its session-scoped dimension from the table above, plus the first-user twin if this session acquired the user.
Channel grouping. GA4 derives the Default Channel Group from source/medium/campaign combinations against fixed rules: cpc maps to Paid Search or Paid Social depending on source, email maps to Email, and an unrecognized medium like paidsocial (no underscore) falls into Unassigned. You don't get to invent media and keep clean channel reports.
Session attribution. The session's traffic source feeds attribution for every conversion in it. A mid-session UTM click on an internal link starts this logic over, which is why you never tag your own internal links (registry, below).

#UTMs vs auto-tagging: gclid wins, and that's correct

For Google Ads traffic, auto-tagging's GCLID, not your UTMs, should carry the attribution. Auto-tagging appends a gclid parameter to every ad click (Google Ads auto-tagging doc); GA4 resolves it to campaign, ad group, keyword, and creative with more precision than five UTM fields can encode, and the same GCLID powers offline conversion imports and cross-platform matching (Click IDs: what gclid, fbclid, and wbraid do covers the whole click-ID family).

The precedence rules (per Google's manual- vs auto-tagging documentation): with auto-tagging on, GA4 uses the GCLID and ignores coexisting UTMs by default. A property-level override lets manual tags win; leave it off unless you have a specific migration reason. The practical rule: don't put UTMs on Google Ads final URLs at all. You'll either be ignored (harmless clutter) or, with the override on, you'll overwrite precise data with coarse data.

Everywhere Google's auto-tagging doesn't reach (Meta, LinkedIn, email, partners, podcasts), UTMs are the only attribution you get. Tag all of it.

#The failure-case registry

Every entry here produces the same symptom, a channel under-reporting while (direct) or Unassigned grows, with a different root cause. Each block: what happens, how to spot it, the fix.

#Case sensitivity splits your campaigns

utm_campaign=June-Launch and utm_campaign=june-launch are two campaigns to GA4: values are matched exactly, not case-folded. The symptom is a campaign reporting at half its real volume, with a near-duplicate row holding the other half. It's the single most common naming problem we see. A representative case (illustrative numbers): one campaign tagged three ways, June-Launch, june-launch, and JUNE-LAUNCH, splitting its volume roughly 60/30/10. The "biggest" row underreports the real campaign by 40%, and every tool reading the tags treats the three as unrelated. Fix: lowercase-only as a hard convention, enforced at link-build time, and a scheduled report that flags case-insensitive duplicate values.

#Redirects and shorteners strip the query string

Link shorteners, www/https canonicalization redirects, and "clean URL" middleware can all drop everything after ?. The tag was on the link; it never reached the page. Spot it by clicking your own tagged link and reading the final URL bar. If the UTMs are gone, something in the chain ate them. Fix: tag the final URL, test the full chain after any infrastructure change, and treat a sudden (direct) spike from one channel as a redirect regression until proven otherwise.

#fbclid and friends pile on after your UTMs

Meta appends ?fbclid=... to outbound clicks, after and independent of your UTMs. Three real consequences: URL-matching rules that expect an exact query string stop matching; naive URL-dedup in reporting treats every click as a unique landing page; and hand-built links that already end in ? get malformed when a platform appends with a second ?. The click ID itself is valuable (it's a measurement match key, not junk, per Click IDs: what gclid, fbclid, and wbraid do), so the fix is making your systems tolerant of appended parameters, not stripping them.

#Tagging your own internal links resets the session

A UTM-tagged link from your homepage to your pricing page tells GA4 "new traffic source", and the original source that actually earned the visit is overwritten mid-session. Symptom: campaigns named after internal banners absorbing conversions that belonged to paid channels. Fix: UTMs on inbound links only, never on links between your own pages; use event parameters for internal promotion measurement.

#`(not set)` means half a tag

Tagging utm_campaign without utm_source, or a typo like utm_source = with a stray space, produces sessions where some campaign dimensions are populated and others read (not set). GA4 requires utm_source for the manual-tagging set to register cleanly. Fix: never ship a partial tag (source and medium minimum, campaign for anything planned), which is exactly the class of error a validating builder refuses to emit.

#Consistent values are the actual game

The syntax above is table stakes; the compounding value is a controlled vocabulary: one spelling of every source, a fixed list of media, campaign names that parse. That's a naming system, and it's bigger than this reference: utm naming conventions is the system we run, and campaign naming convention reference is the copy-pasteable spec. Because UTM values are the match keys between your spend data and your analytics, inconsistency isn't cosmetic: it's data that won't line up. Buron matches your ad spend to sessions and conversions on these exact fields in your warehouse, which makes tagging hygiene one of the first things its audits check, and a broken match one of the standard causes when platform and analytics numbers diverge (Why your GA4 and Google Ads conversions don't match).

This reference is maintained as GA4's parameter handling changes: parameter list, dimension mapping, and precedence rules verified against a live property, with the registry growing as we hit new failure cases in client data.

Frequently asked questions

What are the 5 standard UTM parameters?

utm_source (where the traffic came from: google, newsletter, linkedin), utm_medium (the channel type: cpc, email, social), utm_campaign (the campaign name), utm_term (the paid keyword), and utm_content (which ad or link variant). GA4 also reads utm_id and utm_source_platform. Source is required; source, medium, and campaign together drive attribution.

What does UTM stand for?

Urchin Tracking Module. Urchin was the analytics product Google acquired in 2005 and turned into Google Analytics. The name survived; the mechanism is unchanged: query-string parameters appended to a URL that tell analytics where a visit came from. GA4 still reads the same utm_ parameters Urchin defined.

Put an operator on your channels