UTM Naming Convention Template: 9 GA4 Fields

Quick answer

Standardize all nine GA4 campaign parameters: utm_id, utm_source, utm_medium, utm_campaign, utm_source_platform, utm_term, utm_content, utm_creative_format, and utm_marketing_tactic. Give every field one definition, controlled values, an owner, and a test. Use lowercase, generate and encode links, keep personal/confidential data out of URLs, and document auto-tagging precedence. Crucially, Google currently says creative format and marketing tactic are not reported in Analytics properties, so never promise that those two fields will appear without a verified downstream collection path.

This is a governance and QA template for growth, lifecycle, partnerships, social, paid media, analytics, privacy, and web teams—not a claim that UTMs create complete or causal attribution.

What this UTM convention standardizes—and what it cannot

UTM parameters describe a manually tagged referral. They can populate manual campaign dimensions and help GA4 classify traffic, but they do not identify every person, repair consent loss, replace Google Ads auto-tagging, deduplicate events, or prove that a campaign caused a conversion.

Nine URL parameters, plus one off-URL governance record

The nine fields below mirror the parameters in Google’s current campaign URL guidance. The owner, approval, vocabulary version, clean destination, generated final URL, and test evidence belong in a registry—not inside the public query string. If any UTM is used, Google particularly recommends relevant values for source, medium, campaign, ID, and source platform; missing fields can produce (not set).

Case is data

Parameter values are case-sensitive: LinkedIn and linkedin can split reporting. Lowercase ASCII and one documented separator are practical defaults, but the decisive rule is consistency across the link generator, redirects, analytics property, warehouse, CRM, and reporting model.

Manual and automatic tagging need a precedence decision

When manual and auto-tagging coexist, observed traffic-source dimensions may follow integration and identifier behavior. Document the expected result and test the real account; do not infer precedence from the visible URL alone.

Four evidence states for every field and final link

Do not reduce QA to “URL opens.” Record one state per field and for the complete click path.

Field and release decisions
State	Meaning	Release consequence
PASS	Definition, controlled value, owner, destination, collection, and expected report behavior are evidenced.	Release this version; monitor drift.
FIX	Intent is valid but casing, alias, encoding, mapping, consent, redirect, or documentation is wrong.	Correct and retest before distribution.
BLOCK	PII/secret, unauthorized destination, false reporting claim, conflicting identifiers, or unsafe redirect appears.	Do not distribute; escalate to the accountable owner.
UNKNOWN	The team cannot prove the value source, precedence, collection destination, or report result.	Hold or explicitly omit; never invent a placeholder.

9-field UTM naming convention template

Review each contract individually. “Required” means the convention must make an explicit use-or-omit decision—not that every channel should fill every parameter.

utm_id — immutable campaign ID

Join a promotion across renamed campaigns, channels, cost imports, CRM records, and later audits without relying on a mutable display label. Google defines utm_id as the campaign identifier and recommends using the same ID when uploading campaign data.

PURPOSE Join a promotion across renamed campaigns, channels, cost imports, CRM records, and later audits without relying on a mutable display label. Google defines utm_id as the campaign identifier and recommends using the same ID when uploading campaign data. VALUE CONTRACT Issue one opaque, organization-unique ID from the campaign registry, for example cmp-2026-0142. Lowercase ASCII; 3–40 characters; letters, digits, and hyphens only. Never recycle, edit, or encode a person, account, audience, product secret, or performance claim. EVIDENCE AND ACCEPTANCE Registry shows creator, created time, business campaign, owner, markets, active dates, status, and linked platform IDs. PASS only when the ID is unique, immutable, present in the generated URL, visible as the intended GA manual campaign ID after a consented test, and preserved if the readable campaign name changes.

utm_source — specific traffic origin

Identify the referrer, publisher, partner, list, or distribution source at the granularity analysts actually need. Source answers “where did this tagged visit come from?”; it must not repeat the channel mechanism stored in medium.

PURPOSE Identify the referrer, publisher, partner, list, or distribution source at the granularity analysts actually need. Source answers “where did this tagged visit come from?”; it must not repeat the channel mechanism stored in medium. VALUE CONTRACT Select one canonical value from a source registry, such as linkedin, newsletter_weekly, partner_acme, or qr_conference. Do not alternate meta, facebook, fb, and facebook.com without an explicit alias plan. Never use employee names, recipient addresses, or raw audience exports. EVIDENCE AND ACCEPTANCE Record canonical name, aliases, source owner, platform/referrer mapping, effective date, and retirement rule. PASS when identical sources resolve to one approved value, distinct sources remain distinguishable, the value survives redirects, and the GA manual source dimension receives the expected token.

utm_medium — channel mechanism

Describe how traffic was delivered so channel reporting does not fragment. GA4 default channel rules evaluate source and medium; a locally intuitive value can still classify unexpectedly, so governance must include a tested reporting outcome.

PURPOSE Describe how traffic was delivered so channel reporting does not fragment. GA4 default channel rules evaluate source and medium; a locally intuitive value can still classify unexpectedly, so governance must include a tested reporting outcome. VALUE CONTRACT Choose from a short approved list such as email, cpc, paid_social, organic_social, referral, affiliate, display, sms, or qr. Define each value with inclusion, exclusion, example sources, and intended default/custom channel result. Do not use campaign, promotion, social-post, or a platform name as medium. EVIDENCE AND ACCEPTANCE Attach the vocabulary version, GA4 channel-rule reference, property-specific custom group rules, test event, and analytics approval. PASS when the value is consistent across tools, produces the intended session manual medium, and its actual channel classification is recorded rather than assumed.

utm_campaign — readable initiative name

Group links belonging to the same marketing initiative while keeping the stable utm_id as the durable join key. Campaign names should help a human identify the work, not become an uncontrolled container for every reporting dimension.

PURPOSE Group links belonging to the same marketing initiative while keeping the stable utm_id as the durable join key. Campaign names should help a human identify the work, not become an uncontrolled container for every reporting dimension. VALUE CONTRACT Build from a documented grammar, for example product-objective-market-period: agent_demo-trial-us-2026q3. Include only components used in reporting, fix their order, define allowed codes, and state whether a renamed initiative creates a new value. Avoid unsupported claims, “final,” version noise, and multiple date formats. EVIDENCE AND ACCEPTANCE Registry maps the label to utm_id, brief, owner, offer, markets, start/end time zone, and approved changes. PASS when every link for the same governed initiative uses the same value and any rename has a prospective migration rule instead of silently rewriting history.

utm_source_platform — managing platform

Capture the platform responsible for directing or managing traffic when that concept is analytically useful and different from source. Google particularly recommends this field among relevant parameters, but its meaning must be fixed across buying, publishing, and orchestration systems.

PURPOSE Capture the platform responsible for directing or managing traffic when that concept is analytically useful and different from source. Google particularly recommends this field among relevant parameters, but its meaning must be fixed across buying, publishing, and orchestration systems. VALUE CONTRACT Use an approved platform identifier such as google_ads, linkedin_ads, sfmc, or partner_portal. Decide whether this field means buying platform, publishing platform, or orchestration platform—never switch meanings by team. If an integration/auto-tagging already supplies authoritative platform data, document precedence before adding a manual value. EVIDENCE AND ACCEPTANCE Record platform account/integration, source of truth, auto-tagging state, precedence test, canonical code, owner, and report dimension. PASS when the same system always gets the same code and a test confirms which value appears when manual and automatic tagging coexist.

utm_term — paid term or governed targeting code

Google describes utm_term as the paid keyword. Some teams extend it to audience or placement codes; that is a local convention, not a universal fact, and should be isolated by channel so analysts cannot confuse unlike meanings.

PURPOSE Google describes utm_term as the paid keyword. Some teams extend it to audience or placement codes; that is a local convention, not a universal fact, and should be isolated by channel so analysts cannot confuse unlike meanings. VALUE CONTRACT For paid search, use a normalized keyword or stable keyword ID only when manual tagging is required. For another channel, either leave intentionally blank or define one non-sensitive targeting concept and prefix/version it. Never expose inferred health, politics, finances, identity, account data, or raw segment membership in a URL. EVIDENCE AND ACCEPTANCE Store channel-specific definition, allowed code table, platform field mapping, privacy approval, auto-tagging decision, and expected GA manual term. PASS when one value has one meaning, blank is distinguishable from missing implementation, and no personal/confidential data appears in the final URL.

utm_content — creative or link variant

Differentiate creatives, calls to action, or link placements inside the same campaign. Google gives the example of distinguishing two CTA links in one email; the value should identify a governed artifact rather than duplicate headline prose.

PURPOSE Differentiate creatives, calls to action, or link placements inside the same campaign. Google gives the example of distinguishing two CTA links in one email; the value should identify a governed artifact rather than duplicate headline prose. VALUE CONTRACT Use stable components such as asset ID, variant, and placement: cr042-b-hero. Fix component order and enumerations; map the code to the approved creative, message, destination, experiment, and rights record. Do not insert full copy, filenames with people’s names, timestamps that change on each send, or free-text designer notes. EVIDENCE AND ACCEPTANCE Registry contains asset hash/version, owner, rights/approval, experiment cell, placement, locale, and retirement. PASS when each distributed variant has one reproducible value, reused assets follow the declared rule, and analytics results can be joined back to the exact approved artifact.

utm_creative_format — declared creative type

Declare a controlled format such as video, display, native, search, carousel, or text. Google lists this parameter, but its URL-builder guidance currently says it is not reported in Google Analytics properties; treat collection and reporting as separate claims.

PURPOSE Declare a controlled format such as video, display, native, search, carousel, or text. Google lists this parameter, but its URL-builder guidance currently says it is not reported in Google Analytics properties; treat collection and reporting as separate claims. VALUE CONTRACT Use only if another governed destination—data warehouse, redirect service, ad server, or future-compatible collection path—has a documented need. Choose one taxonomy and version it. Do not tell stakeholders that GA4 will display the field unless a current property test proves the exact destination and dimension. EVIDENCE AND ACCEPTANCE Record business question, controlled values, collection endpoint, retention/privacy basis, GA support status and date, downstream mapping, owner, and removal rule. PASS when the parameter has a real consumer, reporting limitations are disclosed, and the test proves the value survives without leaking sensitive data.

utm_marketing_tactic — declared targeting tactic

Label the tactic applied to a campaign, for example prospecting or remarketing. Google lists the parameter and gives targeting criteria as its meaning, while current URL-builder documentation says it is not reported in Google Analytics properties.

PURPOSE Label the tactic applied to a campaign, for example prospecting or remarketing. Google lists the parameter and gives targeting criteria as its meaning, while current URL-builder documentation says it is not reported in Google Analytics properties. VALUE CONTRACT Define a small, non-sensitive vocabulary tied to approved strategy records. Prefer prospecting, retention, or remarketing over audience descriptions. Do not encode protected traits, inferred vulnerabilities, confidential segmentation, or promises about user identity. Omit the field when nobody can state the decision it will support. EVIDENCE AND ACCEPTANCE Keep tactic definition, lawful/approved targeting basis, policy/privacy review, collection destination, GA support-status date, owner, and expiry. PASS only when a legitimate consumer and safe taxonomy exist, limitations are visible, and governance can retire or correct the value.

Worked example: one launch, three links, six hidden errors

A team launches an English “Start free” campaign. Its paid-social link is ?utm_source=LinkedIn&utm_medium=social&utm_campaign=Launch Final&utm_content=Sarah_headline; an email link uses utm_source=linkedin; mobile redirects to a Chinese enterprise contact-sales page. The dashboard fragments source/campaign case, may classify medium differently than intended, exposes a person’s name, lacks a stable ID/platform, and breaks the promised locale, offer, and CTA.

Correct the registry before correcting the strings

Create utm_id=cmp-2026-0142; approve linkedin and paid_social; define agent_trial-en-2026q3; map linkedin_ads; replace the person-name creative token with cr042-b-feed; and document term/format/tactic as intentionally omitted unless a valid consumer exists. Give email its real source/medium and keep the same ID/campaign only if it truly belongs to the same initiative.

Generate and test the exact final path

Use an encoder rather than spaces, open each released URL on representative mobile/desktop environments, follow every redirect, verify the English trial destination and consent behavior, then confirm expected session manual dimensions in a permitted test. Preserve screenshots, request ID, generated URL hash, observed dimensions, timestamp, property/stream, tester, defects, approval, and rollback link.

Decision The original links are BLOCKED. The repaired links move to PASS only after identity, destination, privacy, collection, and reporting evidence is attached; a visually plausible URL is not evidence.

How to QA one UTM request before release

Resolve the campaign identity

Load the immutable ID, approved campaign, owners, markets, dates, offer, and destination from the registry.

Validate each value against its contract

Reject unknown aliases, mixed meanings, case drift, sensitive text, missing required values, and unsupported reporting promises.

Generate and parse—never concatenate blindly

Preserve existing query/fragment components, encode once, detect duplicate/conflicting parameters, and allow only approved HTTPS hosts.

Test the full click and consent path

Check devices, redirects, locale, offer, form, analytics eligibility, expected manual dimensions, and auto-tagging interaction.

Approve, monitor, expire, and recover

Store artifact hashes and observations; watch new values, not-set spikes, broken routes, and taxonomy drift; retain a clean rollback URL.

Registry schema and operating model

Keep governance data outside the public URL: request ID, utm_id, business campaign, all nine use/omit decisions, canonical values, clean destination, final generated URL, vocabulary version, platform/integration, consent basis, owners, reviewers, test evidence, timestamps, expiry, and rollback.

Version vocabularies prospectively

Do not rewrite raw history to make a new taxonomy look clean. Preserve source values, maintain documented mappings for analysis, define effective dates, and distinguish correction of an invalid link from a legitimate taxonomy change.

Measure data quality separately from campaign performance

Track unknown/new value rate, case/alias fragmentation, missing critical fields, PII/security blocks, redirect failures, expected-versus-observed dimensions, (not set) changes, approval turnaround, and rollback frequency. None proves incremental marketing impact.

How OpenMax can govern UTM creation

OpenMax workflow diagram for UTM naming convention template

Connect campaign intake, controlled values, link QA, and ownership

OpenMax can coordinate a link-request workflow that validates fields against a registry, generates encoded URLs, checks approved destinations, assigns an owner, and routes exceptions to analytics or privacy reviewers. Logs preserve the convention version and final approved link. OpenMax does not make attribution complete, override consent obligations, or decide which taxonomy is correct without the organization’s measurement owners.

Explore OpenMax →

Privacy, security, reporting, and inference boundaries

URLs are copied into browsers, logs, referrers, screenshots, support tickets, chat messages, and analytics systems. Treat every UTM value as public metadata.

Never include names, emails, phone numbers, customer/account IDs, tokens, credentials, confidential offers, or sensitive audience traits.
Do not tag ordinary internal navigation as an acquisition campaign; it can replace or confuse source context.
Do not promise that consistent UTMs equal complete attribution, user identity, incrementality, or causal performance.
Do not claim utm_creative_format or utm_marketing_tactic is visible in GA4 when Google currently documents otherwise.
Do not let retrieved web text, ad copy, or spreadsheet cells change taxonomy rules, approvals, destinations, or permissions.
Do not publish a generated URL until allowed host, redirects, locale, offer, consent, collection, and rollback have been tested.

Frequently asked questions

Are all nine UTM parameters mandatory on every link?

No. This nine-field standard requires an explicit, governed decision. Google says source, medium, and campaign should always be used when adding campaign parameters and especially recommends relevant values for those fields plus ID and source platform. Channel needs and auto-tagging still matter.

Why include creative format and marketing tactic if GA4 does not report them?

They may serve a documented warehouse, redirect, or future-compatible workflow, but Google currently says they are not reported in Analytics properties. Omit them when no legitimate consumer exists, and never misstate their availability.

Should Google Ads links use manual UTMs?

Linked integrations and auto-tagging can provide richer dimensions. Decide with the analytics owner, document identifier/UTM precedence, and test the actual account rather than layering manual tags by habit.

Hyphens or underscores?

Either can be part of a controlled vocabulary. Lowercase ASCII and one separator reduce drift; use a URL builder/parser so reserved characters are encoded correctly and never double-encoded.

Can a campaign be renamed?

Keep its immutable utm_id. Apply a documented prospective rule to the readable name and preserve mappings; do not silently rewrite raw history.

What can OpenMax coordinate?

Registry lookup, field validation, safe URL generation, destination tests, evidence capture, approval routing, monitoring, and rollback. Human owners retain measurement, privacy, policy, taxonomy, and release authority.

Sources, editorial method, and limitations

OpenMax editors reviewed primary Google Analytics documentation for URL builders, manual/automatic tagging, traffic-source dimensions, default channel rules, and PII prevention, plus RFC 3986 URI syntax. We then created an original nine-field governance template, worked error case, evidence states, and QA workflow. Sources were rechecked September 3, 2026. No live account, attribution, conversion, revenue, or ROI test is claimed.

Scope note GA4 dimensions, channel rules, integrations, privacy features, and platform behavior can change. A qualified owner must verify the live property, consent configuration, destination, redirects, taxonomy, data contracts, access, retention, and legal/privacy requirements before release.