Campaign tracking with UTM tags, without cookies
Published 28 October 2026 · 6 min read
Every link you publish yourself, in a newsletter, a social post, an ad or a partner's page, can say where it was published. The convention for that is five URL parameters, the UTM tags. They are the most reliable source information analytics ever gets, because you wrote them, and they need no cookie at all: the information travels in the link.
This article covers what each tag is for, how to tag links so the reports stay readable, how a tagged visit is credited, and what a privacy-first tool should and should not read from a URL.
The five tags
Google's URL builder documentation, which set the convention most tools follow, describes them like this (Google Analytics: collect campaign data with custom URLs):
| Tag | What it says | Example |
|---|---|---|
utm_source | "Referrer" | newsletter, google, billboard |
utm_medium | "Marketing medium" | email, cpc, banner |
utm_campaign | "Product, slogan, promo code" | spring_sale |
utm_content | "Use to differentiate creatives" | header-button, footer-link |
utm_term | "Paid keyword" | pumpkin soup |
The same page says to always use the first three, and that values are case sensitive: utm_source=google is a different value from utm_source=Google.
A tagged newsletter link looks like this:
https://example.com/pricing?utm_source=newsletter&utm_medium=email&utm_campaign=autumn-sale&utm_content=header-buttonTag the links you control, and only those
- Tag every link you publish outside your site: newsletters, social posts, ads, a partner's page, a QR code on a poster. Each is a visit that would otherwise arrive as a bare referrer, or as nothing at all: email apps and many social apps send no referrer.
- Never tag links between your own pages. A tag on an internal link tells the analytics that a visit started there, and can replace the source the visit really came from.
- Pick a spelling and keep it. Lowercase, with hyphens, written down where everyone who publishes links can find it.
Email,emailande-mailare three rows in every report. - Use the medium for the kind of channel, and the source for the place.
utm_medium=emailandutm_source=newsletter, not the other way round: the medium is what decides whether a visit counts as Email, Social or Paid Search.
A naming sheet
The cheapest fix for messy campaign reports is a short sheet that everyone who publishes links can see. For a small team it can be this simple:
| Where the link goes | utm_source | utm_medium | utm_campaign |
|---|---|---|---|
| The monthly newsletter | newsletter | email | the issue, such as 2026-10 |
| A post on a social network | the network, such as mastodon | social | the launch, such as autumn-sale |
| A paid search ad | google | cpc | the ad campaign's name |
| A partner's page | the partner, such as partnerblog | referral | the deal, such as spring-bundle |
| A poster's QR code | poster | qr | the event, such as conf-2026 |
Use utm_content when one campaign has several links in one place, such as the header button and the footer link of the same email, and utm_term for paid keywords. Anything else is better as a campaign name than as a new tag.
How a tagged visit is credited
A visit has one source, and analytics has to decide which. A sensible order is: the tagged link first, because it is the most deliberate statement of where the visit came from; then an advertising click identifier; then the referring site; and only with none of them, Direct.
The medium then decides the channel. cpc or ppc is Paid Search, email or newsletter is Email, social is Social, paid-social is Paid Social. A medium nobody recognises is honest as Referral: a campaign brought the visit, but it does not say how.
The question that matters most is how long a tag's credit lasts. With a cookie, a tool can remember a campaign for weeks and credit it with a purchase made on a later visit. Without one, the credit lasts as long as the visit. A person who arrives from a newsletter on Monday and comes back by typing the address on Thursday is a newsletter visit on Monday and a direct one on Thursday. For most decisions that is the right answer anyway: it compares what each campaign brought on the day it was clicked. The conversion article covers what it means for goals and funnels.
What a URL should not give away
A landing URL can carry far more than campaign tags: an email address in a sign-up link, a password-reset token, an order number. A tool that stores the whole URL stores all of that. Reading only the five tag names, and the other campaign parameters a tool documents, and ignoring the rest of the query string, is what keeps campaign tracking from becoming a way of collecting who people are.
Advertising click identifiers, such as gclid, are a per-click token. A privacy-first tool can note that one was present, which says the visit came from an ad, without keeping its value.
Common questions
Do UTM tags need consent?
The tags themselves are part of the link and are not stored on the visitor's device. Whether the analytics that reads them needs consent depends on what else it does, such as storing an identifier; the cookieless analytics article explains.
Should I tag links that assistants and search engines show?
You cannot: they write their own links. Some assistants tag the links they show; the AI assistant traffic article explains how those visits arrive.
What about a QR code or a printed link?
Tag the URL the QR code holds, with a medium such as print or qr. Without a tag, a visit from a poster arrives as Direct.
How AnalyticsTrend does it
The AnalyticsTrend web SDK reads utm_source, utm_medium, utm_campaign, utm_content and utm_term from the landing URL, ref or source when there is no utm_source, and the name of a gclid, msclkid or fbclid parameter, never its value. The rest of the query string is never read. The referrer is kept as a hostname only. See What it collects.
Each visitor has one source a day: the first seen, with Direct only when nothing better arrived. The Sources report groups visitors by channel, source, medium, campaign, content or term, each with visits, bounce rate and visit duration, and with any goal's conversions and conversion rate. Each tag is kept as the link was written, and any of them can be a filter on every report. Every number that bounds the reports is in Capabilities and limits.
To start, see Install on a website.
Checked against the sources linked above on 28 October 2026.