Five parameters. Three are enough.

A UTM parameter is a piece of a URL that you add yourself to a link to declare where it came from. There's no magic: it's text, appended after a question mark, that the destination analytics tool reads and files.

There are exactly five of them, and the utm_ prefix is required for them to be recognized. Google Analytics' documentation is the authority here, because the convention was born with that tool and the rest of the industry aligned to it.

All five, one by one

Combined, they produce a URL like this:

https://example.com/offer?utm_source=instagram&utm_medium=social&utm_campaign=summer-sale-2026

Three of them should always be written — the cited documentation is explicit: always use utm_source, utm_medium, and utm_campaign, while utm_term and utm_content are optional.

`utm_source`: the proper noun

This is the source, and it behaves like a proper noun: one named entity, one spelling only. instagram, never Instagram, insta, or ig depending on the mood that day. It's the simplest parameter and the one that produces the most duplicates in reports.

`utm_medium`: the category, not the platform

This is the medium, and the one everybody fills in wrong. The medium is not the platform — it's the nature of the contact. social for an organic post, cpc for a paid click, email for a send, affiliate for a paid partner, qr for a printed medium.

The survival rule: a closed vocabulary, decided once, with a maximum of around ten values. This is the parameter that feeds the channel grouping in most tools; an improvised medium creates a phantom channel per campaign.

`utm_campaign`: the initiative

This is the campaign, the only level at which a budget comparison makes sense, because it's the level at which you spent. It groups all the links for a single initiative, regardless of their source or medium.

`utm_term`: the paid search legacy

It was designed to carry the keyword bought in paid search, and platforms often fill it in automatically. Outside paid search, it almost never serves a purpose — and repurposing it for something else is a good way to make a report unreadable to whoever picks it up later.

`utm_content`: the only one that lets you compare

This is the parameter people overlook, and the one that pays off most. It distinguishes two links that differ in nothing else: two buttons in the same email, two creatives in the same ad, two placements on the same page. Without it, there's no way to know which version worked — it's the basis of any distribution A/B test.

The naming convention, in five rules

The chaos at six months never comes from a lack of UTMs. It comes from four different spellings for the same thing. Decide this once, write it in a shared document, and stick to it:

1. All lowercase. Instagram and instagram are two separate rows in almost every tool. This one rule alone prevents half the duplicates.
2. No accents, no spaces, no punctuation. An accent in a URL gets encoded and comes out unreadable; a space becomes %20. Use a hyphen as the separator, everywhere.
3. A closed vocabulary for `utm_medium`. Write the list of allowed values and don't add to it without thinking it through.
4. The date in the campaign name, in year-month format. summer-sale-2026-07 sorts itself; july-sale doesn't sort and becomes ambiguous the following year.
5. Never use UTMs on internal links. A link from your own navigation tagged with UTMs restarts the visitor's session and overwrites the real origin of their visit. You lose the campaign that brought them, and you attribute to yourself an acquisition you paid for elsewhere.

The UTM generator applies these rules at the moment you build the link. It's free, requires no sign-up, and nothing is sent to a server: a tool that asks for your email address to concatenate five strings is a lead-capture page in disguise.

What UTMs don't do

Three limits to know before betting everything on them.

They disappear when someone copies the URL. That's their structural weakness. Someone picks up the address from the browser bar, pastes it into a message, and the parameters are gone. The link still works, but it says nothing anymore — and the visit will swell the "direct" line of your report, as this article explains.

They're readable by everyone. A forty-character link turned into a two-hundred-character block shares badly, dictates even worse, and signals to the reader that they're being measured. On a printed medium or a profile bio, that's a deal-breaker.

They count visits, not sales. A UTM parameter lands on the landing page and stops there. What happens next — the form, the cart, the payment — no longer belongs to it. Connecting the two requires something else, and that's the subject of sales tracking.

So: UTMs or short links?

Both — and they don't play the same role.

The short link on your domain is what the public sees and copies: short, clean, dictable, with a slug that signals the destination. UTM parameters are what the link carries underneath, added automatically at the moment of redirect, so that the destination's analytics tools also know what's going on.

example.com/sale  →  https://store.com/offer?utm_source=instagram&utm_medium=social&…

The visitor never sees the second line. Yet it survives all sharing, because the tracking is no longer in what gets copied.

Where to start, concretely

1. Write your `utm_medium` list before everything else. Ten values, no more, approved by everyone who creates links.
2. Set the `utm_campaign` format: initiative, then year-month.
3. Generate all your links in the same place. A link built by hand in a corner is a misspelled link.
4. Add `utm_content` whenever two links go to the same place. It's the only way to tell them apart later.
5. Have UTMs carried by a short link, so they survive copying and pasting.

Questions that come up

"Are UTMs bad for SEO?" They create distinct URLs for the same content, which can produce duplicates in a search engine's view. The fix is a canonical tag on the landing page, which most sites already have. And the real answer is elsewhere: you don't put UTMs on links meant to be crawled by a search engine.

"Should I use `utm_id`?" It exists in some tools to match a campaign to a platform identifier. It's not part of the five original parameters, and it doesn't replace any of them.

"How long should I keep the same convention?" As long as possible. Changing naming conventions creates a break in history: the same campaigns appear under two names, and no year-over-year comparison holds.

"What if I already have six months of messy data?" Don't rewrite anything retroactively. Set the convention today, mark the switch date, and compare from there forward. To start clean on a large volume of links, bulk import avoids retyping everything.

"Is this GDPR-compliant?" A UTM parameter describes a campaign, not a person — it doesn't identify anyone on its own. The article on tracking without surveillance details the boundary, and the comparison with a standard analytics tool shows where it shifts.

The full vocabulary — source, medium, campaign, channel, touchpoint — is in the lexicon. And to find out what each link actually generated once the visit ended, it's the attribution article.