The Complete UTM Parameter Guide for 2026 (Including the Four Parameters Almost Nobody Uses)

Ask most marketers how many UTM parameters exist and they’ll say five. Ask GA4, and the answer is nine.

The gap between those two numbers is where a surprising amount of free attribution value sits in 2026. While everyone fights over utm_source and utm_medium, GA4 has quietly supported a second tier of parameters — utm_id, utm_source_platform, utm_marketing_tactic, and utm_creative_format — that map to dedicated reporting dimensions and, in one case, unlock an entire GA4 feature most stores never turn on.

And here’s the part that runs against the popular narrative: as privacy features keep stripping click IDs out of URLs, plain old UTMs have become more valuable, not less. They’re one of the few tracking mechanisms that survives Apple’s link-cleaning intact.

This guide covers all nine parameters, when to actually use the obscure ones, the naming rules that keep the data usable, and what the 2026 privacy landscape really does (and doesn’t do) to your links.

Tier 1: The Five Everyone Knows

Quick recap, because the fundamentals still carry the load:

Parameter	Question it answers	Examples
utm_source	Who sent the click?	google, facebook, klaviyo, partner-name
utm_medium	Through what channel?	cpc, paid-social, email, affiliate
utm_campaign	As part of what effort?	2026-q2-de-brand-launch
utm_content	Which creative or placement?	ugc-video-v2, footer-cta
utm_term	Which keyword or audience?	running-shoes, lookalike-3pct

Two working notes on these. First, utm_medium is the parameter with rules: GA4’s Default Channel Grouping matches it against a fixed vocabulary (cpc, email, paid-social, and so on), and unrecognized values send your traffic to Unassigned. Second, utm_term lost its old superpower in GA4 — it no longer feeds keyword reports the way it did in Universal Analytics (that’s handled by Google Ads auto-tagging now), so treat it as a free-form slot for whatever segmentation you need.

Tier 2: The Four Parameters Hiding in Plain Sight

utm_id — the one that unlocks a whole GA4 feature

utm_id is a unique campaign identifier, and it exists to solve a problem campaign names can’t: names change. A manager renames “spring-promo” to “spring-promo-v2” mid-flight, and suddenly your reporting is split across two campaigns that are really one.

An ID is permanent. Assign utm_id=cmp-0042 at launch and it survives every rename, every platform, every export.

But the bigger reason to care: utm_id is the join key for GA4’s cost data import. GA4 can ingest spend data from non-Google platforms (Meta, TikTok, anywhere) and show cost, revenue, and ROAS side by side in the Advertising workspace — but it matches imported cost rows to sessions using campaign ID, source, and medium. No utm_id on your links, no non-Google ROAS inside GA4. Most accounts we see have never used this, purely because nobody was setting IDs.

Practical scheme: don’t invent poetic IDs. A simple incrementing pattern (cmp-2026-0001) managed centrally works — the entire point is that machines match on it, not that humans read it.

utm_source_platform — where was this managed?

This answers a different question than utm_source. Source says the click came from facebook; source platform says the link was managed through meta-ads-manager versus dv360 versus set by hand (manual).

Who needs it: teams buying the same inventory through multiple buying platforms (common in programmatic), or agencies proving which managed stack drove results. If that’s not you, skip it — an unused parameter is just URL noise.

utm_marketing_tactic — the funnel-stage dimension

This groups traffic by targeting strategy: prospecting, retargeting, remarketing. It sounds redundant until you try to answer “what’s our blended prospecting ROAS across Google, Meta, and TikTok?” inside GA4. Without this parameter, that answer requires naming-convention archaeology — parsing funnel stage out of campaign names and hoping every platform’s names cooperate. With it, funnel stage is its own clean dimension you can drop into any Exploration.

If you run paid on more than one platform, this is the sleeper pick of the whole list.

utm_creative_format — comparing asset types across platforms

video, carousel, static-image, short-form-video. Each ad platform will tell you which of its own creatives win; none of them will tell you whether video beats static across your whole mix. This parameter makes that a one-dimension question in GA4 instead of a spreadsheet project.

It overlaps with utm_content, so draw the line deliberately: utm_creative_format for the broad asset type (few values, fixed list), utm_content for the specific variant (blue-hero-v3). Type answers strategy questions; variant answers testing questions.

Honest caveat on all of Tier 2: GA4 is currently the main consumer of these parameters. Shopify’s marketing reports and most other analytics tools ignore them. They also only apply to manually tagged traffic — Google Ads auto-tagging populates its own versions. Adopt them where the reporting payoff is real, not for completeness points.

The Naming Rules (Unchanged, Still Ignored)

The rules haven’t changed in a decade; the fragmented reports prove people still skip them.

1. Lowercase everything. UTM values are case-sensitive strings — Google and google are two rows in every report, forever.
2. Hyphens, not spaces. Spaces become %20 in URLs and break more parsers than you’d expect. Pick hyphens or underscores and never mix.
3. Stay inside a–z, 0–9, and -. Special characters invite encoding bugs, especially through redirect chains and in-app browsers.
4. Make campaign names formulaic. A pattern like {yyyy}-{qN}-{region}-{objective} (e.g., 2026-q2-de-brand-launch) sorts chronologically, parses cleanly, and still means something a year later.
5. Close the vocabularies. Sources and mediums should come from an approved list, not from whatever the person tagging felt like typing. Documentation suggests; only enforcement guarantees.

That last rule is the entire reason UTM Manager exists, so we’ll say it once and move on: in UTM Manager your sources, mediums, and campaign patterns are locked into the builder itself — dropdowns instead of free text — so rules 1 through 5 stop being things your team must remember and become things the tool won’t let them get wrong.

The 2026 Privacy Landscape: What Actually Breaks (And What Doesn’t)

There’s a lot of fear-marketing around this topic, so here’s the sober version from the tracking trenches.

Apple’s Link Tracking Protection strips click IDs — not UTMs

Since iOS 17, Apple’s Link Tracking Protection removes user-identifying parameters — gclid, fbclid, and friends — from links shared in Mail, Messages, and opened in Safari Private Browsing, and that behavior has only expanded since. What it deliberately leaves alone: UTM parameters. UTMs describe the campaign, not the person, which keeps them on the right side of Apple’s line.

The practical consequence is genuinely important: for a growing slice of Apple traffic, your UTMs are the only campaign attribution that survives the click. If your links carry a click ID but sloppy or missing UTMs, that traffic degrades into Direct the moment Apple cleans the URL. Redundant, well-formed UTMs on every paid link are the cheap insurance here — which is exactly why platforms are moving the same direction themselves (ChatGPT, for instance, appends utm_source=chatgpt.com to outbound links so its referrals don’t vanish into Direct).

Ad blockers don’t touch your URL — they shoot the messenger

A blocker doesn’t rewrite ?utm_source=facebook out of your link. It blocks gtag.js from loading, so GA4 never hears about the visit at all — UTMs and everything else included.

The mitigation is server-side tagging: run the collection endpoint on your own first-party subdomain (data.yourdomain.com) via server-side GTM, so measurement traffic doesn’t announce itself as Google Analytics. Implementation lessons from doing this repeatedly: recovery is real but partial (blocklists adapt, so keep the subdomain custom rather than an obvious default), and server-side tagging changes where data is collected, not your consent obligations — Consent Mode still applies. It’s a genuine upgrade for data completeness; it’s not invisibility.

UTMs and SEO: a solved problem

UTM parameters don’t hurt rankings — Google has been clear on this for years. The one real risk is duplicate-content indexing if tagged URLs get crawled, and the fix is a canonical tag pointing at the clean URL. Shopify, WordPress, and every mainstream CMS does this out of the box; verify once with ?utm_source=test and view-source, then stop worrying. One actual rule: never put UTMs on internal links — that’s an attribution problem (it overwrites the visitor’s real source mid-session), not an SEO one.

A Realistic 2026 Setup, In Order

1. Lock the foundation. Approved source list, approved medium list (aligned to GA4’s channel-grouping vocabulary), one campaign naming pattern. One page.
2. Add utm_id to paid campaigns and set up GA4 cost data import for your non-Google platforms. This is the highest-leverage “new” move on this list — actual ROAS visibility for a few minutes of setup.
3. Adopt utm_marketing_tactic if you’re multi-platform paid. Three allowed values (prospecting, retargeting, remarketing), massive Exploration payoff.
4. Skip what you don’t need. utm_source_platform and utm_creative_format earn their place only in programmatic/multi-stack setups and cross-platform creative analysis respectively. Empty discipline beats decorative parameters.
5. Audit monthly. Open Traffic acquisition → Session source/medium, scan for near-duplicates and Unassigned. Ten minutes. If Unassigned is climbing, a human is creating links outside the system — fix the workflow, not just the data.

The through-line of all of it: in 2026, UTMs are no longer the boring baseline of tracking — they’re one of the last attribution signals that privacy tooling leaves intact. That makes the consistency problem more expensive to ignore than it used to be, and consistency has never been a memory problem. It’s a systems problem.

Put the system in place once. Start free with UTM Manager — approved value lists, enforced naming patterns, and support for the full GA4 parameter set, so every link your team ships is one your reports can trust.