UTM Parameters: The Five Fields and the Discipline That Makes Them Work

Five fields, one job each

The parameters are appended to the query string of a landing page URL and read by the analytics library when the page loads. utm_source names the specific origin — facebook, a partner's domain, the name of a newsletter. utm_medium names the kind of channel — email, cpc, social — and it is the field your channel reports group on, so it needs the tightest vocabulary. utm_campaign names the initiative that ties several links together. utm_term carries a paid keyword, a survival from the search-advertising era. utm_content distinguishes two links or two creatives that are otherwise identical: the header button against the footer link, image A against image B.

Two rules keep the set coherent. Fill source and medium together or not at all — a source with no medium lands in an unattributed bucket in most tools, which is worse than leaving the link untagged. And never tag a link you do not control the destination of, because the parameters only work if your own analytics is what reads them.

Attribution breaks on values, not on mechanism

Nothing about the mechanism is difficult. What breaks reporting is that three people tag three links and write the same source three ways. RFC 3986 makes the query component of a URL case-sensitive, and analytics tools generally preserve that, so Facebook, facebook and FB are three distinct strings and therefore three distinct rows. Nobody notices for a quarter, because each row looks plausible on its own.

The cost is not only cosmetic. Suppose the real channel delivered 12,000 sessions and 360 conversions, a 3% rate, and the casing split it 7,000 / 3,500 / 1,500. Those fragments carry 210, 105 and 45 conversions. On the full 12,000 the 95% confidence interval around a 3% rate has a half-width of 0.31 percentage points; on the 1,500-session fragment it is 0.86 points, 2.8 times wider. So the fragmentation does not merely hide the channel's true size in a ranked list — it makes every fragment's performance too noisy to act on, and it will do that quietly for as long as nobody adds the rows up.

Tagging an internal link is the most expensive mistake

Someone wants to know how a homepage banner performs, so they put UTM parameters on it. The analytics library sees campaign parameters arriving on a page view and does what it is designed to do: it ends the current session and starts a new one, attributed to the new source. Everything the visitor had already been credited to is severed at that click. The original campaign keeps whatever happened before, and the internal banner is credited with everything after.

Cost it out. A campaign brings 10,000 sessions that produce 300 conversions worth an $80 average order — $24,000, a 3.0% conversion rate and $2.40 per session. Now tag one internal link that a quarter of those visitors click. Two thousand five hundred sessions are cut in half and restarted, so the tool reports 12,500 sessions where 10,000 people visited. If 60% of the conversions close after that click, the campaign is left with 120 conversions on its 10,000 sessions — 1.2% and $9,600 — while the internal banner shows 180 conversions on 2,500 sessions, a spectacular 7.2% and $14,400 of revenue it did not generate. Nobody bought anything different. Fourteen thousand four hundred dollars of credit simply moved to the wrong row, and the campaign that earned it now looks like a channel to cut.

The damage spreads past attribution. Because the denominator inflated from 10,000 to 12,500 while the conversions stayed at 300, the site-wide conversion rate reads 2.4% instead of the true 3.0% — understated by a fifth. Pages per session fall from 6.0 to 4.8 for the same reason, and bounce rate rises, because the second half of a split visit begins on a page the visitor may leave from immediately. Every engagement metric on the site degrades slightly, and none of it is a real change in behaviour. If you need to measure an internal banner, use your analytics tool's own internal-link or event tracking, which was built for exactly this and does not touch the session.

The tags are public, and they travel

A tagged URL is visible in the address bar, copied when someone shares the page, stored in browser history, kept in server logs and often indexed by search engines. That has three consequences worth planning for. First, a link you sent to one newsletter will be pasted into forums and messaging apps, so a slice of what your reports call newsletter traffic is really word of mouth arriving on a borrowed tag — the effect is small but it always runs in the direction of overstating the tagged channel. Second, a tagged URL that gets indexed competes with the clean URL for the same page; a correct canonical tag on the page is what keeps that from splitting your search signals.

Third, and without exception: nothing private goes in a UTM value. No email address, no customer identifier, no order number, no token. The parameters are logged, shared, indexed and readable by the visitor, and utm_content in particular is where people are tempted to slip a recipient identifier so they can trace an individual click. Do not. If you need per-recipient measurement, your email platform already does it inside its own reporting, without publishing the identifier in a URL that the recipient can forward to anyone.

The convention that survives contact with a team

Everything that keeps UTM data usable is a naming rule, and naming rules only hold if they are short enough to memorise. Lowercase everywhere. Hyphens between words, never spaces or underscores. A closed vocabulary for medium, written down, with one owner allowed to add to it. A date prefix on campaign names so reports sort chronologically and a colleague can read them a year later. Source is a place, medium is a kind of place, campaign is a reason, term is a keyword, content is a variant — and if a value does not fit one of those five sentences, the field is the wrong home for it.

Enforce it with a builder rather than with a document. If every tagged link is produced by the same tool and logged in the same sheet with an owner and a date, the convention holds without anybody policing it; if it lives in a wiki page, you will meet FB again within a quarter. The same instinct that makes you keep URL slugs short, lowercase and hyphenated applies here, for the same reason: a machine will group these strings exactly, and exactness is entirely on you.

When the tags are already a mess

Do not try to rewrite history. The parameters are recorded with the sessions that arrived, and you cannot retag a visit from last March. What you can do is draw a line. Publish the convention, set a start date, and from that date forward every new link follows it. In your reporting layer, build a mapping table that folds the historical variants — Facebook, FB, fb.com — into one canonical source so that year-on-year comparisons still work. That mapping is small, it is written once, and it is the honest way to reconcile two eras of data without pretending the earlier one was clean.

Frequently asked questions

Are UTM parameters case-sensitive?

Yes, in practice. RFC 3986 makes the query component of a URL case-sensitive, and most analytics tools preserve the distinction, so Facebook, facebook and FB become three separate sources. Nothing merges them for you afterwards, so the only defence is to write every value in lowercase, always, and to generate links with one builder rather than by hand.

Can I put UTM parameters on internal links to track a banner?

No — this is the most damaging UTM mistake there is. Campaign parameters arriving on a page view end the current session and start a new one, so the source that actually brought the visitor loses every conversion that follows the click. In the worked example, 300 conversions worth $24,000 become 120 worth $9,600 for the real campaign while an internal banner is credited $14,400 it never earned. Use your analytics tool's event or internal-link tracking instead; it was built for this and leaves the session intact.

Which UTM parameters are required?

In practice, source and medium together, plus campaign whenever the link belongs to an initiative you will want to report on as a unit. Filling source without medium usually drops the visit into an unattributed bucket, which is worse than no tagging at all. Term and content are optional and should stay empty unless you genuinely have a paid keyword or two variants of the same link to tell apart.

Do UTM parameters hurt SEO?

Not by themselves, but a tagged URL that gets shared and indexed competes with the clean URL for the same page. A correct canonical tag pointing at the parameter-free version is what stops your signals from splitting across variants. Never use UTM parameters on internal navigation, which is both a crawl problem and the attribution disaster described above, and keep the underlying slug short and lowercase so the clean URL is the one people copy.

Why does my campaign show up as direct traffic?

Usually because the parameters never reached the page. The most common cause is a redirect that drops the query string between the link and the final URL — the tagging vanishes silently, with no error anywhere. Other causes are a link shortener or app that strips parameters, a typo in a parameter name, or a landing page whose analytics fires before the parameters are read. Test the finished URL end to end, through every redirect, before the campaign ships.