UTM Naming Convention Template: Build It in Google Sheets

Spend an afternoon on this page and you will leave with a UTM convention your team can actually follow: a controlled vocabulary, one casing rule, a campaign pattern with a regex behind it, and an audit tab that makes drift visible the week it starts.

Build it yourself in Google Sheets. Every tab, every starter value, and every validation rule is written out below, so there is nothing to download and nothing to wait for.

One warning before you start. A naming convention is not a link builder. A link builder produces tagged URLs. A convention decides which values are allowed to exist in the first place.

TL;DR

• Most free UTM templates are a CONCATENATE formula with five columns in front of it. A convention also needs picklists, a casing rule, prohibited characters, cross-field validation, and an audit row.
• Seven tabs cover it: Convention summary, Sources, Mediums, Campaigns, Link builder, Validation rules, Audit pivot.
• Start from 12 sources and 7 mediums. Add only what you actually run.
• Lock every UTM cell with data validation. Free typing is where conventions die.
• The campaign field is the generative one. Give it a delimited pattern and a regex.
• A spreadsheet holds up to roughly 150 to 200 active campaigns or five people tagging links. Past that, you are maintaining the sheet instead of the convention.

Most Free UTM Templates Are Just URL Builders

Search “free UTM template” and you get the same artifact ten different ways. Five columns labelled utm_source through utm_content, a sixth column with a CONCATENATE formula, a built URL at the end, and sometimes a tab called “example” holding three rows of invented data.

That builds links. It does not stop the slow rot that turns six months of campaign data into a source report with five spellings of Facebook in it.

Here is what those templates leave out.

No controlled vocabulary. The utm_source column is free text. The first person types Facebook. The second types facebook. The third types FB. Three months later the source breakdown holds all three, plus fb-paid and Facebook Ads, and somebody asks why Meta traffic is split across five rows.

No casing rule. GA4 stores Email and email as different source values, even though its channel grouping rules are not case sensitive. Your channel report looks fine. Your source report is a mess.

No prohibited characters. Spaces, ampersands, equals signs, hashes and plus signs each break something specific: the URL, the parse, or the report. A real convention names the allowed character set and nothing else.

Some combinations are also simply wrong. utm_source=google with utm_medium=email is a tagging mistake every time, and a spreadsheet can flag it at the row level before the link ships.

No audit row. Six months in, nobody can tell which campaigns followed the convention. Each row needs the date it was added, who added it, and which version of the convention was in force.

The workbook below covers all five gaps. It is still a spreadsheet with all the usual limits, but it is built around governance rather than a fancier formula.

The Seven Tabs

Build these in order. The names matter, because later tabs reference earlier ones.

Tab 1, Convention summary. A read-only page holding the rules: allowed characters, the casing rule (lowercase kebab by default), prohibited values, the campaign pattern, and the date the convention took effect. New joiners read this first. It is also what you screenshot when somebody asks “what’s our UTM convention” in Slack.

Tab 2, Sources. Two columns: the canonical utm_source value (google, linkedin, newsletter), then a description holding the aliases that map to it. The 12 starter values are below. This tab is the source of truth for the picklists on the Link builder.

Tab 3, Mediums. Same shape. Seven starter values, listed below. Mediums are where teams overspend on creativity, so keep the list short.

Tab 4, Campaigns. Active and archived campaign names with start date, owner and channel mix. Names follow the regex further down this page. New campaigns get added here first, then referenced from the builder.

Tab 5, Link builder. One row per tagged URL. Source, medium and campaign are data-validated against tabs 2 to 4, so free typing throws a flag. A helper column compares each value against LOWER(value) to enforce casing. The built URL sits in the final column, and the audit columns capture date, owner and convention version.

Tab 6, Validation rules. Cross-field rules as conditional formatting. source=google with medium=email flags red. source=newsletter with medium=cpc flags red. A catch-all rule flags any value containing a space, an uppercase letter, or a character outside the allowed set. Keep this list short on purpose: enforcing every possible combination in a spreadsheet is a losing fight.

Tab 7, Audit pivot. A pivot of the builder rows grouped by source, medium and quarter. Screenshot it for the monthly governance review, or export it when you want trend lines.

Tabs 1 to 4 are the convention. Tab 5 is the URL builder that every other template stops at. Tabs 6 and 7 are what keep the convention true six months later.

Adapt It Before You Roll It Out

Three changes are almost always needed.

Add or remove sources. The 12 starter sources cover the common B2B and B2C channels. Running heavy on podcast, partner co-marketing or community? Add them. Not running paid social on X? Delete it. The rule: every source you actually use, exactly once, under a canonical name. Aliases live in the description column, never as separate sources.

Pick one casing rule. The default here is lowercase kebab (paid-social). Lowercase snake (paid_social) works equally well, and GA4’s channel rules match either, since the Paid Social rule matches any medium beginning with paid. What breaks reporting is mixing the two, because paid_social and paid-social are two different source-report rows even though they land in the same channel. Pick one, write it on tab 1, and enforce it in the helper column on tab 5.

Decide the campaign structure. The default regex below assumes a date, a channel, an audience and an offer. Think in quarters instead of months? Change the date slug. Don’t segment by audience? Drop that slug. The regex is where the decision gets recorded. Skip it and the convention drifts inside a quarter.

One rollout rule: do not rename existing campaigns. GA4 holds historical session data, and renaming breaks trend reports. Apply the convention from a fixed start date, record that date on tab 1, and let the old values age out.

The 12 Starter Values for utm_source

Each value is a platform, lowercase and kebab-case.

Value	What it means
google	Google Search Ads, Performance Max, Display, YouTube auctions sold by Google Ads
bing	Microsoft Advertising (Bing, Yahoo, AOL syndicated)
facebook	Facebook ads in Meta Ads Manager. Use instagram for Instagram placements when you split reporting.
instagram	Instagram ads in Meta Ads Manager (when split from Facebook)
linkedin	LinkedIn Campaign Manager
twitter	X Ads (kept as twitter for historical continuity in most teams)
tiktok	TikTok Ads Manager
youtube	YouTube ads bought outside Google Ads (rare) and organic YouTube descriptions
newsletter	Owned email lists sent through your ESP (Mailchimp, HubSpot, Customer.io)
partner	Co-marketing partner placements (the specific partner goes in the campaign field)
podcast	Sponsored reads and host-read promo codes (the specific show goes in the campaign field)
github	GitHub README links, Sponsors placements, Discussions

Twelve is opinionated. Smaller paid mixes want fewer. Teams with several ESPs or a partner program want more. The principle holds either way: a source is a platform, not a campaign and not a creative.

Four mistakes worth naming:

• email is a medium, not a source. The source is the ESP or newsletter.
• direct should never appear as a source. Direct traffic is the absence of a source. Tagging a link utm_source=direct is lying to your own reporting.
• referral is a medium too. The source is the referring site (producthunt, hackernews) or partner.
• Aliases like fb, ig and li belong in the description column on tab 2.

The 7 Starter Values for utm_medium

The medium decides which channel group a session lands in, so these are the values that keep your channel report readable.

Value	What it means
cpc	Paid search and any cost-per-click auction (Google Search, Bing, Apple Search Ads)
paid-social	Paid placements on Meta, LinkedIn, TikTok, X, Pinterest, Reddit
organic-social	Owned social posts that link out (company page, handle, bio links)
email	Any email send, from an ESP or a CRM workflow
display	Programmatic display, retargeting networks, banner buys
referral	Tagged links from partner sites and integrations
affiliate	Affiliate placements, kept separate from referral so commission reporting matches

Seven is also opinionated. Some teams split paid-social into prospecting and retargeting. Some add audio for podcast and streaming. Both are reasonable. Start at seven anyway, because every extra medium is another row of channel rules to maintain.

Three things worth knowing about how GA4 reads these:

• cpc, ppc and paidsearch all land in Paid Search. Pick one and stay on it. This convention uses cpc.
• Channel rules are not case sensitive, and the Paid Social rule matches any medium starting with paid. So paid-social, paid_social and Paid-Social all land in Paid Social. Your channel report survives the inconsistency. Your source and medium reports show every spelling separately, which is the real reason to standardise.
• A bare social lands in Organic Social. Use it for paid placements and your paid spend gets reported as organic.

Give the Campaign Field a Regex

The other parameters are picklists. The campaign value is generative, and without a pattern every marketer invents their own.

Use a delimited slug with four parts:

{date}_{channel}_{audience}_{offer}

Example: 202608_paidsocial_smb_freetemplate

The validation rule on tab 6:

^([0-9]{6}|[0-9]{4}q[1-4])_[a-z0-9]+_[a-z0-9]+_[a-z0-9-]+$

That enforces a date prefix that sorts lexically (either 202608 or 2026q3), three delimited slugs after it, lowercase letters and digits only, hyphens allowed in the offer slug for multi-word offers like q3-launch-webinar, and nothing else. No spaces, no uppercase, no stray punctuation.

Four slugs is a deliberate ceiling. Five or six stops being readable. Three usually cannot express a real campaign. Need more dimensions? Put them in utm_content for creative and placement, and utm_term for audience or keyword. That is what those parameters are for.

Four decisions are baked into the default pattern:

The date comes first because sorting campaigns by time beats sorting them by channel. Any alphabetical sort then groups campaigns by when they ran.

Second, the channel slug repeats utm_medium on purpose. It lets you read a campaign value at a glance in dashboards that show the campaign field alone, and filter campaign names by channel without joining tables. Note the delimiters differ: underscores separate the slugs, hyphens live inside them, so the channel reads paidsocial here and paid-social in utm_medium. If that bothers you, allow hyphens in the channel slug and keep the two identical.

The audience slug is where most teams add the most reporting value. Splitting smb from enterprise, or new from existing, makes downstream analysis straightforward. Don’t segment? Drop to a three-part pattern.

The offer slug is whatever the campaign is actually pushing: freetemplate, webinar-mmm, casestudy-canon. This is the one position where hyphens are allowed inside a slug.

When You Outgrow the Spreadsheet

A spreadsheet governs well up to a point. The signals that you have passed it are consistent:

• More than five people tag links, and rows get overwritten.
• Tab 6 catches errors after the link has shipped, not before.
• Tab 7 stops matching the UTMs actually arriving in GA4, because people are building links outside the sheet.
• Picklists get long enough that marketers stop using the dropdowns and type values instead.
• You need approvals. Spreadsheets do not have them, and comments are not approvals.
• You need different rules per region or business unit, which one sheet cannot hold without becoming unreadable.

Here is the shape of it, hypothetically. A B2B SaaS team starts with three marketers, one ops lead and about 30 active campaigns. Everything fits. Validation catches typos before links ship.

A year later there are nine marketers across three regions, a partner program, roughly 180 active campaigns and 4,000 rows. The dropdowns are slow, so people type values directly and the validation chain breaks. The partner team needs its own picklist. Drift shows up in the source report.

That is the point where governance moves out of the sheet. Terminus, the marketing taxonomy governance platform, holds the same convention as structured fields, picklists, casing rules and validation patterns, validates values when the link is created rather than after the fact, scopes builders by role so people only see the values they are allowed to pick, and supports region-specific rules without duplicating the whole convention. Approvals are available on paid plans.

The move is straightforward when the convention is already written down. Tabs 2, 3, 4 and 6 become structured config. Nothing about the convention changes. What changes is where it lives and when it is enforced.

The spreadsheet is a fine place to start. It is not the place to end up past 150 to 200 active campaigns or five active link-builders.

Build the Workbook

Roughly an afternoon, in this order:

1. Create tab 1 and write the rules down first: allowed characters, casing rule, cutover date. Deciding later never happens.
2. Create tabs 2 and 3, and paste the starter sources and mediums above. Cut what you don’t run.
3. Create tab 4 with your live campaigns, renamed to the pattern going forward only.
4. Build tab 5. Data-validate source, medium and campaign against tabs 2 to 4, add the LOWER() helper column, then build the URL with a formula in the final column.
5. Add tab 6 as conditional formatting rules, starting with the two cross-field rules and the catch-all.
6. Add tab 7 as a pivot over tab 5, grouped by source, medium and quarter.
7. Share it read-only to the team, editable to the people who tag links.

A note on Excel: the data validation and conditional formatting here rely on Google Sheets behaviour, so an .xlsx export loses most of the enforcement. On Microsoft 365, rebuild the same seven tabs and translate the rules to Excel syntax.

FAQ

What is the difference between this and a UTM builder?

A UTM builder produces tagged links, which is tab 5 of this workbook. The convention is tabs 1 to 4, 6 and 7: the controlled vocabulary, the casing rule, the prohibited characters, the cross-field validation and the audit row. Most “free UTM builder” downloads are the sixth column of a spreadsheet with nothing behind it.

Kebab case or snake case?

Either. This convention defaults to kebab (paid-social) because it reads well in URLs and matches the casing most teams already use in code and config. Snake (paid_social) is equally valid. GA4’s channel rules match both and are not case sensitive. The failure is mixing them, which splits your source and medium reports across spellings.

Does casing actually break my channel reports?

No, and this is widely misunderstood. GA4’s channel definitions are not case sensitive, so Email still lands in Email. What casing breaks is the source and medium reports, where Email, email and EMAIL are three separate rows, and any join you run on those values downstream.

Should I tag organic search traffic?

Almost never. Search engines pass a referrer, and paid Google clicks carry gclid from auto-tagging. Adding manual UTMs to organic links overwrites attribution that already works. AI assistants are the interesting exception, and you still cannot tag them: ChatGPT appends its own utm_source=chatgpt.com to citation links, and GA4 now has an AI Assistant channel that catches the main assistants. Read the referrer rather than inventing a parameter.

How often should I review the convention?

Quarterly for the picklists. Annually for the casing rule and the campaign regex. Tab 7 is the artefact you review. If more than five percent of the last 90 days of UTMs miss the convention, either the convention is too strict or the team needs a refresher.

What about historical UTMs that don’t match?

Leave them. GA4 holds historical session data, and renaming campaigns breaks trend reports. Apply the convention from a fixed date, record it on tab 1, and let the old values age out of the reporting windows you care about.

Can I add parameters beyond the standard five?

GA4 reads more than five: utm_id, utm_source_platform, utm_creative_format and utm_marketing_tactic are all supported alongside source, medium, campaign, term and content. An invented parameter like utm_audience is not. GA4 will not surface it as a dimension without extra configuration, so encode that information in the campaign or content slug instead.

Is a spreadsheet GDPR or CCPA friendly?

UTM values are not personal data, and this workbook only structures the links you send. Privacy regulation touches UTMs when you store click data on landing, which is a separate question about your own site.

What is the one rule that matters most?

Lock the cells. A controlled vocabulary that people can type past is a suggestion, and suggestions drift.