UTM parameters: the mistakes that ruin your analytics

Broken UTM data almost never comes from misunderstanding the spec — it comes from five specific habits: inconsistent capitalization, tagging internal links, unencoded spaces, a naming taxonomy every person invents on the fly, and enormous tagged URLs pasted into organic channels. The parameters themselves are simple and have not changed in two decades. What breaks is the discipline around them, and the damage is invisible: you do not get an error, you get three plausible numbers where there should be one. You can build tagged campaign URLs in your browser, without the destination or the campaign names ever leaving your machine.

What the five parameters actually do

Only three of them do daily work. It helps to know exactly which question each one answers before you pick a value:

• utm_source — the specific place the click came from: mailchimp, linkedin, reddit, partner-acme. The most granular of the five.
• utm_medium — the category that place belongs to: email, social, cpc, affiliate, referral. This is the field default channel grouping reads, which is why inventing values like newsletter or emailblast sends that traffic to a generic bucket instead of the Email channel.
• utm_campaign — the effort everything rolls up into: 2026-08-pro-launch. Without it you have sources but nothing to compare.
• utm_term — originally the paid keyword. Ad platforms auto-tag their own click IDs now, so most teams can safely ignore it.
• utm_content — separates variants inside one campaign: header-button vs footer-link, version A vs version B. The one optional parameter still worth using.

There is a lesser-known sixth, utm_id, used to join campaign data with cost figures imported from outside. If you are not importing ad spend, skip it.

Mistake 1: inconsistent capitalization

Parameter values are compared as plain strings, so Email, email and EMAIL land as three separate rows in your acquisition report. Same with LinkedIn and linkedin. Nothing warns you, nothing looks broken — your campaign simply reports a third of its real traffic three times over, and whoever reads the dashboard draws the wrong conclusion. One rule, no exceptions: lowercase everything.

Mistake 2: tagging internal links

This is the expensive one. When a visitor who is already on your site clicks an internal link carrying UTMs — a homepage banner, a related-products module, a promo bar — analytics interprets it as a brand new campaign. It ends the current session, starts another, and attributes everything that follows to your own internal tag. The organic search result or the newsletter that genuinely brought that person in vanishes from the report, and your homepage banner shows up as the top converting "source" of the quarter.

UTMs are for inbound traffic only. If you want to know how an internal element performs, that is an event, not a URL parameter.

Mistake 3: spaces and unencoded characters

utm_campaign=summer sale is a broken link. Plenty of email clients and text editors cut the URL at the first space, so a share of your clicks land on a 404 or on an untagged page. The same applies to &, which analytics reads as the start of another parameter, and to +, which inside a query string already means "space". The practical answer is to never use those characters in a value and to join words with hyphens. If you genuinely need to keep one, run the value through the URL encoder before assembling the link.

Mistake 4: one taxonomy per person

Without a written convention, the same network ends up recorded as fb, facebook, facebook-ads, Facebook_Ads and meta, depending on who built the link that afternoon. No report will ever group those together, and you cannot fix it retroactively — historical hit data does not get rewritten. A short, closed list of approved values, stored somewhere the whole team can reach, beats any clever reporting workaround.

Mistake 5: giant tagged URLs in organic channels

Pasting a URL with 120 characters of tracking into a social bio, a printed QR code or an organic post causes two problems. People copy and reshare that exact link, so your August campaign keeps collecting visits in November from forums and group chats that were never part of it. And those variants can be crawled and indexed as duplicates of the real page if the destination does not declare a proper canonical. For links meant to live a long time or to be shared onward, tag lightly — or not at all.

A naming convention that survives your team

Beyond the parameter names themselves there is no official standard, so the convention is yours to set. This one holds up:

• Lowercase, always. Not negotiable, not a style preference.
• Hyphens as the separator, never spaces and never a mix of hyphens and underscores. The same reasoning behind a clean URL slug applies here.
• A closed list for utm_medium: cpc, display, email, social, affiliate, referral, qr. Adding a value is a team decision, not an afternoon improvisation.
• utm_source is the platform, not the category. Writing social in source just duplicates the medium and throws away the useful detail.
• Date-first campaign names: 2026-08-pro-launch. They sort chronologically on their own, and a year later nobody has to guess what "summer-promo" referred to.
• No personal data, ever. The URL is visible, users share it, and it is logged by everything it passes through. Keep email addresses, customer IDs and internal project code names out of parameters.

Once the convention is written down, stop typing URLs by hand. The UTM builder assembles the full link and hands it over ready to copy; if the destination is a poster, a booth or product packaging, generate the QR code from the already-tagged URL so you are not reprinting it when someone notices the medium was missing.

When not to tag at all

• Internal links on your own site, for the reason above.
• Ad campaigns with auto-tagging enabled. If the platform already appends its own click ID and is linked to your analytics property, adding manual UTMs on top can override the data coming through that integration.
• Transactional email — receipts, password resets, shipping notifications. They are not campaigns and they only add noise.
• URLs you want other people to link to: documentation, pricing, an article you hope gets cited. That address should be the clean one.
• Footer and legal links. Nobody is going to analyze the performance of your privacy policy link.

What UTMs will never tell you

Worth being honest about the ceiling here. A UTM describes one arrival, not a journey: if someone finds you in a newsletter, comes back two days later by typing your domain, and buys a week after that, the report credits the last recorded interaction rather than the newsletter. They also leak. Some browsers and mail clients strip known tracking parameters, and ad platform click IDs are usually the first to go, so tagged traffic is systematically undercounted by an amount you cannot measure. Read the numbers as orders of magnitude for comparing campaigns against each other, not as an exact count — the same posture worth taking with free SEO tools generally.

Frequently asked questions

Related tools

• UTM builder — Assembles the full campaign URL with correct encoding.
• URL encode/decode — For values that carry spaces, accents or reserved symbols.
• QR code generator — Turn the tagged URL into a code for print and packaging.
• Slug generator — Lowercase, hyphenated campaign names with no surprises.

You might also like: free SEO tools that respect your privacy and what a URL slug is and how to write one.