How UTM Parameters Work
UTM parameters are plain key and value pairs appended to a URL after a question mark. A link such as https://example.com/offer?utm_source=instagram&utm_medium=paid_social&utm_campaign=spring_launch loads the same page as the bare URL, but the analytics script on that page reads the parameters and stores them with the visit.
Nothing about UTMs is enforced by browsers or servers. They work because analytics tools agree to look for them. Google Analytics popularised the convention, and almost every web analytics, product analytics and marketing automation tool now reads the same names. That shared convention is their main strength: one tagged link can be understood by every tool in your stack.
The five core parameters each answer one question. Source names the sender, such as google, meta or partner_blog. Medium names the channel type, such as cpc, email or referral. Campaign names the specific push. Term captures a paid search keyword. Content separates creatives or link placements inside the same campaign, which is how teams compare two banners or two buttons in one email.
Naming Conventions That Hold Up
UTM data is only as useful as its consistency. The most common reporting problem is not missing tags but inconsistent ones: Email, email and e-mail showing up as three channels, or a campaign named three different ways by three people.
A few rules prevent most of this. Use lowercase everywhere. Use underscores or hyphens, not spaces. Keep a fixed list of allowed utm_medium values that match your channel groupings. Put dates or quarters in campaign names in one format. Write the convention down and generate links from a shared builder instead of typing them by hand. The free UTM builder produces consistent tagged links and keeps the naming in one place.
Keep personal data out of UTMs entirely. Email addresses or user IDs in a URL end up in server logs, analytics tools and referrer headers, which creates privacy exposure under laws like GDPR.
UTM Parameters and Mobile Apps
UTMs were built for websites, and they break down at the app store. When a user taps a link to the App Store or Google Play, the store does not pass your query string into the installed app. A UTM on a store URL therefore tells you about the click, not the install.
Android has a partial workaround. Google Play accepts a referrer parameter on store links, and you can URL-encode UTM values inside it. After install, the app reads that string through the Google Play Install Referrer API. iOS has no equivalent channel for arbitrary parameters, so iOS install attribution relies on a measurement link that records the click before redirecting, then matches the install back to it.
In practice, mobile teams keep UTMs for web reporting and use attribution links for app campaigns. An MMP link carries its own campaign fields, records the click, sends the user to the right store, and attributes the install and later events. Many MMPs also accept UTM values on their links so web and app reports share the same campaign names.
UTMs in Web-to-App Journeys
UTMs matter again when a journey starts on the web and ends in the app. A user lands on a tagged landing page, then taps a button to install. To credit the install correctly, the source information from the web visit has to survive the jump to the app.
A web SDK can capture UTM values on the first and latest visit, store them, and pass them into the app link the user taps. Linkrunner's Web SDK (in beta) records first-touch and last-touch UTMs along with ad click IDs, and classifies traffic from AI assistants, search, social and referral sources, so a web-to-app install keeps the campaign that started it.
UTMs vs Click IDs
UTMs describe a campaign. Click IDs identify a single click. Ad platforms append their own click IDs, such as gclid for Google Ads and fbclid for Meta, and those IDs let the platform and your MMP tie a conversion back to the exact ad interaction.
The two work together. Click IDs give deterministic matching and feed conversion data back to the ad platform. UTMs give human-readable reporting that works across every tool, including ones the ad platform does not integrate with. Keep both on your links, and avoid stripping parameters in redirects, because a lost click ID often means a lost attribution.