What UTM parameters are, and where each one shows up
A UTM parameter is an ordinary query parameter that analytics tools agree to read. Adding ?utm_source=newsletter to a link does not change the page: the server ignores it, the visitor sees the same content, and Google Analytics records where the visit came from. The name comes from Urchin Tracking Module, the analytics product Google bought in 2005, and the convention outlived it — Matomo, Adobe, Plausible, Fathom and most others read the same five parameters.
- utm_source becomes Session source: where the click came from, such as google, naver, newsletter or a partner’s name.
- utm_medium becomes Session medium: what kind of link it was — cpc, email, social, referral. This is the value GA4 uses to sort traffic into channels, so it matters more than people expect.
- utm_campaign groups everything that belongs to one push: spring-sale, 2026-09-launch, weekly-42.
- utm_term is the paid-search keyword, and utm_content separates two creatives inside the same campaign — banner-a and banner-b, or header-link and footer-link in the same email.
GA4 adds four more. utm_id is a manual campaign ID that joins to campaign data you import into GA4. utm_source_platform records the system that sent the traffic, such as Search Ads 360. utm_creative_format and utm_marketing_tactic are collected but not currently shown in GA4 reports — they still reach BigQuery exports, which is the only reason to fill them.
The three you have to use together
Google’s documentation is unusually direct about this: always use utm_source, utm_medium and utm_campaign together. They are not three independent labels — they are one identity. Send a link with only utm_source and the session is reported with a medium of (not set), which drops it out of every channel report you actually look at.
The most common half-tagged link is the one someone builds by hand in a hurry: a URL with utm_campaign only, so the campaign name shows up in one report while the traffic itself is filed under direct or unassigned. The data is not wrong exactly — it is split across two places, and reconciling it later is impossible because the session is already recorded.
utm_term and utm_content are genuinely optional, and utm_id only matters if you import campaign cost data into GA4 and need the two sides to join. Filling every field is not the goal; filling the three that define the visit is.
utm_medium and why traffic ends up in "Unassigned"
GA4 does not store your channel — it derives it. Every session is matched against a list of default channel group rules, and almost all of those rules look at utm_medium. cpc, ppc and paidsearch become Paid Search. email becomes Email. social becomes Organic Social, while paid_social becomes Paid Social. referral, affiliate and display map to the channels of the same name. Anything the rules do not recognise becomes Unassigned.
Unassigned is where invented mediums go: newsletter, banner-ad, kakao, qr, offline, post. They are perfectly descriptive and completely useless to the channel report, because there is no rule that maps them. If a value describes the platform, it belongs in utm_source; utm_medium should describe the kind of link. kakao is a source, social is its medium.
Two mediums do damage rather than nothing. utm_medium=organic overwrites what Analytics means by organic search, so paid or referred visits get counted as free search traffic. utm_medium=none collides with the (none) that GA4 writes for direct visits. This page flags both.
You can define custom channel groups in GA4 to catch your own mediums, and if your team already has one, the badge on this page will be more conservative than your reports. That is the safer direction to be wrong in.
Naming conventions that still make sense a year later
UTM values are free text, which is exactly the problem. Nothing stops one person writing Facebook, another facebook, and a third fb — and GA4 will faithfully report three separate sources for one channel. The fix is not a tool, it is a convention written down somewhere your team can see, plus the discipline to build links from it rather than from memory.
- Lowercase everything. It is the single rule that prevents the most damage, because case is the split nobody notices until the monthly report.
- Use hyphens, not spaces or underscores, and never mix the two. spring-sale reads cleanly in a URL; spring_sale is fine but has to be the rule everywhere; "spring sale" becomes spring%20sale.
- Put the date in the campaign name when the campaign repeats: 2026-09-launch sorts correctly and never collides with next year’s launch. weekly-42 beats "newsletter" for the forty-second send.
- Keep utm_content for the thing that actually differs — banner-a vs banner-b, header vs footer — so an A/B result is readable without opening the ad platform.
- Never put personal data in a UTM value. The whole string sits in the address bar, gets copied into chats, travels in referrer headers to third-party sites and lands in analytics reports that many people can read. An email address in utm_content is a data leak with a very long tail.
Spaces, capitals, encoding and the # trap
A space cannot survive in a URL, so it gets encoded. Which encoding depends on the tool: form-style encoders write +, URL-style encoders write %20. Analytics reads both as a space, but redirect services, link wrappers and some email platforms do not always agree, and a + that arrives literally turns spring+sale into a campaign whose name contains a plus sign. This page writes %20, and the better answer is still to not use spaces at all.
Capitals are not encoded at all, and that is worse. GA4 treats values as case-sensitive strings, so Facebook, facebook and FaceBook are three different sources with three different session counts. Nothing warns you, no report merges them, and the split is permanent for the sessions already recorded.
Non-ASCII values are legal but painful. A Korean campaign name is percent-encoded into a long unreadable string in the link itself, and some export paths show it that way in reports too. Use ASCII for machine-facing values and keep the human-readable name in a spreadsheet next to it.
Then there is the # trap. Everything after a fragment marker stays in the browser: it is never sent to the server and never reaches Analytics. A link like /page#section?utm_source=newsletter looks tagged and tracks nothing. Parameters go before the #, and the fragment stays at the end — which is exactly what this page does when it rebuilds your URL.
Never tag links inside your own site
This is the mistake that quietly destroys attribution. A visitor arrives from a paid search ad, browses, and clicks a homepage banner you tagged with utm_source=homepage&utm_medium=internal. Analytics sees campaign parameters, decides a new campaign has started, and opens a new session — attributed to your own banner. The paid click that actually brought them is gone from the conversion path.
The damage compounds. Internal campaigns inflate their own numbers while the real acquisition channels look weaker, so budget moves toward the banner that was only ever the second click. The larger the site and the more internal promos it runs, the more the whole report tilts.
For internal promotions, use the tool built for them: GA4’s internal promotion events, or your own query parameter such as ?promo=hero-banner combined with a custom dimension. Both measure the click without resetting the session. Enter your domain in the field above and this page will warn you whenever the destination is your own host.
UTM parameters and auto-tagging (gclid, fbclid)
Ad platforms tag their own clicks. Google Ads appends gclid (or gbraid and wbraid on some app and iOS paths), Microsoft appends msclkid, Meta appends fbclid, TikTok appends ttclid. These IDs carry far more than UTM values can: campaign, ad group, keyword, match type and cost, joined server-side when the account is linked to Analytics.
Adding manual UTM parameters on top of an auto-tagged link is where it gets messy: in GA4 the manual values can override the auto-tagged campaign fields, and you trade a rich, automatically maintained record for whatever someone typed into a form. Google’s guidance for Google Ads is to leave auto-tagging on and not tag manually.
Use manual UTM where nothing tags for you: newsletters, partner links, QR codes, printed material, community posts, sponsorships, app store listings and any platform whose click IDs your analytics does not understand. The rule is one tagging method per link — this page warns when it sees a click ID already in the URL you pasted.
Do you need a link shortener?
Tagged links are long and ugly, so the reflex is to shorten them. There are two situations where shortening genuinely earns its place: printed or spoken links that a person has to type, and platforms with hard character limits. Everywhere else the length costs nothing, because the link is a click target and nobody reads it.
What you give up is worth knowing. The short link belongs to the shortening service: if the service shuts down or the free plan changes, every printed poster and every old post points at nothing. Click data — who clicked, from where, when — passes through a third party. And a shortened link hides the destination, which makes it look less trustworthy in messengers and gets it filtered more often by spam rules.
That is why this page does not shorten. Everything here runs in your browser, and a shortener would mean sending your links to someone else’s server — the opposite of how the rest of the tool works. If you need a short link, run your own redirect on a domain you control (go.example.com/promo) so the link, the data and the expiry stay yours.
For print and offline, skip the shortener and use a QR code instead: nobody types a URL from a poster anyway, and a QR carries the full tagged link with no third party in the middle. The button under the result sends the finished URL straight to the QR generator on this site.