UTM Parameter Validation Rules: Characters, Case and Length

The short answer

A valid UTM link always has utm_source, utm_medium and utm_campaign; every value is lowercase; values use only letters, numbers, hyphens or underscores; each value stays under 100 characters; utm_medium uses a value Google Analytics 4 maps to a channel; and no value contains personal data.

The rules below explain each check, why it matters, and what breaks when it fails. Together they are the validation layer of a UTM naming convention.

Rule 1: Always include source, medium and campaign

Google says that when you add campaign parameters you should always use utm_source, utm_medium and utm_campaign. Leave one out and the missing dimension shows as "(not set)" in GA4 reports, so the visit cannot be grouped with the rest of its campaign.

utm_term, utm_content and utm_id are optional. Add utm_id when you also import cost or campaign data, because GA4 joins the two on that ID.

Rule 2: Lowercase every value

UTM values are case sensitive. Google's own example: utm_source=google and utm_source=Google are reported as two different sources. One capital letter splits a campaign into two rows that never add up.

Lowercase is the simplest standard to enforce, and it is the one Google recommends. See are UTM parameters case-sensitive for how to clean up data that is already split.

Rule 3: Use only letters, numbers, hyphens and underscores

A URL can only carry a small set of characters without encoding: letters, digits, hyphen, period, underscore and tilde (RFC 3986 calls these unreserved). Everything else has to be percent-encoded, so a space becomes %20 or +, and the value you see in reports may not match what you typed.

Three characters do real damage. An ampersand (&) ends the value and starts a new parameter, an equals sign (=) confuses parsers, and a hash (#) ends the query string entirely, so every parameter after it is lost. "spring&summer" as a campaign name silently becomes "spring".

Rule 4: Keep each value under 100 characters

GA4 limits event parameter values to 100 characters, and the full page URL (page_location) to 1,000 characters, counted after encoding. Long campaign names and stacked parameters push links toward both limits.

In practice, values of 10 to 40 characters are easy to read in reports and leave room for the rest of the URL. If a value needs more than that, the extra detail usually belongs in utm_content or a separate parameter.

Rule 5: Use medium values GA4 maps to a channel

GA4 assigns each visit to a default channel from its source and medium. utm_medium=email lands in Email; social, social-media or sm land in Organic Social; display, banner or cpm land in Display; affiliate lands in Affiliates; and a social or search source with a medium that contains "cp", or is ppc, retargeting or starts with "paid", lands in a paid channel.

A medium GA4 does not recognise, such as "newsletter-blast" or "qr", lands in Unassigned. That is not wrong, but those visits disappear from channel reports unless you build a custom channel group for them.

Rule 6: Never put personal data in a UTM value

Google Analytics terms prohibit sending personally identifiable information, and UTM values are a common way it leaks in: an email address in utm_content, or a customer name in utm_campaign. Use an internal ID instead, and keep the mapping in your CRM.

Rule 7: Pick one word separator and stick to it

Hyphens and underscores both work. Mixing them does not: spring-sale and spring_sale are two campaigns. Choose one for the whole team and write it into your convention.

A pre-launch validation checklist

Before a link ships, check that: source, medium and campaign are all present; every value is lowercase; no value contains spaces, &, = or #; each value is under 100 characters; the medium is one your channel reports expect; no value contains an email address or name; and the separator matches your convention.

Run the same checks on links other people create, not just your own. Most broken tracking comes from the fifth person to tag a link, not the first. The pre-launch tracking checklist covers the rest of the launch.

Automating the rules

Checking by hand works for a few links a week. Past that, put the rules in the tool that creates the links: UTMLoop lets an admin set the allowed values for each parameter, lowercases values automatically, and blocks a link that breaks the rules before it is saved, whether it was created in the app, the API, the WordPress plugin or an AI assistant.