UTM tags, referrers and direct traffic: read acquisition sources correctly

A rise in direct traffic does not necessarily mean more people typed your domain into a browser. A UTM-tagged visit does not prove that one campaign created the demand. A missing referrer does not prove that the visit had no source.

These concepts appear in the same acquisition reports but describe different signals:

• UTM parameters are labels deliberately added to a URL;
• the referrer is information a browser may transmit;
• direct traffic is a classification used when the analytics system has no more specific usable source under its rules.

Reliable reporting starts with that distinction. It also accepts that web attribution is a reconstruction from incomplete signals, not a complete history of a person’s journey.

UTM tags are declarations attached to a link

A campaign URL might look like this:

https://www.example.com/guide/?utm_source=newsletter&utm_medium=email&utm_campaign=launch_june

Common parameters are:

• utm_source: the declared origin, such as linkedin, newsletter or a partner;
• utm_medium: the channel family, such as paid_social, email or referral;
• utm_campaign: the initiative name;
• utm_content: a creative, placement or link variant;
• utm_term: historically used for keywords, and best used only when there is a clear need.

Google documents additional manual campaign parameters, but most small teams gain little from more dimensions. Three required fields and one optional variant are usually enough.

UTM values are not detected by the browser. A person or system writes them into the link. Treat them as declared campaign metadata, with the strengths and weaknesses of any declared data.

What UTM tags do well

They help when the referrer is missing, generic or insufficient:

• newsletters;
• QR codes;
• PDF documents;
• email signatures;
• organic or paid social posts;
• partner campaigns;
• in-app links.

They also distinguish two links to the same destination, such as a newsletter hero button and footer link.

What they do not prove

A UTM tag does not prove that the campaign caused all demand. It says that the measured visit arrived with that label.

The URL may have been copied into a private channel, forwarded by a colleague, opened much later or altered by an intermediary. The visitor may have discovered the brand elsewhere first.

Reports should therefore describe visits and conversions attributed under the measurement rule, not certain causality.

The referrer is conditional browser information

When a browser follows a link, it may send the HTTP Referer header to the destination. The historical misspelling remains part of the protocol.

What is sent depends on referrer policy, protocol, browser, opening context and the source site’s choices.

The modern default policy, strict-origin-when-cross-origin, generally sends:

• the full URL for same-origin navigation;
• only the origin for HTTPS cross-origin navigation;
• no referrer when moving from HTTPS to HTTP.

A site can apply a stricter policy, an app can open a webview, and redirects or privacy protections can remove the signal. Referrers are useful but never guaranteed.

Referrer and UTM can coexist

A visit may provide:

• referrer: linkedin.com;
• utm_source: linkedin;
• utm_medium: paid_social;
• utm_campaign: webinar_june.

The analytics platform then applies its own precedence rules. GA4 exposes manual source, medium and campaign dimensions while channel groups follow documented rules that can evolve.

Do not compare reports without checking scope. First-user source, session source and key-event attribution answer different questions.

Direct means that no better source was assigned

In everyday language, “direct” suggests a typed URL or bookmark. Those visits exist, but the channel can also contain visits whose source was lost.

Common examples include:

• untagged links in mobile apps or messaging tools;
• local documents, PDFs and presentations;
• redirects that drop parameters;
• restrictive referrer policies;
• secure-to-insecure navigation;
• email campaigns without UTM tags;
• copied links shared in private channels;
• analytics deployment errors;
• URL cleanup before campaign parameters are read.

A safer interpretation is:

The platform did not assign this visit to a more specific source with the data available.

A large direct share is not automatically a problem. It becomes an audit signal when it changes abruptly, concentrates on a campaign landing page, or differs unexpectedly between tools measuring the same scope.

Build a controlled UTM taxonomy

The main risk is not a missing tag. It is inconsistent naming that fragments reports.

1. Use a closed vocabulary for utm_medium

The medium should represent a channel family. Keep a controlled list, for example:

email
paid_search
paid_social
organic_social
partner
affiliate
display
offline

Do not mix paid-social, paidsocial, cpc_social and social_paid. Platforms may treat case and spelling variants differently, and reports will often show separate rows.

2. Use source for a platform or partner

Examples:

linkedin
google
customer_newsletter
partner_acme
event_paris

Do not put the campaign name in the source, or you lose the ability to compare the same source over time.

3. Give campaigns a readable structure

A simple convention is:

goal_offer_period

Examples:

lead_demo_2026q2
launch_product_2026june
retention_webinar_2026q3

Choose one language, case and separator. Lowercase with underscores is easy to validate.

4. Reserve utm_content for useful variants

Examples include:

• hero_button;
• footer_link;
• video_a;
• creative_02;
• partner_banner.

Never use it for recipient information.

5. Centralise link generation

A validated spreadsheet, small internal generator or controlled form removes most variants. Store destination URL, source, medium, campaign, optional content, owner, creation date and status.

Never place personal data in UTM tags

Query parameters spread across many systems. They may appear in:

• browser history;
• web-server and CDN logs;
• analytics tools;
• support tools;
• screenshots;
• copied links;
• some referrer data;
• exports and reports.

Do not put an email address, name, phone number, customer ID, token or other person-level identifier in a UTM value.

For example:

utm_content=customer_12345
utm_campaign=renewal_alice@example.com

These values turn campaign metadata into a personal-data distribution channel. Use a category or creative variant, not a person.

Your data collection summary should state which parameters are allowed, retained or removed.

Five mistakes that distort reporting

Using UTM tags on internal links

Internal UTM tags can create new attribution or overwrite prior context depending on the platform. Use an event or internal dimension to compare navigation placements.

Tagging everything without a question

A tag is unnecessary when the referrer provides enough information and no variant needs to be separated. Campaign metadata should answer a decision, not simply add columns.

Changing convention mid-campaign

linkedin, LinkedIn and linkedin.com can become three rows. Correct naming at generation time and keep a change log.

Cleaning the URL too early

Removing visible parameters after capture can produce a cleaner address. Removing them before analytics reads them loses the campaign. Test execution order.

Comparing tools without aligning definitions

Platforms can differ in session definitions, attribution windows, source lists and precedence rules. A discrepancy is not automatic proof that one tool is broken.

Diagnose a rise in direct traffic

1. Locate the change

Inspect landing pages, devices, countries and time patterns. A home-page increase differs from a spike on a campaign-only page.

2. Review deployments

Look for changes to redirects, routing, CMP behaviour, tag managers, analytics scripts or URL cleanup.

3. Audit live campaign links

Open the actual links in emails, ads, profiles, QR codes and documents. Do not rely on the planning sheet.

4. Test the complete journey

Follow the link in its real context: app, messenger, embedded browser, PDF or QR code. Inspect the collection request and final report.

5. Accept residual uncertainty

Dark social and no-referrer contexts cannot be reconstructed with certainty without more intrusive tracking. Responsible analytics sometimes keeps an unknown bucket rather than manufacturing false precision.

A minimal acquisition dashboard

For a small B2B team, four views are often enough:

1. visits by source and medium;
2. landing pages by source;
3. meaningful conversions by source;
4. direct and unassigned trends.

Add cost and revenue only when definitions and joins are reliable. An apparently precise ROAS built on incomplete identifiers may be less useful than a well-defined cost per qualified request.

Review trends over several weeks. Low volumes make daily changes noisy.

Conclusion

UTM tags, referrers and direct traffic are not three versions of the same field. They are separate mechanisms that complement and sometimes contradict one another.

A sound acquisition setup uses:

• a short, controlled UTM taxonomy;
• no personal identifiers in URLs;
• a realistic view of referrer limits;
• a cautious definition of direct;
• documented attribution rules;
• regular checks of the links actually distributed.

The goal is not to eliminate all direct traffic. It is to make important campaigns readable without pretending to reconstruct every journey.

FAQ

What is the difference between utm_source and the referrer?

utm_source is deliberately added to a link. The referrer is a signal the browser may send from the previous page. Either, both or neither may be present.

Does direct traffic mean people already know the brand?

Sometimes, but not exclusively. It also includes visits for which no usable source was assigned, including some apps, documents and untagged campaigns.

Which UTM parameters are essential?

For most teams, utm_source, utm_medium and utm_campaign are the baseline. Use utm_content for a meaningful variant and add other parameters only for a defined question.

Should internal links use UTM tags?

Usually not. They can disrupt attribution. Use dedicated events or dimensions for internal navigation.

Can UTM parameters be removed after arrival?

Yes, once they have been captured correctly. Test execution order and retain the values only according to your collection and retention policy.

Sources

• Google Analytics, Traffic-source dimensions, manual tagging and auto-tagging
• Google Analytics, Default channel group definitions
• MDN, Referer header
• MDN, Referrer-Policy header
• OWASP, Information exposure through query strings in URL
• CNIL, The six GDPR principles