UTM Tracking in Google Analytics 4

GA4 keeps more than one answer to “where did this visit come from?”, and the prefix on a dimension’s name says which one a report is showing.

Every fact below comes from Google’s own help or developer pages, linked where it’s used and checked on 2026-10-06. GA4 changes often. When a screen disagrees with this page, the date says how old our reading is.

The examples are Stride’s, the book’s fictional shoe brand.

Parameters and dimensions

GA4 reads nine utm_ parameters, and the Data API schema names a session dimension for each (Google, Data API schema, checked 2026-10-06):

Parameter	Session dimension
utm_source	Session source
utm_medium	Session medium
utm_campaign	Session campaign
utm_term	Session manual term
utm_content	Session manual ad content
utm_id	Session manual campaign ID
utm_source_platform	Session manual source platform
utm_creative_format	Session manual creative format
utm_marketing_tactic	Session manual marketing tactic

The help page for URL builders says of the last two that each “isn’t currently reported in Google Analytics properties” (Google, URL builders, checked 2026-10-06), though the schema lists their dimensions.

Session source, medium and campaign can also hold values from auto-tagging (below). The schema’s Session manual source, Session manual medium and Session manual campaign name are “populated by” utm_source, utm_medium and utm_campaign (same schema, checked 2026-10-06).

Three more facts from the same help page (checked 2026-10-06):

• A link without a parameter leaves a gap: “Missing UTM parameters will result in (not set) values being present in reporting.”
• “Parameter values are case sensitive, e.g. utm_source=google is different from utm_source=Google.” Chapter 3 shows what a second spelling does to a report.
• The tags don’t stay in the Landing page + query string or Page path + query string dimensions. They’re kept in Page location.

Both of the parameters the help page calls unreported also reach the BigQuery export (below).

Scopes: user, session and event

Each traffic-source dimension comes in three scopes, marked by a prefix: “First user” for the user, “Session” for the session, and no prefix for the event (Google, Scopes of traffic-source dimensions, checked 2026-10-06). Here they are on Alex’s order from Chapter 11, taking the Facebook ad as Alex’s first visit ever:

1. Session 1 · Week 1

   Facebook ad

   facebook / paid_social

2. Session 2 · Week 2

   Newsletter

   newsletter / email

3. Session 3 · Week 4

   Google search ad

   google / cpc

4. Session 4 · Week 5

   Instagram retargeting ad

   instagram / paid_social

5. Outcome

   Order: trail runners, $140

1. Session 1 · Week 1

   Facebook ad

   facebook / paid_social

2. Session 2 · Week 2

   Newsletter

   newsletter / email

3. Session 3 · Week 4

   Google search ad

   google / cpc

4. Session 4 · Week 5

   Instagram retargeting ad

   instagram / paid_social

5. Outcome

   Order: trail runners, $140

Scope	Prefix	Alex’s order reads
User	First user	facebook / paid_social, on every visit
Session	Session	each visit’s own source and medium
Event	none	the touch the model credits for the order

From the same page:

• User scope: “The value assigned to each user-scoped dimension remains the same as users return.” The User acquisition report shows it.
• Session scope: “New values are assigned to session-scoped dimensions each time users return.” The Traffic acquisition report shows it.
• Event scope credits key events, and “the source and medium for non-key events are ‘(not set)’.” The model is the property’s choice, data-driven by default (the attribution section below). Under paid and organic last click, Alex’s order goes to instagram / paid_social; data-driven can split it across the four touches.

Two reports can disagree about the same campaign and both be right. The prefix says which question each one answered.

Channel rules

GA4 files each session into a channel by reading its source and medium together, and for three channels (Cross-network, Paid Shopping and Organic Shopping) its campaign name. Chapter 2 teaches the mechanism. These are Google’s rules for manual traffic, the traffic your tags describe, with the patterns put into words (Google, Default channel group, checked 2026-10-06). Traffic from Google Ads, Display & Video 360, Campaign Manager 360 and Search Ads 360 gets its channel from the platform’s own data instead, and Merchant Center traffic with the source platform “Shopping Free Listings” is Organic Shopping (same page).

Two terms carry the table. A paid medium is one GA4’s paid rule reads as paid: it starts with paid, contains cp, or is exactly ppc or retargeting (Chapter 3 builds the book’s mediums on it). A known search, social, video or shopping site is one on Google’s downloadable list of sources and categories, linked from the same page.

Channel	GA4 files it here when
Direct	the source is (direct) and the medium (none) or (not set)
Cross-network	the campaign name contains cross-network
Paid Shopping	a paid medium, with a known shopping site or a shopping campaign name
Paid Search	a paid medium, from a known search site
Paid Social	a paid medium, from a known social site
Paid Video	a paid medium, from a known video site
Display	the medium is display, banner, expandable, interstitial or cpm
Paid Other	a paid medium, from any other source
Organic Shopping	a known shopping site, or a shopping campaign name
Organic Social	a known social site, or the medium is exactly social, social-network, social-media, sm, social network or social media
Organic Video	a known video site, or a medium containing video
Organic Search	a known search site, or the medium is exactly organic
AI Assistant	the medium is exactly ai-assistant; when the referrer is on its list of AI assistants, GA4 sets that medium and the campaign (ai-assistant)
Referral	the medium is referral, app or link
Email	the source or the medium is email, e-mail, e_mail or e mail
Affiliates	the medium is affiliate
Audio	the medium is exactly audio
SMS	the source or the medium is exactly sms
Mobile Push Notifications	the medium ends in push or contains mobile or notification, or the source is firebase
Unassigned	no rule matches

A shopping campaign name contains shopping, or shop at the start, after an e, or after any character that isn’t a letter: spring_shop and eshop count, workshop doesn’t.

What the table means for a value:

• Case doesn’t change a channel: “Channel definitions aren’t case sensitive and can’t be edited” (same page). The values in a report do keep their case, so Paid_Social from Facebook lands in Paid Social and still takes a row of its own.
• The organic lists are exact. social-media is on Organic Social’s list and social_media isn’t. From a known social site the source decides anyway (Chapter 2); from any other source, social_media matches nothing and is Unassigned.
• From a source on none of Google’s lists, offline matches no rule and is Unassigned. Chapter 3 says why the book keeps it.
• The default channel group can’t be edited. A custom channel group can give a value like offline a channel of its own, and the primary channel group “serves as your property’s editable default channel group” (same page). Standard reports use the primary channel group (Google, Data API schema, checked 2026-10-06).

The simulator runs these rules on Stride’s spring sale link. Three readings to try: retail_display with offline; newsletter with social_media, then with social-media; and Paid Social typed by hand, which keeps its channel and splits its row.

utm_sourcefacebookinstagramgoogleyoutubenewsletterretail_displayutm_mediumpaid_socialcpcpaid_videosocialvideoemaildisplayaffiliatereferralaudioofflinesocial-mediasocial_mediaPaid Social (typed by hand)

stride.com/spring-sale?utm_source=facebook&utm_medium=paid_social&utm_campaign=spring_sale-runners-2025_03

Session source

facebook

Session medium

paid_social

Session default channel group

Paid Social

"paid_social" reads as paid and facebook is a recognized social site → Paid Social.

Internal links and sessions

Chapter 8’s law is “Never tag an internal link”: tags on a link claim the visit came from somewhere, and a link inside your own site brought nobody. Here is what GA4 makes of one.

How a session starts and what it’s attributed to (Google, About Analytics sessions, checked 2026-10-06):

• A session starts when someone views a page “and no session is currently active.” By default it times out “after 30 minutes of user inactivity.”
• The session_start event “carries the information that determines the attribution of the session, such as the gclid, UTM parameters, and referrer.”

What a tagged click does mid-visit (Google, Campaigns and traffic sources, checked 2026-10-06): “a new session is not started when Google Analytics encounters a new campaign or traffic source.” The new values “are associated with the events for which they were collected and the data is used for event-based attribution, but the campaign and traffic-source values are not associated with the existing session of the user.”

Google’s own example runs it end to end (Google, Scopes of traffic-source dimensions, checked 2026-10-06). A shopper arrives from a Google search ad and, mid-visit, clicks a link inside the site tagged utm_source=internal_promotion:

• The session keeps its source: session 3 still reads google / cpc.
• The internal link enters the key-event path. It appears as its own touch after google / cpc in the paths to the add-to-cart and the purchase, and the attribution model gives it a share of the credit. (Google’s tables label that touch partner / affiliate.)
• A later direct visit takes its values. The shopper comes back through a bookmark, and that session is attributed to the internal link’s values, because “sessions initiated by direct entrance are attributed to the UTM values for that user.”

It follows from the two pages quoted above (a session starts when none is active, and its session_start carries the UTM parameters) that a visitor who sits idle for more than 30 minutes and then clicks a tagged internal link starts a new session, and that session’s source is the link’s.

The same page carries a note about purchase events sent through the Measurement Protocol: “Avoid including manual campaign details (for example, utm_source, utm_medium, and utm_campaign) unless these details reflect new campaign interactions.”

Attribution models and report defaults

Chapter 11 teaches the models without naming a tool, and keeps one mechanism: a report that groups each conversion by the source of the visit it happened in is a last-touch reading, whatever model anyone chose. Here is how GA4 does it.

• The menu: GA4’s attribution reports offer three models, data-driven, paid and organic last click, and Google paid channels last click. First click, linear, time decay and position-based “are no longer available as of November 2023.” Paid and organic last click “ignores direct traffic and attributes 100% of the key event value to the last channel that the customer clicked through.” All three exclude direct visits from credit “unless the path to key event consists entirely of direct visits.” (Google, Get started with attribution, checked 2026-10-06)
• Data-driven “uses machine learning algorithms to evaluate both converting and non-converting paths” (same page, checked 2026-10-06). For Google Ads, Google recommends “at least 200 conversions and 2,000 ad interactions in supported networks within a 30-day period,” and says the model “will still function with less data” (Google Ads, About data-driven attribution, checked 2026-10-06). GA4’s own attribution page (above) gives no minimum.
• The default: event-scoped dimensions use the model you select, “but by default, Analytics uses the data-driven attribution model.” User- and session-scoped dimensions use paid and organic channels last click (Google, checked 2026-10-06).
• What the setting doesn’t touch: “User- and session-scoped traffic dimensions, such as Session source or First user medium, are unaffected by changes to the reporting attribution model” (Google, Select attribution settings, checked 2026-10-06). The Traffic acquisition report is built on session-scoped dimensions, with Session default channel grouping as its default dimension, each describing “a user’s most recent session” (Google, Traffic acquisition report, checked 2026-10-06). So it credits each session’s source, whatever model the property is set to: Chapter 11’s last-touch reading.
• The lookback window: 30 days by default for acquisition key events (7 is the other choice), 90 days for all others (30 or 60 are the others), and the window “also applies to session attribution” (Google, checked 2026-10-06).
• A returning visitor’s direct session: “Sessions initiated by direct entrance are attributed to the UTM values for that user” (Google, checked 2026-10-06). Google’s sessions page gives the case: a visit from an organic Google search result on day 1, a direct return on day 68, and the second session also reads google / organic under the 90-day window (Google, checked 2026-10-06).

Every one of these models splits only the touches your tags recorded. An untagged paid click reads as free under all of them, and a campaign under two spellings splits its own credit under all of them (Chapter 11).

utm_id and auto-tagging

utm_id is the “Campaign ID. Used to identify a specific campaign or promotion. Use the same IDs that you use when uploading campaign data” (Google, URL builders, checked 2026-10-06). The upload it means is campaign data import, which brings cost, clicks and impressions from platforms outside Google into GA4 (Google, Campaign data import, checked 2026-10-06):

• The import joins on utm_source, utm_medium and the date, which are required. utm_id and utm_campaign are “Optional, but highly recommended.”
• The values “must exactly match the values your users have logged. For example: ‘Facebook’ and ‘facebook’ aren’t exact matches.”

It’s Chapter 6’s join key, inside GA4.

Google Ads auto-tagging writes its own envelope. It adds a click ID, the gclid, to the link: Google’s example is www.example.com/?gclid=123xyz, and auto-tagging “is turned on by default for new accounts” (Google Ads, About auto-tagging, checked 2026-10-06). Here is Stride’s Google search ad as clicked, with Stride’s own tags in the final URL and Google’s placeholder ID:

stride.com/spring-sale?utm_source=google&utm_medium=cpc&utm_campaign=spring_sale-runners-2025_03&utm_term=running_shoes&gclid=123xyz

What GA4 makes of it:

• “If you use manual tagging and auto tagging together, then the source, medium, and other traffic-classification dimensions use the auto-tagged values. The manually tagged values for utm_content and utm_term are used for the Manual Ad Content and Manual Term dimensions” (Google, Auto-tagging, checked 2026-10-06). Session campaign shows the Google Ads campaign’s name, and running_shoes survives in Session manual term.
• There’s no switch to reverse it: “in Google Analytics 4 (GA4), auto-tagging is prioritized over manual tagging due to the absence of an override option” (Google Ads).
• With auto-tagging on and the Google Ads account not linked, the campaigns “appear in reports by default with a source/medium of google/cpc or using available UTM values,” with no campaign data, and the clicks aren’t used for Google paid channels attribution (Google).

Chapter 5 tells this as a collision. Chapter 6 is why the Google Ads campaign name and utm_campaign can be the same value, so the campaign reads the same either way.

A click ID another platform adds, such as Meta’s fbclid, is a query parameter on the landing URL. Query parameters are part of page_location and page_referrer, and GA4’s data redaction can replace the values of the ones you list with (redacted) (Google, Data redaction, checked 2026-10-06). The setting: Admin, Data collection and modification, Data streams, the web stream, then Redact data under Events; turn on URL query parameters and enter each one. It works on web data streams only, and needs the Editor role or above.

Report limits

Each of these can change what a campaign report shows:

• Processing: “Data processing can take 24-48 hours. During that time, data in your reports may change” (Google, Data freshness, checked 2026-10-06).
• Thresholds: when a report includes demographic data, rows may be withheld; when it includes search query information, a row “may be withheld if there aren’t enough total users.” Thresholds “are system defined. You can’t adjust them” (Google, Data thresholds, checked 2026-10-06).
• The (other) row: when a table has more rows than its limit, GA4 keeps the most common values and condenses the rest into (other). Google treats a dimension with more than 500 values as high cardinality, “not a limit, but a guidance.” Secondary dimensions, filters and comparisons make it more likely, and 360 properties have higher limits (Google, The (other) row, checked 2026-10-06). Each spelling of a campaign is one more value toward that count.
• Sampling: when a query covers more events than the property’s quota, GA4 analyzes a portion and scales up. The quota for event-level queries is “10 million events for standard Google Analytics properties and up to 1 billion events for Google Analytics 360 properties” (Google, Data sampling, checked 2026-10-06).
• Session counts: reports estimate them with HyperLogLog++, and BigQuery counts them exactly, so the two can differ slightly (Google, checked 2026-10-06).

BigQuery fields

The export holds “all the raw, unsampled event data,” without “any value additions that Google Analytics makes to the data found in standard reports and explorations,” so its numbers can differ from the interface’s (Google, BigQuery Export, checked 2026-10-06). Standard properties’ daily export has a limit of 1 million events a day; the streaming export has none (Google, Set up BigQuery Export, checked 2026-10-06). Daily tables keep taking late events for up to three days after the date, and Google signals data isn’t exported (Google, BigQuery Export schema; Google, Data thresholds).

The fields that carry your tags, from the export schema (Google, BigQuery Export schema, checked 2026-10-06): a record for each scope, then the page URL.

• traffic_source is the user. Its source, medium and name hold the source, medium and campaign that first acquired the user, and are empty in intraday tables.
• collected_traffic_source is the event, as collected:
  • manual_source, manual_medium and manual_campaign_name hold the UTM values (source and medium can also come from parsed referral parameters);
  • manual_term, manual_content and manual_campaign_id hold utm_term, utm_content and utm_id;
  • manual_source_platform, manual_creative_format and manual_marketing_tactic hold the three extra parameters, the two the help page calls unreported included;
  • gclid holds the Google click ID.
• session_traffic_source_last_click is the session: its last-click source, in one record each for manual, Google Ads, cross-channel, Search Ads 360, Campaign Manager 360 and Display & Video 360 campaigns.
• event_params, under the key page_location, holds the page URL with its query string.

Which record a warehouse table reads decides which of GA4’s three answers it gives.