Learn about UTM parameters
UTM parameters (Urchin Tracking Module) are query-string tags appended to URLs. They tell your analytics platform exactly where traffic came from, through which channel, and from which campaign. UTM tracking is the foundation of campaign attribution — without it, you’re flying blind.
Originally developed by Urchin Software (acquired by Google in 2005), UTM parameters are now an open web standard recognized by virtually every analytics tool — including privacy-first alternatives to Google Analytics that don’t require cookies.
How UTM parameters work: When someone clicks a UTM-tagged link, the analytics tool reads the query-string parameters on page load and attributes the visit accordingly. Unlike cookies or fingerprinting, UTM parameters are fully transparent — the user can see them in the URL bar, and they carry zero privacy risk.
Key insight: UTM parameters themselves are completely privacy-friendly. They don’t set cookies, don’t collect personal data, and work identically whether you use Plausible, Fathom, Matomo, or GA4. This makes them the ideal tracking mechanism for teams that have migrated away from Google Analytics or are building a privacy-compliant analytics setup.
Whether you’re running paid search campaigns, sending email newsletters, posting on social media, or printing QR codes on flyers, UTM parameters give you consistent, reliable attribution data across every channel.
Not sure whether your analytics setup needs cookie consent? UTM parameters work the same regardless — they’re parsed from the URL, not from cookies.
The five standard UTM parameters cover the full attribution picture: where, how, why, what keywords, and which variation. The first three are required; the last two are optional.
| Parameter | Required | Purpose | Examples |
|---|---|---|---|
utm_source | Yes | Traffic origin — the platform, website, or advertiser sending you traffic | google, facebook, newsletter, telegram, linkedin, partner_blog |
utm_medium | Yes | Marketing channel — the type of link or mechanism (aligns with channel groupings) | cpc, social, email, referral, display, print, video, affiliate |
utm_campaign | Yes | Campaign name — the specific promotion, sale, or content initiative | spring_sale, product_launch, weekly_digest, black_friday_2026 |
utm_term | No | Paid search keywords — the search query that triggered the ad | running+shoes, analytics+tools, privacy+analytics |
utm_content | No | Creative variation — used for A/B testing different ads, CTAs, or link placements | header_cta, sidebar_banner, blue_button, version_b |
Pro tip: Google also introduced utm_id as a sixth parameter for data import workflows, but it’s rarely needed outside GA4. Privacy-first tools like Plausible, Fathom, and Matomo don’t use it.
Naming convention matters. Before building your first UTM link, define a standardized naming convention for your team. Decide whether you’ll use facebook or fb, paid_social or paidsocial. Consistency prevents fragmented reports. Document your convention and share it with everyone who creates campaign links.
Following these best practices will keep your UTM data clean, consistent, and actionable across all analytics platforms — whether you’re using a self-hosted or cloud analytics solution.
✓ Always use lowercase
UTM params are case-sensitive. Facebook ≠ facebook in reports. This builder enforces lowercase by default to prevent data fragmentation.
✗ Never tag internal links
Internal UTMs overwrite the original traffic source and start a new session. A visitor from Google would appear as coming from your promo page instead. This tool warns you if it detects an internal URL.
✓ Stick to a naming convention
Decide on fb vs facebook once and document it. Create a shared spreadsheet or use a naming guide. Inconsistency fragments data across dozens of entries in reports.
✗ Never include PII
No emails, names, user IDs, or any personal data. UTM values are visible in the URL bar and logged by every analytics tool. Under GDPR, this could constitute a violation.
✓ Use underscores or hyphens
Replace spaces with _ or - for clean, readable values. Spaces get URL-encoded as %20, making URLs harder to read and debug.
✗ Don’t over-tag
The 3 required params (source, medium, campaign) cover most use cases. Add utm_content only for A/B testing; use utm_term only for paid search keywords.
✓ Shorten URLs for sharing
UTM-tagged URLs get long. Use a URL shortener for social media, print, or QR codes. The UTM data still works after redirects.
✗ Don’t tag organic search
Never add UTMs to pages that appear in search results. Search engines pass source data automatically. Adding UTMs to SEO pages can create canonicalization issues.
For cookieless attribution models, UTM parameters are even more critical — they’re often the primary signal for campaign-level attribution when cookies aren’t available.
Email Newsletter
Track which email drives clicks
medium: email
campaign: weekly_digest
Facebook Ads
Measure paid social performance
medium: paid_social
campaign: spring_promo
Google Search Ads
Track PPC with keyword detail
medium: cpc
term: analytics+tools
Telegram Channel
Attribute traffic from posts
medium: social
campaign: channel_post
QR Code / Print
Bridge offline to online tracking
medium: print
campaign: expo_berlin
Affiliate Partner
Track partner contributions
medium: referral
campaign: q1_collab
Yes. Plausible, Fathom, Matomo, Simple Analytics, and virtually every analytics platform automatically parse UTM parameters. Because UTMs are just URL query strings, they need no cookies or client-side tracking to capture. In fact, UTM parameters are the preferred attribution method for privacy-first tools that don’t rely on cookies.
No. UTMs don’t set cookies themselves. However, the analytics tool processing them might. With cookieless platforms like Plausible or Fathom, no consent is needed at all. If you’re using GA4 in the EU, you’ll need a consent banner regardless of UTM usage — but the UTMs themselves are privacy-neutral.
No direct impact. Google’s John Mueller has confirmed that search engines strip UTM parameters before indexing. To be safe, ensure your site uses rel="canonical" tags pointing to the clean URL (without UTMs). Most CMS platforms and analytics tools handle this automatically.
Clicking an internal UTM link starts a new session and overwrites the original source. A visitor from Google would suddenly appear as coming from your internal promo — destroying attribution data. Use event tracking or content grouping for internal navigation analysis instead. If you need to audit your current setup, check our GA4 privacy audit guide.
Yes. utm_source=Facebook and utm_source=facebook are tracked as separate sources in every analytics tool. This builder enforces lowercase by default to prevent data fragmentation. If you’ve already collected mixed-case data, most analytics tools let you create filters or regex-based groups to merge them.
At minimum, always use the three required: utm_source, utm_medium, and utm_campaign. Add utm_content when you need to differentiate between multiple links within the same campaign (A/B testing, multiple CTAs). Use utm_term for paid search keyword-level tracking.
In a cookieless attribution model, UTM parameters become your primary campaign-level signal. Unlike cookies that track users across sessions, UTMs identify the traffic source on each individual page view. Privacy-first tools like Plausible attribute conversions by matching the UTM from the landing page to the conversion event within the same visit.
Absolutely. During migration from Google Analytics, consistent UTM tagging ensures your campaign data remains comparable across both platforms. If you run analytics in parallel during migration, UTMs let you verify that both tools attribute traffic the same way.
UTM parameters by themselves don’t collect personal data and are fully GDPR-compliant. However, never put personally identifiable information (emails, names, user IDs) into UTM values — they’re visible in URLs, browser history, and analytics dashboards. Under the EU Digital Omnibus directive, the focus is shifting toward simpler consent requirements, but UTMs remain privacy-safe regardless.
They all describe paid search traffic, but cpc (cost per click) is the industry standard used by Google’s own auto-tagging. Use cpc for consistency. Avoid creating synonyms like ppc, paid_search, or paid-search — they’ll split your data into separate line items in reports.
What Are UTM Parameters?
UTM parameters (Urchin Tracking Module) are standardized query-string tags you append to any URL to tell your analytics platform exactly where traffic came from. They were invented by Urchin Software Corporation, a web analytics company that Google acquired in 2005 to build what became Google Analytics.
Despite their origins in Google’s ecosystem, UTM parameters are an open web standard — not proprietary technology. Every major analytics platform supports them: Google Analytics alternatives like Plausible, Fathom, and Matomo read UTMs automatically, as do enterprise tools like Adobe Analytics, Mixpanel, and Amplitude.
How a UTM Link Works
A UTM-tagged URL appends tracking parameters after a ? in the URL. Here’s the anatomy of a complete UTM link:
When a visitor clicks this link, your analytics tool reads the query parameters and attributes the visit to the specified source, medium, and campaign. The parameters are visible in the URL bar but are stripped before indexing by search engines, so they don’t affect SEO.
This mechanism is entirely server-side and privacy-friendly. UTM parameters don’t set cookies, don’t use fingerprinting, and don’t collect any personal data. They simply describe the link itself — not the person clicking it.
UTM Parameters and Privacy
In an era where privacy-compliant analytics is becoming the default, UTM parameters stand out as a tracking method that doesn’t compromise user privacy at all.
Why UTMs Are Privacy-Safe
- No cookies involved. UTM data is captured from the URL itself, not from cookies stored on the user’s device. This means UTM tracking works identically with or without cookie consent.
- No personal data collected. UTM parameters describe the campaign, not the individual. They tell you “this click came from a newsletter” — not “this click came from [email protected].”
- Transparent by design. Users can see UTM parameters in the URL bar. There’s nothing hidden or deceptive about the mechanism.
- Fully GDPR-compliant. Since UTMs don’t process personal data, they don’t require a legal basis under GDPR, ePrivacy, or the upcoming EU Digital Omnibus. Use our Consent Logic Planner to see which tracking technologies actually need consent in each region.
UTM Tracking vs. Cookie-Based Tracking
| Feature | UTM Parameters | Cookie-Based Tracking |
|---|---|---|
| Requires consent in EU | No | Yes (ePrivacy) |
| Works after cookie deletion | Yes | No |
| Cross-session tracking | No (single visit) | Yes |
| Works in incognito mode | Yes | Partially |
| Blocked by ad blockers | No | Often |
| Identifies traffic source | Yes (campaign-level) | Yes (user-level) |
| Privacy risk | None | High (PII potential) |
For teams using cookieless attribution models, UTM parameters are the primary campaign-level signal. They replace the role that third-party cookies used to play in identifying which campaigns drive traffic. If you’re still running cookie-based analytics, our Consent Impact Dashboard shows exactly how much data you’re losing to consent banners — and why UTM-based attribution with cookieless tools is the better path.
How UTM Parameters Work in Cookieless Analytics
Privacy-first analytics tools like Plausible, Fathom, and Matomo handle UTM parameters natively — but the way they process campaign data differs from traditional cookie-based tools like GA4.
Platform Comparison
| Platform | UTM Support | Cookies | Campaign Reports | Multi-Touch Attribution |
|---|---|---|---|---|
| Plausible | Full | None | Sources → Campaigns | First-touch only |
| Fathom | Full | None | Referrers → UTM view | First-touch only |
| Matomo | Full | Optional | Acquisition → Campaigns | Configurable |
| GA4 | Full | Required | Acquisition → Traffic | Data-driven |
| Simple Analytics | Full | None | Referrers page | First-touch only |
Key difference: Cookieless tools typically use first-touch attribution within a single session. If a visitor arrives via utm_source=newsletter and later converts, the conversion is attributed to that newsletter campaign. But if they return a week later via a direct visit, that second session won’t be linked to the original campaign — because there’s no cookie to connect them.
This is a deliberate privacy trade-off. For most teams, campaign-level attribution (which campaigns bring visitors) is far more actionable than user-level tracking (which individual saw which ad). If you’re migrating from Google Analytics, consistent UTM tagging ensures your campaign data stays reliable even without cookies.
Common UTM Mistakes to Avoid
Even experienced marketers make UTM errors that pollute their analytics data. Here are the most common mistakes and how to avoid them.
✗ Using UTMs on internal links
Adding UTM parameters to links within your own site starts a new session and overwrites the original traffic source. A visitor from Google suddenly appears as “internal_promo.” Use event tracking or link decoration instead.
✗ Inconsistent capitalization
utm_source=Facebook and utm_source=facebook create two separate rows in your reports. Always use lowercase (this builder enforces it by default).
✗ Using spaces in values
Spaces get encoded as %20 and can cause parsing issues across platforms. Use underscores (spring_sale) or hyphens (spring-sale) instead.
✗ Putting PII in parameters
Never include email addresses, user IDs, or names in UTM values. They’re visible in URLs, logged by analytics tools, and storing them violates GDPR.
✗ Creating too many campaign names
Having 50 variations of “spring sale” (spring_sale, SpringSale, spring-sale-2026) fragments your data. Standardize naming before launch.
✗ Tagging organic search results
Never add UTMs to pages appearing in search results. Search engines pass referrer data automatically. Adding UTMs to SEO landing pages can create canonicalization problems.
To prevent these mistakes at scale, establish a UTM naming convention before your team starts building links.
UTM Naming Convention Template
A naming convention eliminates guesswork and keeps your campaign data clean. Use this template as a starting point, adapting it to your team’s channels and campaigns.
Recommended Naming Rules
- Always lowercase. Never mix cases.
- Use underscores to separate words (
spring_sale, notspring saleorSpringSale). - Be specific but concise.
fb_retarget_q1is better thanfacebook_retargeting_campaign_quarter_one_2026. - Include dates in campaigns for time-based promotions:
black_friday_2026. - Document everything in a shared spreadsheet accessible to all team members.
Example Convention
| Channel | utm_source | utm_medium | utm_campaign | utm_content |
|---|---|---|---|---|
| Google Ads | google | cpc | brand_awareness_q1 | headline_a |
| Facebook Ads | facebook | paid_social | spring_promo | carousel_v2 |
| Email Newsletter | newsletter | email | weekly_digest_0310 | top_cta |
| LinkedIn Organic | linkedin | social | thought_leadership | article_link |
| Partner Blog | partner_techblog | referral | guest_post_march | — |
| QR Code (Print) | qr_code | print | conference_berlin | badge_back |
| YouTube Video | youtube | video | product_demo | description_link |
| Telegram | telegram | social | channel_post | — |
Tip: Review your convention quarterly. As new channels emerge and campaigns evolve, update the template to prevent drift. If you’re using a privacy-first WordPress analytics plugin, you can verify UTM data flows correctly by checking your campaign reports immediately after launch.
Frequently Asked Questions
rel="canonical" tags pointing to the clean URL without parameters. Most CMS platforms handle this automatically. UTM-tagged URLs will not create duplicate content issues if canonical tags are properly configured.utm_source=Facebook and utm_source=facebook are treated as two completely different sources in every analytics platform. This is why enforcing lowercase is critical. This UTM builder applies lowercase transformation by default to prevent data fragmentation in your reports.utm_source, utm_medium, and utm_campaign. These give you the complete picture of where traffic came from, through which channel, and for which campaign. Add utm_content when you need to A/B test different creative or link placements. Use utm_term only for paid search keyword tracking.utm_source=newsletter, utm_medium=email, utm_campaign=[campaign_name], and utm_content=[link_position] (like header_cta or footer_link) to track which placement drives the most clicks.utm_source identifies the specific platform or sender (e.g., google, facebook, newsletter). utm_medium identifies the marketing channel type (e.g., cpc, social, email). Think of source as “who sent the traffic” and medium as “how it was sent.” One medium (like social) can have many sources (facebook, linkedin, twitter).Want to go deeper into privacy-compliant tracking?
Learn how to measure marketing without compromising user privacy.
Read Our Privacy Analytics Guide →Related resources