The 2026 UTM Tagging Guide

By the end of this page you can write a tagging convention that still reports cleanly four quarters from now.

The parameters have not changed since Urchin. What has changed is everything around them: how GA4 reads them, what iOS strips from the URLs beside them, which assistants now show up as referrers, and how many people on your team can create a tagged link.

Naming conventions are the work. The syntax takes ten minutes.

TL;DR

• Six core parameters, plus three GA4-era additions most teams never populate.
• GA4 writes UTMs into session-scoped and user-scoped dimensions, and the auto-tagged values win when a click also carries a click identifier.
• A convention that survives is lowercase, consistently separated, controlled at source and medium, and dated where it helps.
• Click IDs and UTMs coexist and answer different questions.
• GA4 now has a native AI Assistant channel, so assistant traffic is no longer invisible by default.
• Governance, not creativity, is what makes a tagging programme last.

What UTMs Are, and Are Not

Six named query-string fields appended to a destination URL:

https://example.com/landing?utm_source=newsletter&utm_medium=email&utm_campaign=2026-summer-sale

The analytics platform reads them on the landing request and attributes the session.

They are not an identity layer. They tell you a session came from a campaign, not who the person is.

They are not click tracking. If the page never loads, nothing is recorded, because the mechanism is session tagging rather than click counting.

They are not populated by ad platforms. Google’s auto-tagging appends gclid, not UTMs. Meta is not documented to append UTMs to untagged ads, though practitioners report defaults built from IDs appearing on ads that carry none, so check a live click rather than assuming either way.

And they are not standardised between companies. The names are universal; the values are yours. Anyone selling a standard taxonomy is selling their opinion of one.

The Parameters

utm_source is the platform that sent the traffic, and the value channel logic hangs off. Let it fragment across Google, google and google-ads and every report splits.

utm_medium is the channel category, and GA4’s channel rules read it first. Keep the list short: cpc, paid-social, email, social, referral, affiliate, display, qr.

utm_campaign names the campaign. The biggest mistake here is human-readable phrasing with spaces and capitals, which encodes badly and breaks every regex you write later.

utm_term was built for paid search keywords. Leave it to that, or to audience identity in social campaigns where you have decided that deliberately.

utm_content identifies the creative or placement. Free-form within a per-campaign convention rather than a global vocabulary, since variants change every campaign.

utm_id joins imported cost data. Use a stable ID from your campaign system, not the campaign name, and skip it entirely if you do not import cost data.

Three more exist and are rarely used: utm_source_platform, utm_creative_format and utm_marketing_tactic. GA4 reads them. Most teams never populate them, and that is a defensible choice.

How GA4 reads them

UTM values land in two scopes. Session-scoped dimensions (Session source, Session medium, Session campaign) describe the visit. User-scoped dimensions (First user source and siblings) describe acquisition. Reports built on one answer a different question from reports built on the other.

The API and BigQuery export use different names from the interface. In the UI you see “Session manual ad content”; in the export you read manual_content inside the traffic source structs. Check the export schema before writing queries rather than guessing from the UI labels.

Two behaviours worth internalising:

Auto-tagged values win. When a click carries both a click identifier and manual UTMs, GA4 fills source, medium and campaign from the auto-tagged values, and your manual values populate the Manual dimensions. Tagging a Google Ads link utm_source=adwords does not relabel it.

Cross-network is not what most people think. That channel catches Performance Max and Demand Gen based on the ad network type Google reports, or a campaign name containing “cross-network”. A click with source google and medium cpc lands in Paid Search.

Conventions That Survive a Quarter

Lowercase, always. Values are case-sensitive in the dimension reports, so Facebook and facebook are two rows in every tool and two values in every join. Channel definitions themselves are not case sensitive, which is why the channel still resolves while your source report fragments. Enforce lowercase at creation.

Pick one separator. This blog’s house convention is lowercase kebab: paid-social, product-launch. Snake case works identically as far as GA4’s channel rules are concerned, and some older posts here recommend it. What breaks reporting is mixing them, so choose one, write it down, and apply it everywhere.

Control source and medium. A fixed list of allowed values, visible to whoever builds links. Twenty sources and a dozen mediums covers most B2B programmes. Campaign and content stay free-form within a pattern.

Date your campaigns. A year or quarter in the campaign name makes year-over-year slicing trivial and prevents this year’s summer sale colliding with 2024’s.

Fix a field order. Something like {region}-{quarter}-{program}-{tactic}, so campaign names parse later in a warehouse. The order matters more than the specific fields.

Decide what you will not encode. Every extra semantic field makes the name longer and more error-prone. A common split: the UTM carries source, medium, campaign and content, while region, product line and persona live in the CRM and join later.

Where UTMs Go

GA4 reads them on the first page view of a session and writes both scopes. Channel grouping then operates on the session source and medium.

Adobe Analytics does not consume them natively. A processing rule copies specific parameters into eVars, and Marketing Channel rules build attribution from there. Document the mapping once.

Mixpanel captures them automatically, storing first-touch values on the profile and current values on events, with no built-in channel grouping.

Warehouses receive whatever your export provides. For the GA4 export, a session-scoped view that takes the first event’s values per session is the usual pattern. For raw logs, parse the query string yourself.

ESPs and CRMs capture them through hidden form fields and a script that reads the URL. The boundaries are where they break: cross-domain form posts, popups with stale referrers, iframes that cannot see the parent URL.

Click IDs Alongside

Every ad platform appends its own identifier: gclid and the iOS variants for Google, msclkid for Microsoft, fbclid for Meta, li_fat_id for LinkedIn, ttclid for TikTok, ScCid for Snapchat, epik for Pinterest, twclid for X, rdt_cid for Reddit.

They answer a different question from UTMs: which specific click, in the platform’s own records, produced this conversion. Both belong on the same URL. The click ID reference covers each one’s lifetime and match behaviour.

The failure at this boundary is contradiction rather than absence. Set utm_source=adwords on an auto-tagged Google Ads link and you now have two sets of values in two sets of dimensions. The clean pattern is an account-level Final URL Suffix carrying your standard template, with auto-tagging left on.

The Privacy Layer

iOS link tracking protection strips known click identifiers in Mail, Messages and Safari Private Browsing by default. That default is a setting users control, with options for off, private browsing or all browsing, and whether recent Safari versions moved it is disputed. Apple publishes no strip list. UTM parameters are not on the community-maintained ones, which is the practical argument for never depending on a click identifier alone. Details in what link tracking protection strips.

Consent Mode v2 has been mandatory in the EEA and UK since March 2024 for advertisers using Google’s measurement and ad products. When analytics storage is denied, GA4 receives limited pings, and UTM values still travel because they ride the URL rather than a cookie. That makes UTMs the most privacy-resilient signal you have.

Server-side tagging changes little about UTM capture itself. What it changes is persistence: cookies set from your server can outlive the caps Safari applies to JavaScript-written ones, subject to the endpoint being hosted so that Safari treats it as genuinely first-party.

AI-Era Referrers

Assistant traffic is no longer invisible by default. GA4 ships an AI Assistant channel, setting the medium ai-assistant when the referrer matches its list, which Google’s documentation gives as ChatGPT, Gemini, Deepseek, Copilot and Grok.

Claude and Perplexity are not on that list, so their referrals still arrive as ordinary Referral sessions until you add a custom channel group. The hostnames worth knowing are chatgpt.com and the legacy chat.openai.com, claude.ai, perplexity.ai, copilot.microsoft.com, gemini.google.com, chat.deepseek.com, grok.com and you.com. Tracking AI referral traffic has the regex and the verification steps.

One tagging question the AI era raises, with a clear answer: do not invent a UTM source for inbound assistant clicks. You do not control the links an assistant emits, UTM values override the referrer, and tagging a page that way relabels every human visitor to it. Tag the placements you control, and measure assistants by referrer.

Governance

A solo marketer with a spreadsheet and discipline can run a clean programme indefinitely. Add a second person and it wobbles. Add a third and you have a governance problem.

The failure modes are predictable. Source values drift within a week. Someone writes utm_medium=newsletter when the medium is email and the source is the newsletter, and because that value matches no channel rule the session lands in Unassigned rather than anywhere useful. Two people tag one launch as two campaigns. A salesperson shares an untagged link and the traffic is indistinguishable from brand search.

Training does not fix this, because training fades and the next hire was not in the room. Structure fixes it: the convention enforced where links are created.

Three patterns, in ascending order of durability. A shared spreadsheet with dropdowns, which breaks the moment someone edits the finished URL. A custom internal tool, better but now your team maintains it. Or a purpose-built platform such as Terminus, the marketing taxonomy governance platform, which holds the allowed values, validates before the link exists, and rejects anything outside the convention.

What drift looks like

Consider a team of eight running paid search, paid social on two networks, organic social, email, partner co-marketing and webinars. Eighteen months in, a source-by-medium pivot shows dozens of distinct source values where the channel mix justifies about twelve. Six spellings of one network, five of another, synonyms for the newsletter, and four ways of writing partner. Illustrative, but the shape is universal.

The cleanup has two halves. A warehouse view normalises the history, because you cannot rewrite links already in the wild. Then a controlled vocabulary at creation prevents the next round. Only the second half is permanent.

A Starter Taxonomy

Sources. google, bing, facebook, instagram, linkedin, tiktok, twitter, reddit, pinterest, youtube, newsletter, email, plus prefixed patterns for partners, events and webinars, and direct-mail and print for offline.

Mediums. cpc, paid-social, email, social, referral, affiliate, display, video, qr.

Campaigns. {year}-{quarter}-{program}-{tactic}, lowercase, dash-separated: 2026-q2-product-launch-press.

Content. Free-form within the campaign: header-cta, variant-a, image-square.

Term and id. Leave utm_term empty unless you have a deliberate use. Use utm_id only when importing cost data, with a stable ID from your system of record.

Write it somewhere that enforces it rather than describes it, versions changes, and puts new values through review. A document goes stale within two quarters.

FAQ

What is the difference between UTMs and click IDs?

UTMs are values you choose that any tool can read. Click IDs are opaque per-click identifiers the ad platform appends for its own attribution. Both belong on a paid link.

Do UTMs affect SEO?

Not in any documented way, as long as canonical tags are in place. The practical rule is never to use them on internal links, which fragments session attribution for your own visitors.

What happens without UTMs?

The platform falls back to the referrer, or to direct when there is none. A high direct share is usually a tagging problem rather than a brand-strength signal.

Should I use utm_id?

Only for cost-data imports, where it is the join key. Otherwise skip it.

How do UTMs interact with auto-tagging?

Auto-tagging appends the click identifier, and its values take precedence inside GA4 for source, medium and campaign. Add UTMs through the Final URL Suffix so everything outside GA4 still gets a campaign name.

Are UTMs case-sensitive?

The values are, in every tool that reads them, so casing splits your source and medium reports and breaks joins. GA4’s channel definitions are not case sensitive, which is why the channel itself still resolves.

Do UTMs survive iOS stripping?

Yes. Click identifiers are what gets removed, and only in Mail, Messages and Private Browsing by default.

How long should a campaign value be?

Long enough to be descriptive, short enough to scan. Past roughly 60 characters they become unreadable in reports.

How should employee share links be tagged?

Give people a tool that appends a consistent source and a campaign identifying the programme rather than the person. That keeps attribution clean without turning every employee into a separate source value.