UTM Parameters Explained, and the 5 Mistakes That Break Them
What each of the five UTM parameters carries, the naming convention that keeps reports from splitting in two, and the five tagging mistakes that corrupt attribution while looking plausible.
Like it ? share it
If Direct is your largest traffic source in Analytics, that is usually not a finding. It is a gap.
Direct is where sessions go when nothing told Analytics where they came from: clicks out of email clients, links opened inside social apps, PDFs, QR codes, anything that arrives without a referrer. The traffic is real. The attribution is missing.
UTM parameters are how you fill the gap: tags on the end of a URL that carry the answer with the click.
https://yoursite.com/?utm_source=newsletter&utm_medium=email&utm_campaign=winter_sale
The five parameters
utm_source is who sent them. google, facebook, newsletter. A name, not a category.
utm_medium is how they got there. cpc, email, social, referral. A category, not a name.
Getting these two the wrong way round is the single most common tagging error, and it corrupts the two dimensions every acquisition report is built on.
utm_campaign is which push this was. summer_sale, black_friday, product_launch.
utm_term is optional, and carries the paid search keyword.
utm_content is optional and more useful than it looks. It distinguishes two links to the same place in the same campaign: header_button against footer_link, or one creative against another. Without it, an A/B test collapses into a single row.
The five mistakes
Analytics is only as good as the data you feed it. Messy tags make the reports built on them worse than useless, because they are wrong in ways that look plausible.
1. Tagging internal links
The mistake. Putting a UTM link on your own homepage banner, pointing at your own product page.
yoursite.com → yoursite.com/product?utm_source=banner
What it does. It overwrites the original source. Someone arrives from Google organic search, clicks the banner, and Analytics now records the session as coming from banner. The credit for the search visit is gone.
Instead. Never use UTMs on internal links. Track internal promotions with click events or GA4's internal promotion reports.
2. Inconsistent capitalisation
The mistake. utm_source=LinkedIn on Monday, utm_source=linkedin on Tuesday.
What it does. GA4 treats them as two different sources, and your LinkedIn numbers are split across two rows that nobody thinks to add together.
Instead. Lowercase, always. Set the convention once and use presets so you are not retyping it.
3. Spaces in values
The mistake. utm_campaign=summer sale.
What it does. The URL breaks when it is pasted into an email client, or survives as summer%20sale and shows up that way in every report from then on.
Instead. Underscores or hyphens: summer_sale or summer-sale. Pick one and stay with it, because these also split into separate rows.
4. Source and medium the wrong way round
The mistake. utm_source=cpc with utm_medium=google.
What it does. It reverses the two dimensions your acquisition reports are built on, so paid search appears as a source called cpc arriving through a channel called google.
Instead. Source is who sent them, medium is how. Google is the source. CPC is the medium.
5. Putting personal data in the tag
The mistake. utm_term=user_john_doe_email@gmail.com.
What it does. Sending personally identifiable information to Google Analytics breaks their terms of service, and the account can be terminated for it. The URL is also visible to anyone who sees the link.
Instead. Track cohorts, not individuals, in anything that goes in a public URL. If you genuinely need a per-user identifier, use an opaque one that means nothing outside your own system.
Write the convention down
Most split data comes from two people tagging the same channel differently over two months, not from one person making a mistake once. A one-page convention covering case, separator, and the allowed medium values prevents more damage than any amount of cleanup afterwards.
Why a builder, rather than typing
Every mistake above is a typing error, and a form catches all of them before the link exists.
The UTM Builder puts source, medium and campaign in separate labelled fields so they cannot swap, enforces lowercase, handles the ? and & separators, and shows you the finished URL as you type. It also checks that the destination actually responds, which is worth doing before a link goes to ten thousand inboxes rather than after.
It runs in your browser. The link is assembled on your machine and nothing you type is sent anywhere.