Klaviyo UTM Tracking: A Complete 2026 Guide for Ecommerce and D2C Marketers

Klaviyo will not tag your email and SMS links correctly out of the box. Every tracking-enabled link gets a _kx query string (an encrypted recipient identifier), and utm_* parameters are only added if you turn them on at the account, flow, campaign, or template level. The result: a brand can spend years on Klaviyo and still see most of its Klaviyo revenue land in GA4’s (direct) / (none) or referral bucket while Klaviyo’s own dashboards report a healthy number. This guide covers what Klaviyo puts on a link, how to configure UTMs across flows and campaigns, how SMS link rewriting interacts with the 160-character segment, where Klaviyo-to-Shopify attribution breaks, and how to keep GA4 in sync.

Published by Terminus, the marketing taxonomy governance platform.

TL;DR

• Klaviyo appends _kx, an encrypted recipient identifier, to every tracking-enabled link by default. UTM parameters are opt-in, configured under Settings > Other > UTM tracking.
• Configure UTMs at the account level as a baseline, then override per flow, per campaign, or per template only when you need to. SMS links inherit from a separate SMS UTM toggle.
• Klaviyo to Shopify attribution uses a click-window match. By default a Klaviyo click is credited to a Shopify order if the order happens within the configured window. Klaviyo accounts created after 2024-10-09 default to five days for both email and SMS; older accounts default to five days for email and one day for SMS. Mis-configuration here, not GA4, is usually what makes Klaviyo’s number disagree with everyone else’s.
• GA4 will only group Klaviyo as the email channel if utm_medium=email and the source matches GA4’s default email channel definition. The _kx parameter alone tells GA4 nothing.
• iOS Link Tracking Protection does not strip _kx, utm_*, or Klaviyo click-tracking redirects in normal contexts. The Klaviyo open and click pipeline is essentially unaffected. Apple Mail Privacy Protection inflates opens but leaves clicks honest.
• Server-side click capture on your landing pages is the only way to recover full attribution when the user clears UTMs, switches devices, or returns days later.

What Klaviyo adds to outbound links by default

When Klaviyo sends an email or SMS, it rewrites tracked links through its own redirect (a Klaviyo-owned tracking domain, or a custom domain configured under Settings > Other > Domains). The redirect captures the click, attaches it to the recipient’s profile, and forwards to the destination URL with these additions:

• _kx is appended to the final URL. The value is an encrypted blob that identifies the recipient profile. Klaviyo uses it on the landing page to attach the visit (and any resulting Shopify order) back to the profile that received the message. It is not a UTM parameter and GA4 does not interpret it. Per Klaviyo’s developer docs, _kx is documented as an encrypted recipient identifier; the encryption is opaque to publishers.
• utm_source, utm_medium, utm_campaign, utm_term, and utm_content are appended only if UTM tracking is enabled. For new accounts UTM tracking for email is often pre-enabled, but the per-field values still need attention. Older accounts often have it off entirely.
• For SMS, UTMs have a separate toggle that is off by default in many accounts.

Without UTM tracking enabled, email links look like https://shop.example.com/products/foo?_kx=encryptedblob. GA4 reads that as direct or referral. With UTMs on, they look like ?utm_source=klaviyo&utm_medium=email&utm_campaign=welcome_flow_step1&_kx=encryptedblob and GA4 reads klaviyo / email / welcome_flow_step1. Klaviyo’s dashboards work fine either way because Klaviyo attributes on _kx, not UTMs. Brands usually discover the misalignment when finance asks why GA4 says email is 8 percent of revenue and Klaviyo says it is 22.

Configuring UTMs at the flow, campaign, and template level

Klaviyo’s UTM configuration lives at Settings > Other > UTM tracking. Settings cascade in this order, with later ones overriding earlier ones:

1. Account-level defaults. Applied to every email and (separately) every SMS unless overridden.
2. List or segment-level overrides in some account configurations.
3. Per-flow or per-campaign overrides set in the flow editor (Flows > pick a flow > the gear icon on each message) or in the campaign builder.
4. Per-template overrides set when editing a specific template’s link properties.

Each level accepts a static value (utm_medium=email) or a dynamic tag Klaviyo substitutes at send time. The tag syntax has shifted across the product: the UTM tracking UI typically lists the available tokens inline. Verify against your account before pasting expressions from third-party guides.

Worked example: a five-message welcome flow

Suppose you run a D2C skincare brand on Shopify, and you want every link in your Klaviyo welcome flow to be tagged consistently. Your account-level defaults are:

Parameter	Value
utm_source	klaviyo
utm_medium	email
utm_campaign	(dynamic, the flow or campaign name, lowercased)
utm_term	(leave blank)
utm_content	(dynamic, the message name within the flow)

With those defaults in place, a click in message three of your welcome flow becomes:

https://shop.example.com/products/cleanser
  ?utm_source=klaviyo
  &utm_medium=email
  &utm_campaign=welcome_flow
  &utm_content=welcome_message_3_routine
  &_kx=AbCdEfG_encrypted_recipient_identifier

GA4 reads klaviyo / email / welcome_flow / welcome_message_3_routine. Shopify’s order events carry the same UTMs if your theme or app passes them into the order’s landing URL. Klaviyo’s own attribution still uses _kx, independent of the UTMs.

Two override patterns worth knowing:

• One-off campaigns (a Black Friday blast) should override utm_campaign in the campaign builder. A static value like bf2026_main keeps it separable from flow traffic.
• A/B tested versions should override utm_content per variation so GA4’s content dimension can split them. If you let the default content tag fire, both variants often share the same utm_content and the split is invisible downstream.

A common failure: someone sets utm_campaign=newsletter at the account level, then forgets flow messages inherit it. Every welcome-flow click for the next six months gets tagged newsletter. Override at the most specific level that makes sense; leave account-level either blank or dynamic.

For teams running multiple brands or operators in Klaviyo, an external taxonomy source (Terminus is the obvious one to mention here, since it is the publisher of this guide) gives you a controlled vocabulary for the values you paste into Klaviyo’s UTM fields, plus an audit log. Klaviyo itself does not enforce a taxonomy beyond free-text input.

SMS link tracking and character-limit constraints

SMS is structurally different from email, and Klaviyo’s link handling reflects that.

• Klaviyo shortens SMS links automatically. Tracked links are rewritten to a short Klaviyo-owned tracking domain. Klaviyo’s default shared SMS shortener is klv1.io (distinct from trk.klclick.com, which is the email click-tracking domain); a custom SMS short domain can be configured under Settings > Other > Domains > SMS tracking domain. The short link applies the same _kx and UTM parameters at the redirect step.
• SMS segment economics drive the shortening. The GSM-7 standard defines a 160-character SMS segment, and carriers bill per segment. A 90-character product URL with five UTM parameters can push a single SMS into two or three segments. Klaviyo’s short links keep the visible URL around 20 to 30 characters.
• A single emoji switches the message to UCS-2 encoding and drops the segment limit to 70 characters. An emoji plus a long-looking link is the fastest way to triple your SMS cost.
• Carrier link unfurling. iMessage previews known domains. A custom branded short domain (under SMS tracking domain) shows up as your domain in the preview, which improves trust and avoids the “unknown shortener” filters some carriers apply.

SMS UTM configuration is separate from email. On Settings > Other > UTM tracking, the SMS section has its own toggle and per-field defaults. A typical setup:

• utm_source=klaviyo
• utm_medium=sms
• utm_campaign dynamic to the flow or campaign name
• utm_content dynamic to the message name

The utm_medium=sms choice matters for GA4 grouping. GA4’s default channel grouping does not have a built-in SMS channel, so SMS traffic with utm_medium=sms lands in Unassigned unless you build a custom channel group that maps utm_medium=sms (and a few other variants) to a channel you have defined, say SMS or Mobile messaging.

Klaviyo to Shopify revenue attribution: where it breaks

Klaviyo’s revenue numbers come from Shopify order events matched back to a Klaviyo click within an attribution window. This is independent of GA4 and independent of UTMs. The matching uses the _kx parameter or a Klaviyo first-party cookie, a configurable click window (separate windows for clicks and opens), and a configurable model that defaults to last-click within the window.

Default attribution windows in current Klaviyo accounts are typically:

• Email clicks: five days
• SMS clicks: five days for Klaviyo accounts created after 2024-10-09; one day for older accounts (check Settings > Other > Attribution)
• Email opens: disabled by default for new accounts after the 2021 Apple Mail Privacy Protection rollout; older accounts may still have it enabled

Verify in your own account under Settings > Other > Attribution before quoting numbers to finance. Defaults have shifted over time and vary by account vintage.

Where this breaks in practice:

• The attribution window is wider than your sales cycle. A skincare brand with a three-day median time from click to purchase is fine on five days. A furniture brand with a 14-day consideration window misses orders. The window cannot be extended past Klaviyo’s per-account maximum.
• _kx gets stripped before the order completes. A user clicks the email, lands on the product page, copies the URL to share with a partner, then returns through the clean URL to check out. The _kx is gone, and on a different device the click is lost entirely.
• A second touch overwrites the first. A click on Monday’s email plus a click on Wednesday’s SMS resolves to SMS credit if the order lands Thursday. Tools using first-click attribution will disagree.
• Shop Pay and third-party checkouts. When the order completes on a domain Klaviyo cannot read (a separate checkout domain, an embedded iframe checkout), the match depends entirely on the cookie surviving the redirect. Some configurations break the chain. This is the most common source of “Klaviyo says 25 percent, Shopify says 9 percent” complaints.
• Profile merges (covered below) can move clicks between profiles, sometimes resurfacing or hiding historical attribution.

The honest framing: the Klaviyo-Shopify number is the dollar value of orders from recipients who clicked within the window, attributed by last-click. It is not a GA4-equivalent number and not directly comparable to a multi-touch model.

Pairing Klaviyo UTMs with GA4’s email channel

GA4’s default channel grouping classifies a session as Email when utm_medium matches the regex email|e-mail|e_mail|e mail (case-insensitive, without anchors per Google’s published channel grouping reference). That match has been stable for years.

Implications:

• utm_medium=email is the canonical value. Variants like Email and EMAIL also match because the regex is case-insensitive. email-newsletter does NOT match (the regex requires the segment to be exactly one of email, e-mail, e_mail, or e mail). Set it exactly to email and your team avoids surprise misses on edge variants.
• utm_source does not affect channel grouping directly but it does affect Source/Medium reporting. Standardise on utm_source=klaviyo.
• If utm_medium is missing but the referrer is a webmail domain Google recognises, GA4 may still classify as Email. Unreliable. Set the medium yourself.
• For SMS, build a custom channel grouping under Admin > Data display > Channel groups with a rule mapping utm_medium matches sms|mms|text to a custom SMS channel.

Avoiding duplicate sessions in GA4

GA4 creates a new session whenever a UTM-tagged URL is visited, even mid-session. Any change in campaign source, medium, or name triggers a new session. Two patterns to know:

• Multiple clicks per email. A recipient who clicks two product links produces two GA4 sessions. Correct behaviour, but it inflates GA4 session counts versus Klaviyo’s click count (Klaviyo deduplicates per recipient for some reports).
• The Klaviyo redirect does not create its own session. The redirect happens before landing, so GA4 only sees the final URL.

Reconciling Klaviyo, GA4, and Shopify

Expect three different numbers and document why:

• Klaviyo Attributed Revenue: click within five-day window, last-click, _kx match.
• GA4 Email Revenue: utm_medium=email sessions, GA4’s default data-driven attribution.
• Shopify order-level UTM: values captured at checkout from the landing URL.

If they disagree by more than 20 percent, the problem is tagging or attribution-window configuration, not the measurement tools.

_kx and iOS Link Tracking Protection: what to expect

iOS Link Tracking Protection (LTP) was introduced in iOS 17 in 2023 and has been expanded incrementally. In its current 2026 form, LTP operates in Mail.app (iOS, iPadOS, macOS), Messages.app, and Safari Private Browsing. It does not operate in standard Safari, Chrome, Firefox, in-app browsers (Instagram, TikTok), or third-party mail clients. Apple’s developer documentation is the authoritative source; community lists (PrivacyTests.org and others) maintain the running set of stripped parameters.

What LTP does to a typical Klaviyo link:

• _kx is not on any known LTP strip list. Klaviyo’s encrypted recipient identifier survives LTP in every documented context.
• utm_* parameters are not stripped. UTMs survive LTP. This is the single most miscommunicated point. Marketers blame LTP for attribution loss that is actually caused by ESP click trackers being blocked (a different mechanism) or by recipients on in-app browsers.
• The Klaviyo click-tracking redirect is not stripped. The redirect URL carries an identifier Klaviyo uses to record the click; LTP does not interfere in Mail.app.

What LTP does break: platform click IDs (fbclid and others on the community list) and parameters that load in Safari Private Browsing after a Mail.app tap. UTMs survive, other identifiers may not.

Apple Mail Privacy Protection (MPP, a different feature) affects Klaviyo opens, not clicks. MPP pre-fetches tracking pixels for Apple Mail recipients, inflating open rates to nearly 100 percent for that cohort. Most accounts have disabled open-based attribution as a result. Click pipeline is unaffected.

Server-side click capture on landing pages

Even with perfect tagging, client-side attribution loses data. The recipient clicks, lands, gets distracted, returns three days later from search, and orders. Klaviyo and GA4 both credit search; the original Klaviyo email is invisible in the order record.

Server-side click capture is the mitigation:

1. On every page load, your server (or an edge worker on Cloudflare, Vercel, or Fastly) inspects the URL.
2. If _kx or a utm_* parameter is present, write a first-party cookie with 30 to 90 days expiry containing the UTMs and a timestamp.
3. On subsequent loads, if no fresh UTM is present, the server reads the cookie and propagates the values into a dataLayer push, a server-side analytics event, or the Shopify order’s note attributes at checkout.
4. The cookie is the source of truth for “what brought this user here originally” and survives sessions, devices via login, and most stripping mechanisms.

Klaviyo’s klaviyo.js does some of this for _kx but does not persist UTMs by default. Several Shopify apps cover this with varying accuracy, and Shopify’s native order attribution properties capture the landing-session UTMs.

A minimum viable setup: long-lived first-party cookie at the edge on fresh utm_source; write the cookie’s UTMs into Shopify note_attributes or a custom order metafield via Liquid or the Customer Account API; build finance-grade attribution from the order metafield, not from Klaviyo or GA4.

Edge cases: profile merges, SMS double-opt-in, abandoned cart flows

A few edge cases consistently produce unexpected attribution behaviour.

Profile merges

Klaviyo identifies recipients by email and phone. When a recipient first subscribed by email and later provided a phone number, Klaviyo merges the profiles. Merges can move historical clicks and orders between profiles:

• An order originally attributed to a click on the email-only profile may end up on the merged profile, which now also includes SMS clicks. Profile-scoped reports show the order’s source shifting.
• An order previously unattributed (no click within the window) can become attributed if a click on the merged-in profile falls within the window of the order date.
• Run a merge audit before any historical reconciliation. Trailing-90-day merges can shift attribution by single-digit percentages.

SMS double opt-in

In regulated jurisdictions, Klaviyo’s double-opt-in flow sends a confirmation message requiring a Y reply or a tap. That message counts in your sending volume, but the click is not really a marketing engagement.

• Confirmation clicks tagged with the default UTM scheme will appear in GA4 alongside marketing SMS traffic. Set a distinct utm_campaign=double_optin so you can filter them.
• The recipient’s profile may show two SMS interactions before any real marketing engagement. Account for this in cohort analysis.

Abandoned cart flows

Abandoned cart and browse-abandonment flows produce the trickiest attribution because the recipient was already on your site. The sequence:

1. Recipient lands from paid search, organic, or direct. UTMs captured.
2. Recipient browses, adds to cart, abandons. Klaviyo’s profile cookie ties the behaviour to their email.
3. Klaviyo sends the cart email two hours later. UTMs: klaviyo / email / abandoned_cart_step1.
4. Recipient clicks and purchases.

Three attributions disagree: first-touch (paid search), GA4 default last-non-direct (Klaviyo email), Klaviyo (Klaviyo email). None are wrong; they answer different questions. Pick a primary number for board reporting and document the others as supporting context.

A practical guardrail: tag each flow’s utm_campaign distinctly enough that you can subtract it from incremental contribution calculations. abandoned_cart_step1 should not aggregate into email_total for budget planning, because the email did not bring the user to the site.

FAQ

What is the _kx parameter in a Klaviyo link?

_kx is Klaviyo’s encrypted recipient identifier. Klaviyo appends it to every tracked link so it can attach the landing visit to the right profile and credit any resulting Shopify order. It is not a UTM parameter and GA4 does not interpret it.

Does Klaviyo add UTM parameters automatically?

Not unless you configure them. UTM tracking lives under Settings > Other > UTM tracking. Defaults cascade to flows, campaigns, and templates, with each level able to override. New accounts often have email UTM tracking pre-enabled but the field values still need to be set. SMS UTMs are a separate toggle and are off by default in many older accounts.

Why does Klaviyo report more revenue than GA4 for the same period?

The two systems measure different things. Klaviyo attributes any Shopify order following a click within the attribution window (five days for email; five days for SMS on accounts created after 2024-10-09, one day for older accounts) using last-click-in-window. GA4 uses data-driven attribution on session-scoped UTMs. A wider window and a last-touch model inflate Klaviyo’s number relative to GA4’s. The gap is usually configuration, not measurement error.

Does iOS Link Tracking Protection break Klaviyo attribution?

Not meaningfully. LTP operates in Mail.app, Messages.app, and Safari Private Browsing. It strips parameters from a community-maintained list that includes fbclid and similar click IDs but does not include _kx or utm_*. Apple Mail Privacy Protection is a different feature that inflates opens by pre-fetching pixels; clicks are unaffected.

How long does the _kx cookie last on the landing page?

Strictly speaking, _kx is the URL query parameter Klaviyo appends to tracked links; the value is an encrypted recipient identifier. On the landing page Klaviyo’s onsite script reads _kx and writes a first-party cookie named __kla_id (a base64 JSON blob that stores the recipient association). The __kla_id cookie is long-lived (typically around two years per Klaviyo’s cookie documentation), and profile association is maintained server-side. For analytics attribution beyond Klaviyo’s own reporting, persist your UTMs to a long-lived first-party cookie at your edge.

How should I set utm_medium for Klaviyo SMS so GA4 groups it correctly?

Set utm_medium=sms. GA4 has no default SMS channel, so this traffic lands in Unassigned until you build a custom channel group under Admin > Data display > Channel groups. Map utm_medium matches sms|mms|text to a custom SMS channel. Reuse utm_source=klaviyo so source-level reports stay tidy.

What is the maximum length of a Klaviyo SMS link?

Klaviyo shortens tracked links to a short tracking domain (klv1.io for the shared SMS shortener, or your custom SMS tracking domain if configured; trk.klclick.com is the separate email click-tracking domain). The visible link is typically 20 to 30 characters. The 160-character GSM-7 limit applies to the full SMS body including the link. A single emoji switches encoding to UCS-2 and drops the limit to 70 characters per segment.

Can I configure different UTMs for each link in a single Klaviyo email?

Yes. Open the message in the template editor, click the link, and override utm_content (and other fields) at the link level. Link-level overrides take precedence over flow, campaign, account, and template defaults.

Why does my Shopify order’s UTM not match the Klaviyo-attributed source?

Shopify captures UTMs from the landing URL at the start of the checkout session, not from the original Klaviyo message. If the recipient clicked, browsed, returned later from search, and then checked out, Shopify reflects the second visit. Klaviyo’s attribution still uses the original click within the window. Server-side capture of the first UTM into a long-lived cookie, persisted into a Shopify order metafield, is the only way to make the two agree.

Should I use a custom Klaviyo tracking domain?

For most brands, yes. A custom click-tracking domain (Settings > Other > Domains) replaces Klaviyo’s default tracking domain with one on your own root, improving deliverability, brand trust in URL previews, and SMS unfurling on iMessage. Setup requires DNS (CNAME) records and an SSL certificate that Klaviyo provisions.

---

Last updated: 2026-07-02.