UTM tags explained for small business owners

Without them, most of your traffic lands in a bucket called direct, which means analytics has no idea. Direct traffic is not people typing your address. It is your newsletter, your QR code, your Instagram bio link, and half your paid clicks, all collapsed into one line you cannot act on.

That single failure is why so many owners believe attribution is impossible. It is not impossible. It is untagged.

What do the five parameters actually mean?

They are labels you invent. Analytics reads them literally and does no interpretation, which is why consistency is the whole game.

utm_source is where the link lives. facebook, newsletter, yelp, printed_menu, partner_site. The specific platform or place.

utm_medium is the type of channel. email, social, cpc, qr, referral, print. Keep this list short. Five to eight values total, forever.

utm_campaign is the reason you are sending traffic. summer_patio_2026, grand_opening, catering_launch. Name it after the initiative, not the date alone.

utm_content distinguishes two versions of the same link. header_button versus footer_link. Optional, useful when you have two links in one email.

utm_term was built for paid keyword data and is largely handled automatically now. You can ignore it.

The single most common mistake is inconsistent capitalisation and spelling. Facebook and facebook are two different sources in your report. So are email and e-mail. Lowercase everything, use underscores, never spaces, and keep the approved list in one document.

What does a tagging audit actually find?

Two things, and here is the arithmetic for both.

Part one, the size of the unknown bucket. Pull ninety days of traffic by source. Say it shows 4,860 sessions with 1,431 landing in direct. That is 29.4%derived of everything, and it is the largest single row on the page. A source that large and that unlabelled means your report is describing roughly seven tenths of your business.

Tag the eleven places you control, wait ninety days, and pull it again. Now 612 of 4,720 sessions are direct, or 13.0%derived. The 819 sessions (derived) that moved out of the bucket resolved to newsletter 341, Google Business Profile 288, Instagram bio 130 and printed QR codes 60. Those four rows already existed. You simply could not see them.

Part two, the collisions. Sort your source report alphabetically instead of by volume and look for near-duplicates. A typical first audit finds something like facebook 412 sessions, Facebook 96, and FB 41. That is one source reporting as three, totalling 549 sessions (derived), with the biggest row showing 75.0%derived of the real figure. You were understating that channel by a quarter and making budget decisions on it.

Fixing it forward matters more than cleaning the history. Add the correct spelling to the convention document, use it from today, and annotate the date so the next person reading the chart knows why the line steps.

One rule about the comparison: do not judge performance across the tagging change. New tags create a break in your history, and comparing a tagged ninety days to an untagged ninety days will fool you. That is a specific case of a general problem, since month to month comparisons already carry seasonal distortion before any tracking change is added on top.

Where do UTM tags belong and where do they break things?

They belong on any link you control that points at your own site from somewhere else.

Email links. Social bio links. QR codes on printed material. Partner websites. Digital ads that do not tag automatically. Your Google Business Profile website link, which is one of the highest value tags most local businesses never add, because it separates map traffic from general organic. The size of that prize is documented: in Patient Prism's 2025 cohort of 8,280 dental locations and 11,552,668 calls, 90% of attributable patient contacts came from the Google ecosystem, with the Business Profile alone accounting for 54%. Patient Prism sells call intelligence, so label it vendor research, and the shape holds well beyond dentistry. If the largest single source of your business is untagged, nothing downstream can be right.

They do not belong on internal links between pages of your own site. Tagging an internal link restarts the session and destroys the original source, which means you overwrite the truth with your own label. This happens constantly on sites where somebody tagged the navigation menu.

They also should not be used on links you expect people to share. A tagged link posted to a forum spreads that campaign label to everyone who clicks it, including people who found it in a completely different way.

Ads on Google and Meta usually populate source and medium automatically, and adding manual tags on top can override the automatic version and lose granularity. Check what the platform does before you tag by hand.

How do I set a convention I will still follow in a year?

Write it on one page and store it where whoever builds a link can find it.

The page needs three things. Your approved medium list, closed and short. Your naming pattern for campaigns, with two examples. And a rule for who creates tagged links, which for a small business should be one person or one shared builder tool.

Build links with a generator rather than by hand. Google's Campaign URL Builder is free and it removes typos, which are the main failure mode.

Then shorten the result if it is going in print or on a card. A long tagged link on a menu looks like spam and nobody types it. A short link or a QR code carries the tags invisibly.

Audit quarterly, using the two-part method above. It takes twenty minutes.

What can UTM tags never tell me?

This is where most reporting goes wrong, so it deserves saying plainly.

UTMs record the last tagged link a visitor clicked before arriving. They do not record influence. Somebody who saw your ad three times, asked a friend, then searched your name and clicked an untagged result appears as organic, and the ad gets no credit at all.

They also cannot see offline. A customer who walks in because of a sign does not exist in your analytics under any label.

And they break when a link is copied without the tag, stripped by a platform, or opened in an app browser that drops parameters. Some of your tagged traffic will still land as direct. That is normal and it is not a setup error.

The whole open web is getting quieter on this front, which changes how much any channel table can carry. SparkToro's panel work with Similarweb on US Google searches from January to April 2026 puts 68.01% of searches ending without a click, and reports that per 1,000 US Google searches only 276 clicks now reach the open web against 374 in 2024, a 26% reduction in two years. That is panel-based vendor research, Google has publicly disputed the methodology, and a separate 2026 measurement using a different definition reached a very different figure. Use the direction, not the decimal. The direction is that fewer sessions arrive at all, so the ones that do deserve a correct label.

So treat UTM data as a strong signal about channel direction, not as a ledger. Once you accept that, splitting credit across five channels on no budget becomes a practical exercise rather than a hopeless one, because you stop asking the data to be exact.

Can I build an AI channel in my analytics?

No, and this is the newest way a channel report gets quietly falsified.

Google states that clicks from AI Overviews and AI Mode are included in ordinary search traffic. They arrive as `google / organic` with no referral parameter, no distinguishing query string, and nothing you can attach a UTM to, because you do not control the link. There is no AI channel in GA4 to switch on, and there is no setting that creates one. Google's Search Console generative-AI reports, live since June 2026, give impressions, pages, countries, devices and dates, and explicitly withhold clicks, click-through rate, position and the user's prompt. So any dashboard showing you AI-sourced sessions has a rule somebody wrote, not a measurement. Ask to see the rule.

Three smaller leaks work the same way. Native app clients for assistants often strip the referrer, so those sessions land in direct. Referrer policies drop the source on some secure connections and inside in-app browsers. And the largest leak is the click that never happens: Kevin Indig's Growth Memo analysis found that 62% of the time, when an AI system uses your content and links it, the answer text does not name your brand at all.

The honest treatment is to label the direct bucket as partly unknowable rather than pretending you have cleaned it. Restaurant operators recognise the pattern. Food cost variance rarely hides where you first look for it, and the fix in both cases is the same: measure the pieces you can measure cleanly, then reason about the gap rather than pretending it is not there.

What to do this week

Open your analytics traffic source report for the last ninety days. Find the direct line and write down its share. If it is one of your two largest sources, you have a tagging problem, not a mystery.

List every place a link to your site exists that you control. Newsletter footer, Instagram bio, Google Business Profile, partner pages, printed material, email signature. Usually between six and fifteen.

Tag them, using one convention, in one afternoon. Start with your Google Business Profile link and your email links, which together carry most of the untagged volume for a local business.

Sort the source report alphabetically once and merge the near-duplicates into the convention document.

Then leave it alone for ninety days before judging anything. When the report arrives, read the source table before the summary. Reading a monthly marketing report critically starts with checking whether the channel labels are real or invented by a missing tag.

Questions about your tagging?

Email me at eric@seod.com with one tagged link you are currently using, pasted in full. I will send it back corrected, plus a one page naming convention sheet built for your channels that you can hand to whoever creates links.

I answer these personally and it takes about five minutes. Send the messiest one you have.

More on measurement sits in the analytics library.