utm_source, utm_medium, utm_campaign: How GA4 Actually Reads Them ,And Why Your Traffic Ends Up “Unassigned”

Open GA4’s Traffic acquisition report on almost any account and you’ll find a channel called Unassigned quietly eating a chunk of the traffic. We’ve seen accounts where it was the third-largest “channel” — bigger than email, bigger than paid social. The team was running real campaigns with real budgets, and GA4 was shrugging at the results.

Here’s the uncomfortable part: Unassigned traffic is almost never a tracking bug. The gtag fires fine, the events arrive fine. It’s a naming bug. Someone tagged a paid Facebook campaign with utm_medium=fb-ads, GA4 checked that value against its channel definitions, found no match, and filed the whole campaign under “no idea.”

To fix it, you don’t need more tracking. You need to understand how GA4 actually processes the three core parameters — utm_source, utm_medium, and utm_campaign — and then tag in the language GA4 speaks. That’s what this post covers, working backwards from GA4’s logic instead of forwards from definitions.

What the Three Parameters Do (In One Minute)

When someone clicks a tagged link like:

https://yourstore.com/?utm_source=facebook&utm_medium=paid-social&utm_campaign=bfcm-prospecting-202511

GA4 reads the query string and records three things about the session:

• utm_source — who sent the click. The platform or referrer: facebook, google, klaviyo, partner-newsletter.
• utm_medium — how it traveled. The channel type: cpc, email, paid-social, referral.
• utm_campaign — why it happened. The marketing effort: bfcm-prospecting-202511, spring-launch.

Two supporting parameters exist — utm_term and utm_content — and we’ll get to them, but source, medium, and campaign carry the attribution weight. Get these three consistent and 90% of your reporting problems disappear.

One rule before anything else: never put personal data (emails, names, customer IDs) in UTMs. They’re visible in the URL, they get logged everywhere, and they’ll create privacy problems you don’t want.

The Part Nobody Explains: GA4’s Channel Grouping Is a Rulebook, Not a Guess

This is the mental model that makes everything click.

GA4 doesn’t “figure out” your channels. It runs every session’s source and medium through a fixed set of if/then rules called the Default Channel Grouping. Simplified, the rules look like this:

• medium is cpc, ppc, or paid and source is a search site → Paid Search
• medium contains paid and source is a social site → Paid Social
• medium is exactly email or e-mail → Email
• medium is social, social-media, etc. → Organic Social
• medium is referral → Referral
• nothing matches → Unassigned

That last line is the whole story. GA4 never asks “what did the marketer probably mean by fb-ads?” It checks the string against the rulebook, finds nothing, and gives up. Your campaign didn’t disappear — it’s sitting in Unassigned with a label GA4 couldn’t parse.

So the practical rule is: your utm_medium vocabulary must come from GA4’s rulebook, not from your imagination. Here’s the short list that covers most businesses:

You’re tagging…	Use utm_medium	Use utm_source	GA4 files it under
Google/Bing ads	cpc	google, bing	Paid Search
Meta/TikTok ads	paid-social	facebook, instagram, tiktok	Paid Social
Newsletters & flows	email	klaviyo, mailchimp, hubspot	Email
Unpaid social posts	social	linkedin, x, facebook	Organic Social
Partner/affiliate links	affiliate	partner’s name	Affiliates
SMS	sms	klaviyo, attentive	(custom/Unassigned*)

*SMS is a known gap in the default rules — either accept where it lands or define a custom channel group for it. The point is you decide deliberately, instead of discovering it in a report later.

utm_source, by contrast, is where you get to be specific. youtube beats video. A partner’s actual name beats partner. Medium is for GA4’s rulebook; source is for you, six months from now, trying to remember where a spike came from.

Where Your Tags Show Up in GA4

Once tagged traffic starts flowing, here’s the map:

• Traffic acquisition (Reports → Acquisition) — session-level attribution. Switch the primary dimension to Session source/medium or Session campaign to see your raw UTM values instead of the channel groups.
• User acquisition — first-touch attribution. Same UTM data, but pinned to the first session a user ever had. Useful for “what channel finds us new customers” questions.
• Explorations — build free-form tables mixing session source/medium, campaign, and revenue for real campaign-level ROI analysis.
• DebugView — your QA tool. Click your own tagged link with debug mode on and watch the parameters arrive before the campaign goes live. Sixty seconds here prevents a month of dirty data.

One GA4-specific heads-up on utm_term: in Universal Analytics it fed keyword reports; in GA4 it’s just a free-form dimension. Keyword-level data for Google Ads comes from auto-tagging (gclid) via the Ads link instead. So use utm_term for whatever you need — audience names, keyword themes — and don’t expect GA4 to do anything clever with it.

utm_content is the underused one. It answers “which variant?” — hero-cta vs footer-link in the same email, ugc-video vs static-carousel in the same ad set. If you A/B test anything, utm_content is how the winner shows up in analytics instead of only in the ad platform.

The Mistakes That Send Traffic to the Wrong Bucket

Case drift. UTMs are case-sensitive strings. Email, email, and EMAIL are three different rows in every report, forever. Lowercase everything — no exceptions, no “just this once.”

Invented mediums. fb-ads, social-paid, meta, newsletter2 — every one of these is a one-way ticket to Unassigned. Medium is a closed vocabulary. If a value isn’t in the table above (or your documented custom channel group), it doesn’t go in a link.

Tagging internal links. A homepage banner tagged utm_source=homepage-banner overwrites the session’s real source the moment someone clicks it. The visitor you paid Google for is now attributed to your own homepage. Track internal clicks with GA4 events instead; UTMs are for external traffic only.

Double-tagging Google Ads. If auto-tagging (gclid) is on — and it should be — manual UTMs on the same links can conflict with it. Let gclid do its job and reserve manual tagging for platforms without an integration.

Trusting the link chain. Shorteners, in-app browsers, and redirect hops sometimes strip query strings. If a “fully tagged” channel shows suspicious Direct traffic, click the live link on your phone and check what URL actually loads. We’ve traced entire “attribution mysteries” to a shortener that silently dropped everything after the ?.

And on Direct traffic generally: some of it is real (bookmarks, typed URLs), but a lot of it is untagged links plus dark social — people pasting your URL into WhatsApp, Slack, or DMs where no referrer survives. UTMs are the only instrument that makes that traffic visible. You’ll even see platforms doing this themselves now: ChatGPT appends utm_source=chatgpt.com to its outbound links precisely so that traffic shows up as its own source instead of vanishing into Direct.

Making It Stick: Governance Beats Good Intentions

Everything above is easy to do once. The hard part is doing it identically on link #400, when it’s Friday evening and three people are launching campaigns at the same time. In practice, consistent tagging needs four things:

1. A written vocabulary — the allowed sources and mediums, in a doc everyone can find.
2. A campaign naming format — something like {objective}-{promo}-{yyyymm} so names sort and compare cleanly across platforms.
3. A QA step — DebugView check before any major campaign ships.
4. Enforcement at the point of creation — because a doc nobody’s forced to follow is a suggestion, not a system.

That fourth one is why we built UTM Manager. Your sources and mediums live as locked dropdown lists, so Facebok and fb-ads literally can’t be created. Campaign name patterns are templated. Every link the team builds lands in one shared history, so there’s a single source of truth instead of a spreadsheet with three conflicting tabs. The convention doc stops being something people have to remember and becomes something the tool enforces automatically.

The Takeaway

GA4 isn’t mysterious about attribution — it’s mechanical. It reads utm_source to learn who sent the click, checks utm_medium against a fixed rulebook to pick a channel, and groups everything by utm_campaign. Traffic ends up Unassigned when your labels aren’t in its vocabulary, and reports fragment when your labels aren’t consistent.

Speak GA4’s language on medium, be precise on source, be systematic on campaign names — and enforce all three with tooling instead of memory.

Tired of Unassigned traffic? Start free with UTM Manager — lock your naming conventions into the link builder itself, so every link your team creates is one GA4 can classify.