The Ultimate Guide to UTM Parameters: 2026 Edition

UTM stands for Urchin Tracking Module, the analytics company Google acquired in 2005 to build what became Google Analytics. The naming convention stuck. Today, UTM parameters are tags appended to a URL's query string that tell your analytics platform exactly where a visitor came from.

Without UTMs, GA4 sees a visitor arriving at yourcompany.com/pricing and shrugs. It might guess at the source via HTTP Referer headers, but referrers are stripped by most modern browsers, half of Apple's ecosystem, every dark-social channel (Slack, WhatsApp, email clients), and every native mobile app. So you end up with 50%+ of paid-campaign traffic landing in "(direct)" and an attribution model that systematically underreports the channels you're actually paying for.

UTMs fix that. Append them to any campaign URL and the visit becomes attributable forever, regardless of which channel ate the referrer.

The anatomy of a UTM-tagged URL

A typical UTM-tagged URL looks like this:

https://yoursite.com/pricing?utm_source=newsletter&utm_medium=email&utm_campaign=q2-launch

The base URL is your destination. Everything after the ? is the query string. Each utm_* parameter is a separate value that GA4 reads into its source/medium/campaign columns. Order doesn't matter; analytics platforms parse them by name.

There are five standard UTM parameters. Only three are required for GA4 to record a session as "campaign traffic"; the other two are optional but valuable for specific use cases.

source vs medium, the confusion that breaks everything

This is the single most common mistake we see in audits. People mix up what goes in utm_source vs utm_medium, and the data becomes uninterpretable.

Here's the simple rule: medium is the channel type, source is the specific origin within that channel.

• You send an email → utm_medium=email, utm_source=newsletter-weekly (the specific newsletter)
• You run a Google Ads campaign → utm_medium=cpc, utm_source=google
• You post on LinkedIn → utm_medium=social, utm_source=linkedin
• You sponsor a podcast → utm_medium=podcast, utm_source=lenny-rachitsky

If you can't articulate the difference between source and medium for a given campaign, the campaign is being tagged wrong. Stop, decide what each layer means in your business, write it down.

The most expensive UTM mistake is inconsistent naming. "Facebook", "facebook", and "FB" become three different sources in GA4. Your weekly traffic report shows 33% lower numbers per channel than reality because the data is split across rows that look like duplicates but aren't.

A naming convention solves this. Pick one, document it, get everyone on the team to follow it.

The 4 rules that fix 90% of UTM data quality issues

1. Lowercase everything. UTMs are case-sensitive in GA4. Newsletter and newsletter are different sources. Always lowercase.
2. Use hyphens, never spaces or underscores. Spaces get URL-encoded to %20 in the parameter (ugly, breaks in some platforms). Underscores work but are inconsistent. Hyphens are cleanest. spring-sale-2026, not spring sale 2026 or spring_sale_2026.
3. Be specific but concise. utm_source=newsletter is too vague if you have 5 newsletters. utm_source=weekly-product-update is better. But don't go to utm_source=weekly-product-update-march-15-edition, that's data per-send, not per-channel.
4. Stick to the same vocabulary forever. Once utm_medium=email, never switch to utm_medium=e-mail. Build a UTM dictionary (10 lines in a Google Doc) and link to it in your team onboarding.

A starter UTM dictionary

If you're starting from scratch, copy this and adapt it:

After auditing hundreds of GA4 accounts, the same handful of mistakes show up everywhere. Avoiding these alone makes your data 2-3x more useful.

1. UTMing your own internal links

This is the cardinal sin. If a visitor arrives via ?utm_source=newsletter&utm_medium=email and then clicks a UTM-tagged button on your site, GA4 ends their session and starts a new one, with the new UTM as the source. The original newsletter attribution disappears.

2. Including PII in UTM values

Don't put email addresses, names, or user IDs in UTM parameters. They're logged in plain text in your analytics, sent in browser Referer headers to every third-party domain you link to, and frequently end up in server logs that your security team can't audit.

3. UTMing inside platforms that already have native attribution

Facebook Ads, Google Ads, and LinkedIn Ads all auto-tag URLs with their own click IDs (fbclid, gclid, li_fat_id). Adding manual UTMs on top is usually fine, but if the platform's auto-tagging is enabled, you can end up with conflicting data. Either let auto-tagging do its job, or override it consistently, never half-and-half.

4. Over-granularizing the campaign value

If you create a unique utm_campaign per email send, you'll have hundreds of campaigns by year-end and zero ability to roll them up by initiative. Group sends into campaigns: q2-product-launch covers every email, ad, and post related to that launch.

5. Not tagging dark-social and offline channels

If you give a customer a printed business card with yoursite.com and they later visit, GA4 records "(direct)". Use branded short links with UTMs baked in (e.g. WhatsApp short links with UTMs) for any non-web channel, print, podcast ads, video, conference badges. Branded short links make tagged URLs short enough to share.

Hand-writing UTM parameters into every URL doesn't scale. A 7-word destination URL becomes a 240-character monster with full UTMs attached, too long to fit on a business card, looks spammy in tweets, breaks when copied into iMessage.

This is where branded short links change the game. Tools like Flyn let you create a clean flyn.to/q2-launch URL that redirects to your full UTM-tagged destination. The visitor sees the short link; analytics receives the full UTM payload.

How automated UTM tagging works in Flyn

In the Flyn dashboard, when you create a short link you can fill in the UTM fields directly. Flyn appends them to the destination URL behind the scenes. From the API, you pass UTMs as fields:

POST /api/links { destination: "https://yoursite.com/pricing", utm_source: "newsletter", utm_medium: "email", utm_campaign: "q2-launch" }

You get back flyn.to/q2-launch. Every click hits GA4 with the full UTM string. Every click also lands in Flyn's click analytics, so you have two independent attribution sources cross-checking each other, which is invaluable when GA4 inevitably loses 20-30% of mobile attribution to ITP/cookie restrictions.

Workflow: from campaign brief to live tagged URL in 60 seconds

1. Open flyn.to/utm-builder
2. Paste your destination URL
3. Fill source / medium / campaign (the form blocks invalid values like uppercase or spaces)
4. Copy the resulting URL OR click "Shorten" to wrap it in a branded short link
5. Drop the short link into your email, ad, post, or print piece

GA4 surfaces UTM data in two main places, and they answer slightly different questions.

Acquisition → Traffic Acquisition

This is the report you'll live in. It groups sessions by source/medium and shows engagement metrics (engagement rate, session duration), conversions, and revenue per group. Use it to answer "which channel is driving the most engaged sessions right now?"

Acquisition → User Acquisition

Same dimensions, but grouped by first-touch user. Use it for "where did our paying customers originally come from?", the answer might differ wildly from last-touch.

Exploration → Free-form for custom analysis

For anything beyond the canned reports, build an Exploration. Drag Session source / medium as the row, Sessions and Key events as the values, and filter by date range. Add Campaign as a second row to break down by initiative.

For campaigns running across email, paid social, organic social, podcast, and display simultaneously, a robust UTM strategy lets you compare channel performance in one analytics view and in your link analytics tool.

The 3-layer pattern that works at scale

Use this structure for every multi-channel initiative:

• Campaign (top layer): same across all channels for the same initiative. Example: q2-product-launch
• Source + Medium (middle): varies per channel. Example: (email, newsletter-weekly) on one channel, (linkedin, paid-social) on another
• Content (bottom): varies per creative variant within a channel. Example: hero-image-v1 vs hero-image-v2 for the same LinkedIn ad in two variants

This gives you three layers of aggregation:

1. Roll up to utm_campaign for total initiative performance ("Did Q2 launch hit its number?")
2. Break down by source+medium for channel ROAS ("Which channel converted best?")
3. Drill into utm_content for creative testing ("Did the orange CTA outperform blue?")

Tagging the dark-social long tail

The biggest blind spot in modern attribution is dark social, Slack, WhatsApp, iMessage, email forwards, podcast mentions. These don't pass referrers, and the visitor lands in "(direct)" by default.

The fix: every link you create for non-web distribution should be UTM-tagged and shortened. Put a UTM-tagged Flyn short link in your podcast outro, in your Slack community pinned post, in your email signature. When someone shares it, the UTMs ride along, and the attribution chain stays intact.

The teams with the cleanest GA4 reports don't have smarter analytics. They just have better link hygiene at the source, every campaign URL tagged, every URL shortened through one branded domain, one naming convention enforced for years.

Combining link analytics with GA4

One pattern we see at high-performing growth teams: they trust their link-shortener's click data over GA4's session data for top-of-funnel attribution, then trust GA4 for downstream conversion. The reason is that click data is captured at the redirect layer, before any browser cookie restriction or tracking-prevention extension kicks in. GA4 sees fewer sessions because Safari ITP, Firefox ETP, and adblockers all suppress GA4's beacon. Flyn click counts don't have that problem.

Putting UTMs to work in a specific tool? Follow the step-by-step recipes for Google Analytics 4, Mailchimp, and Klaviyo, each with the exact parameter convention for that platform. For the layer above tagging, deciding what your placements even are and joining a click to an order, see how to track which posts drive sales.