What the five parameters are for
utm_source names the specific origin of the click, utm_medium names the kind of channel, and utm_campaign is the label that ties every link in one push together. Those three are effectively mandatory. utm_term holds a paid search keyword and utm_content distinguishes variants within a campaign — banner A from banner B, the header link from the footer link. Analytics platforms store all five as opaque strings and group by exact match, which is the single most important thing to understand about them: they are not validated, not corrected and not normalised on arrival. A typo does not produce an error, it produces a new row. The link is assembled in your browser and nothing is sent anywhere.
Case and spaces
Instagram and instagram report separately, and by the time you notice, the traffic is already split across two lines that have to be added together by hand for every period you look at. Since there is no upstream normalisation to rely on, the practical answer is a convention everyone follows, and all-lowercase is the easiest convention to enforce, which is why it is on by default here. Spaces are worse than a case mismatch: they encode to %20, which makes the link unreadable and, more importantly, fragile — a space that survives unencoded into an email client will often get the link truncated at that point. Hyphens are the usual replacement and read better in a report than underscores, though either works as long as you pick one.
Medium values GA4 recognises
GA4 maps traffic into default channel groups using rules that look at the source and medium together, and the medium is what does most of the work. cpc, ppc and paid route to paid channels, email to Email, social to Organic Social, referral to Referral, display to Display, affiliate to Affiliates. Invent your own — emailer, insta, newsletter in the medium slot — and the traffic lands in Unassigned, where it is easy to miss entirely. This tool flags a medium that is not on the common list. It is a nudge, not a rule, since custom channel groups are a legitimate thing to configure; but if you have not configured one, the standard values are what your reports are built on.
Where UTM links do not belong
They are for inbound links from somewhere else. Put one on an internal link and the analytics session restarts and attributes the visit to the new source, so a user who arrived from a paid ad and then clicked a tagged internal banner is recorded as arriving from the banner. The original attribution is gone. The second trap is search engines indexing a tagged URL, which makes one page look like several and splits its ranking signals; a canonical tag pointing at the clean URL is the standard defence. Both of these are quiet failures — nothing errors, the numbers just stop meaning what you think they mean — which is the argument for keeping a spreadsheet of every link you generate, with the destination, the five values, the date and who made it. Six months later, that sheet is the only way to work out what an unfamiliar campaign name in a report referred to.
Questions people ask
The destination already has query parameters.
They are kept and the UTM parameters are appended with &. If a utm_ parameter of the same name is already on the URL, its value is replaced rather than duplicated, which is what you want when you are re-tagging a link someone sent you. Non-UTM parameters are never touched.
Why is my traffic showing as (not set)?
Usually one of the three core parameters is missing or misspelled — utm_soruce is a classic, and since nothing validates the name, an unrecognised key is simply ignored. The other common cause is a redirect in the path: a shortener or a marketing platform that bounces the click through an intermediate URL will sometimes drop the query string entirely. Test the finished link by clicking it and checking that the parameters are still in the address bar when the page settles.
Do UTM parameters survive a link shortener?
Yes. A shortener issues a redirect to the full URL, parameters included, so analytics on the destination sees them normally. What a shortener does change is that the parameters become invisible to the person clicking, which is sometimes the reason to use one — a bare tracking link in a printed piece or a chat message looks like spam.
Can I use non-Latin characters in the values?
They work, but they percent-encode to three or four sequences per character, so the link gets long fast and becomes hard to read or repair by hand. Reports will show the decoded value correctly. The practical argument for ASCII is not correctness, it is that someone will eventually need to type one of these values into a filter box.