The UTM Naming Convention I'd Defend in Any Audit

The deliverable first: a UTM naming convention every campaign link passes through before it ships. Lowercase everywhere. Closed vocabularies for source and medium. One delimiter, locked. A stamped campaign ID. And the part that makes it real, enforced at the moment a link is built, not audited after the numbers come in wrong.

I call it a convention you'd defend in an audit, and that phrase is borrowed on purpose from compliance work. A value is audit-defensible when it's predictable, documented, classified the way you intended, and reconstructable months later. Point that same bar at measurement instead of consent and you get a UTM standard that holds up when someone asks why a channel's numbers moved. What follows is the convention itself, then how each rule maps to what Google Analytics 4 actually does with the parameters you send it.

The convention is mine. The GA4 behavior underneath it is not, so I've cited each parsing rule to Google's own documentation and kept my judgment marked as opinion, separate from the facts.

Attribution failures are governance failures

When a channel's traffic lands in the wrong bucket, the instinct is to blame the data. GA4 "lost" the campaign; the numbers are "off." They aren't. GA4 did exactly what it was told. It stored the string you sent, byte for byte, and ran it through a fixed set of classification rules you don't control. If the string didn't match, the traffic went where non-matching traffic goes. The failure happened upstream, at the moment a link was created without a rule governing what went into it.

That reframe is the whole paper. The data layer is deterministic and well documented. The place teams lose attribution is the ungoverned input: the free-text medium field, the capital letter, the space, the fourth spelling of "newsletter." A naming convention is the control that governs that input. Almost no one governs it, which is why almost everyone has an Unassigned problem.

What GA4 actually does with your tags

Three documented behaviors, and each one becomes a rule in the convention.

It stores values case-sensitively, byte for byte. Google's URL-builder documentation states it plainly: "Parameter values are case sensitive, e.g. utm_source=google is different from utm_source=Google" (Google Analytics Help — URL builders). It gives the same warning for spelling and delimiters: "Keywords with different capitalization, such as Meta and meta, are treated as different values," and "SpringSale and Spring_Sale are considered distinct" (same). There is no fuzzy matching. utm_source=Facebook, utm_source=facebook, and utm_source=FaceBook are three sources in your reports, splitting one campaign's traffic across three rows.

It derives the channel from your medium, not the other way around. GA4 does not report your raw medium string to stakeholders. It runs each session's source and medium through a fixed rule set, the Default channel group, and assigns a channel from it ([Google Analytics Help — [GA4] Default channel group](https://support.google.com/analytics/answer/9756891)). The rules are specific and unforgiving. Email classifies when the medium is email, e-mail, e_mail, or e mail. Paid Search requires the source to be a known search site and the medium to match the regex ^(.cp.|ppc|retargeting|paid.*)$, which cpc satisfies and e-blast does not. Organic Search wants a medium that exactly matches organic. Display wants display, banner, expandable, interstitial, or cpm. Referral wants referral, app, or link. Affiliates wants affiliate, exactly (same). A medium of e-blast, newsletter, or social-fb matches none of these. It is not a smaller version of the right channel. It is no channel at all.

Non-matching mediums fall to "Unassigned." Google defines it: "Unassigned is the value Analytics uses when there are no other channel rules that match the event data" (same). That is where an off-convention medium goes, not into Email-but-slightly-wrong, but into a bucket that means GA4 could not tell what this traffic was. One lookalike is worth separating out: "(other)" is not a naming failure. Google defines it as "the value Analytics uses for an aggregated row due to cardinality limits" (same), a high-cardinality reporting artifact, not a tagging mistake. Unassigned is the one your convention prevents.

Google already told you to be strict

The strongest argument for treating this as governance isn't mine. It's Google's. The same URL-builder page that defines the parameters also prescribes the discipline: "Maintain a strict, case-sensitive naming convention for all fields such as source, medium, and campaign," and "Use lowercase as a standard practice" (Google Analytics Help — URL builders). It sets the completeness bar too: "When you add parameters to a URL, you should always use utm_source, utm_medium, and utm_campaign," and it recommends that if you set one parameter you set all the relevant ones, to avoid (not set) values in reporting (same).

That is a vendor documenting the rules its own product obeys, then telling you in writing to be strict about them. What Google does not hand you is the enforced operating convention: the closed vocabularies, the delimiter choice, the builder that rejects a bad link. There is no ISO standard for UTMs. The platform tells you to be disciplined and leaves the discipline for you to supply. Closing that gap is the whole job.

The convention

Here is the operating standard. Four global rules, then a field-by-field template you can lift straight into your own documentation. Every "why" ties back to a GA4 behavior above, so the convention isn't preference. It's the input rules written to match the parser.

Global rules

• Lowercase, always. The cheapest possible enforcement of a rule Google already documented. Case-sensitivity is fact; lowercase-only removes an entire class of fragmentation for zero cost.
• No spaces. One delimiter, locked. Pick hyphen or underscore and use it everywhere. SpringSale is not Spring_Sale, per Google. Mixing delimiters re-creates the fragmentation you're trying to kill.
• Controlled vocabularies for source and medium, never free text. Free text is where the fourth spelling of "newsletter" and the Unassigned pile come from. Source and medium are the two fields that feed channel classification, so they are the two you lock hardest.
• Always set source, medium, and campaign, and stamp a utm_id. The ID is the stable key that ties a link back to your campaign record. Set the optional two, term and content, only with a defined purpose.

The template

The allowed-value columns are short and closed on purpose. Every value in the medium list earns its place because Google's channel rules recognize it; every value you add outside the parser's vocabulary is a future row in Unassigned.

Where the convention stops: Google Ads

A convention honest about its own limits is more defensible, not less. UTMs govern the traffic you tag by hand: email, organic social, referral, partner links, offline and QR codes, non-Google paid. They do not govern Google Ads.

When a Google Ads gclid (auto-tagging) and manual UTMs are both present on a URL, GA4 uses the auto-tagged values: "If you use manual tagging and auto tagging together, then the source, medium, and other traffic-classification dimensions use the auto-tagged values" (Google Analytics Help — Traffic-source dimensions, manual tagging, and auto-tagging). Google Ads' own documentation states there is no switch to change it: in GA4, "auto-tagging is prioritized over manual tagging due to the absence of an override option" (Google Ads Help — About auto-tagging).

A common myth, corrected. A lot of secondary guidance tells you to flip a GA4 setting so manual UTMs override the Google Ads gclid. That setting exists, but it does not do that. Its literal wording is "Allow manual tagging (UTM values) to override auto-tagging (DCLID values)," and DCLID is the Campaign Manager 360 / Display & Video 360 click ID, not GCLID, the Google Ads one. It applies to click data only, and not to the Google Marketing Platform acquisition reports (Google Analytics Help — CM360/DV360 auto-tagging override). There is no equivalent override for Google Ads gclid in GA4. So the governance move for Google Ads is the opposite of hand-tagging: link your Ads and GA4 properties, let auto-tagging carry the classification, and don't spend effort UTM-ing ad URLs that will lose to the gclid anyway. State that boundary plainly. It's a place lesser conventions get the facts wrong.

A convention you don't enforce is theater

A naming standard that lives in a wiki page and depends on everyone remembering it is not a control. It's a suggestion with good intentions. The enforcement is the part that makes it audit-defensible, and it belongs at the point a link is created, not in the report after.

Enforcement means a link builder or validator that does four things before a link ships: forces lowercase, restricts source and medium to the governed lists, rejects spaces, and stamps a campaign utm_id. Fix the taxonomy at creation, never in the report. Post-hoc channel-grouping overrides and regex clean-up in your BI tool are the tax you pay for not governing the input, and they only repair the report you remembered to repair, while the raw data stays fragmented underneath. Prevention is one rule at the builder. Reconciliation is forever.

Where to start

You don't need a new platform to begin, and you don't need to fix everything at once. Start where the money and the scrutiny are, usually paid and lifecycle, and pull the source, medium, and campaign values GA4 has actually recorded for the last quarter. Sort them. The variants jump out: three spellings of one source, the capitalized medium, the campaign names with four different delimiters, the pile sitting in Unassigned. That list is your exposure. Writing the governed vocabularies to replace it is most of the convention, and reconstructing why your current values fragmented is the audit.

I've stood up UTM and campaign-naming governance across a large, multi-office organization, and the lesson that held every time is this: the convention is never the hard part. The enforcement is. The teams whose numbers you can trust are not the ones with the most elegant taxonomy. They're the ones who put the taxonomy behind a builder, so a bad link can't be made in the first place. Govern the input and you can trust every downstream decision built on it. Leave it free-text and no dashboard built on top is defensible, because you can't show why any number is the number it is.