Category: Acquisition
All blog posts in this category.
- 24 Aug, 2026
Email tracking pixels: what marketing teams should fix after the CNIL recommendation
An email tracking pixel often looks harmless. It is tiny, invisible, enabled by default in many email platforms, and it feeds a familiar metric: the open rate. But that simple metric can hide a compliance decision. A pixel may reveal that a specific address loaded a message, when it happened, and sometimes technical context associated with that request. The event can then feed a CRM profile, a campaign report, a lead score or an automation workflow. This is not always just campaign statistics. In many setups, it is tracking. In April 2026, the French data protection authority, CNIL, published its final recommendation on tracking pixels in emails. For marketing, CRM, growth and communications teams, the useful question is no longer: “Should we keep open rates?” The useful question is: what purpose does the pixel serve, what data does it collect, for which recipients, and on what basis? This article gives teams a practical way to review email measurement without abandoning useful reporting altogether. Why this changed in 2026 CNIL published its final recommendation on tracking pixels in emails on 14 April 2026, after a public consultation. The recommendation applies to private and public organisations using such pixels, and to the technical providers involved in that ecosystem. It clarifies three areas:the role of each actor, especially senders and providers; when consent is required; when a pixel may be exempt, under strict conditions.CNIL also introduced a progressive approach for email addresses collected before publication. Senders could continue using certain pixels if recipients received clear information within a period that should not, in principle, exceed three months from 14 April 2026, and if no objection was received after recipients had an easy way to object. At the time of publication of this article, that period has passed. For teams that have not reviewed their emails, this is no longer a theoretical issue. Tool settings, email templates and real purposes should be checked. What an email tracking pixel actually measures A tracking pixel is usually a tiny image loaded from a remote server when an email is opened. The image URL may contain an identifier tied to a recipient, campaign, message or variant. When the email client loads the image, it sends a request. Depending on the platform configuration, that request may reveal or record:that a message was opened or loaded; the date or time of the opening; a recipient or message identifier; the campaign or segment; technical data transmitted with the request; sometimes approximate location or email-client-related information, depending on the processing performed.The important point is that the pixel is not automatically an abstract performance metric. In many configurations, it first creates an individual signal, and that signal is later aggregated into a report. Teams should also be careful with the business interpretation. An “open” does not necessarily mean a person read the message. Images may be blocked, preloaded, proxied or loaded in ways specific to the email client. Open rate can still help with broad trends, but it should not be treated as a reliable measure of individual attention. The starting point: define the purpose The risky shortcut is to classify pixels by platform: “our email tool does this, so it must be standard.” CNIL’s framework pushes teams to start with purpose instead. The same technical mechanism can serve several goals:measuring campaign audience; personalising future messages; scoring a prospect; triggering a sales alert; cleaning an inactive list; improving deliverability; authenticating the user for a requested service.Those goals do not all lead to the same analysis. Article 82 of the French Data Protection Act governs operations that access information stored in terminal equipment or store information there. It is built around consent, with exceptions where the operation exclusively enables or facilitates electronic communication, or where it is strictly necessary to provide an online communication service expressly requested by the user. In practice, two questions must be separated:Does the pixel require consent under tracker rules? Does the related personal data processing also comply with the GDPR, including legal basis, information, retention and rights?Tracker consent and the GDPR legal basis are connected, but they are not the same thing. A sender may be allowed to send a commercial email in certain situations, yet that does not automatically permit the use of a tracking pixel under the rules for trackers. Uses that usually require consent Individualised marketing uses are the most sensitive. This is the case when the pixel reveals that a person opened a message and that signal changes the profile, score, segment or next step in the journey. Typical examples include:showing in the CRM that a contact opened an email; triggering a follow-up after an open; prioritising a lead because they opened several messages; personalising a newsletter based on previous opens; measuring a recipient’s interest in a category of offers; producing contact-level or account-level reporting.These uses go beyond deliverability. They aim to understand, influence or personalise the relationship with a person. They should be treated as tracking purposes in their own right. Mixed-purpose pixels deserve particular attention. One pixel can pursue both an exempt purpose and a purpose subject to consent. But the purpose that requires consent can only be activated after valid consent has been collected. It is not healthy to place a pixel “just in case” and decide later how it will be used. Deliverability may be exempt, but only narrowly The recommendation recognises a possible exemption for certain individual deliverability measurements. The operational idea is to identify recipients who no longer open emails so the sender can reduce frequency, stop sending or clean the list. This can protect sender reputation and avoid repeatedly contacting people who appear inactive. But the exemption is narrow. It does not make open rate a freely available metric. To stay within this framework, the pixel must be limited to the deliverability purpose and linked to a service requested by the recipient. CNIL also stresses data minimisation. In principle, the central data point for that goal is the date of the last opening. Collecting IP address, user-agent or other additional data, then deleting or anonymising it quickly, does not bring the use into the exemption if that data was not necessary from the start. For marketing teams, the lesson is simple: excessive data does not become necessary because it is deleted quickly. Not all newsletters are the same The word “newsletter” covers very different situations. A newsletter expressly requested by the user may, in some cases, be linked to a service requested by that user. A pixel used only for deliverability may then benefit from the exemption, if all other conditions are met. By contrast, a communication sent under the exception for similar products or services does not automatically become a service requested by the user. In that situation, a deliverability pixel should not be treated as automatically exempt. Teams should examine the source of the list, the subscription method, the promise made at sign-up, and the actual purposes of the pixel. A personalised newsletter raises another issue. If the pixel directly contributes to personalising content or frequency, consent may be linked to the subscription when the information is clear and the purposes are sufficiently connected. This should not become a vague formula such as “we improve your experience.” The recipient must understand what they accept. Transactional emails, cart reminders and regulatory messages Transactional emails often have a more favourable analysis, but not without limits. An order confirmation, subscription confirmation, invoice, password reset or legal notice may be linked to a service requested by the user. A pixel limited to a compatible purpose, such as deliverability or user authentication, can therefore be analysed within the exemption framework. But the message content matters. If an email presents itself as transactional while including a strong promotional element, the analysis changes. CNIL gives cart reminders as an example: their purpose is essentially promotional, since they encourage the recipient to complete a purchase, so they cannot benefit from the transactional-email exemption. The right approach is to classify templates one by one: confirmation, invoice, onboarding, newsletter, prospecting, reminder, support, security, product notification. A single global rule for “all emails” will almost always be too rough. Tracking links should not be ignored The recommendation directly addresses pixels in emails. Tracking links are not directly covered by that specific recommendation, but CNIL notes that similar principles should be considered. A tracking link may contain a recipient, campaign or segment identifier. When clicked, it can associate an action with a person. Depending on the technique, it may also involve operations covered by Article 82. For acquisition teams, the practical distinction is useful:UTM parameters describe a campaign or channel; person-level identifiers in links track a recipient.Pomelo’s guide to UTM tags, referrers and direct traffic explains how to tag campaigns without confusing attribution with individual tracking. The guide to privacy-first URL parameter filtering completes the picture: an email address, customer ID or token should not flow through URLs measured by web analytics. How to audit your email platform The audit should start with real emails, not only global platform settings. List your message categories: newsletter, nurturing, prospecting, transactional, support, security, product, events. For each category, record whether open tracking is enabled, whether clicks are tracked, whether data syncs to the CRM, and whether automations use those signals. Then ask five questions. 1. What purpose is being pursued? Write one understandable sentence: “reduce sending frequency for inactive recipients,” “measure overall newsletter performance,” “trigger a sales follow-up,” or “personalise content.” If the purpose is vague, the configuration is probably vague too. 2. What data is collected? Do not stop at “opened or not opened.” Check identifiers, timestamps, IP address, user-agent, campaign data, CRM tags, exports and provider logs. 3. Is the data necessary? For deliverability, CNIL indicates that the date of the last opening is, in principle, the central data point. If the tool collects more, the sender should justify that need or disable excessive collection. 4. Is the choice understandable and easy to withdraw? When consent is required, the recipient must understand the scope of their choice. They must also be able to withdraw consent as easily as they gave it. A preference centre may group several choices, but it must not make rights harder to exercise. 5. What happens after withdrawal? Because an email already sent cannot be removed from the recipient’s inbox, the sender must have a mechanism to ignore pixel requests associated with withdrawn consent. Previously collected data should also be deleted if no other legal basis justifies keeping it. A simple decision matrixUse case Conservative reading Recommended actionGlobal open rate for a newsletter Possible only if the initial collection is lawful and the data is effectively anonymised or aggregated Check the source collection, then report only aggregated metricsInactive-list cleaning for an expressly requested newsletter Deliverability exemption may be possible Limit data, document the purpose, provide information and objection mechanismsCRM scoring based on opens Individual tracking Collect valid consent and document the processingSales alert after an open Sensitive individual tracking Avoid by default or collect explicit and clear consentOrder confirmation with no promotion Requested service Assess a deliverability or user-authentication exemption, without marketing reuseCart reminder Promotional communication Do not treat as an exempt transactional emailSecure unsubscribe link May be strictly necessary Keep the link limited to that purposeThis matrix is not legal advice, but it helps teams remove the most common grey areas. What if you did not inform existing lists before 14 July 2026? For addresses collected before 14 April 2026, CNIL provided a transition period. In principle, clear information enabling objection had to be sent within three months, meaning before 14 July 2026. CNIL’s FAQ notes that a longer period may be justified in certain situations, such as database size or deliverability issues, but those difficulties must be objectively documented. If no information was sent and there is no strong documented justification, the sender should apply the recommendation. That means collecting consent where the pixel requires it, or stopping the use of pixels that require consent. The safest operational response is often progressive: disable unnecessary pixels, keep only strictly justified measurements, and rebuild preferences cleanly at the next collection or subscription point. Keep useful reporting without tracking every open Reducing pixels does not mean giving up email marketing measurement. Post-click measurement is often more useful than open tracking. A click to an acquisition page, a qualified visit, a demo request, a registration or a download usually says more about intent than an image load. To do this well, tag links with non-identifying campaign parameters and read results in web analytics. UTM values should describe the campaign, channel and possibly variant, not the person. A URL such as utm_source=newsletter&utm_medium=email&utm_campaign=product_update is useful. A URL containing an email address or customer ID creates privacy debt. This is also where a clean separation between tools helps. The email platform manages sending, preferences and channel-specific obligations. Web analytics measures what happens after the click with limited and documented collection. Pomelo’s data collection summary can help explain what the analytics tool receives and what it does not receive. Pomelo follows that logic: measure useful web signals without turning every marketing interaction into person-level tracking. But no analytics tool can, by itself, make an email platform configuration compliant. The two scopes should be audited separately. Correction checklist for marketing teams Before the next campaign, review these points:identify all email templates containing a pixel; separate opens, clicks, personalisation, scoring, deliverability and security; disable pixels with no clear purpose; check whether the emails were actually requested by the recipient; limit data collected for deliverability; avoid IP address, user-agent and other additional data when unnecessary; separate aggregate statistics from individual signals; provide a simple withdrawal or objection mechanism; ensure pixels already sent are no longer exploited after withdrawal; update the privacy notice and, where needed, the preference centre; document platform settings and retained choices; check contracts and roles with providers.The analytics privacy notice offers a useful method for avoiding overly broad wording. The same principle applies here: do not promise “anonymous” or “purely statistical” measurement if the tool first processes signals tied to a person. Conclusion CNIL’s recommendation does not say that all email measurement is forbidden. It imposes clearer discipline: name the purposes, limit the data, separate deliverability from individualised marketing, and give people real control where consent is required. Open rate can still exist in some reports. But it should be placed where it belongs: a fragile metric, sometimes useful in aggregate, rarely sufficient to steer a campaign alone, and legally sensitive when it relies on individual tracking. For marketing teams, the fix is not only to change one checkbox in Mailchimp, Brevo, HubSpot or another platform. It is to rebuild email measurement so it is more limited, more explicit and more coherent with the rest of the analytics stack. FAQ Are email tracking pixels always subject to consent? No. Some pixels may be exempt, especially for tightly defined deliverability or user-authentication purposes. But individualised marketing, scoring, personalisation and sales alerts usually require a consent analysis. Can a global open rate be calculated from aggregated data? It can be calculated from lawfully collected data that is then effectively anonymised or aggregated. This does not remove the need to analyse the initial pixel collection. Downstream aggregation does not fix excessive or unauthorised collection. Can an expressly requested newsletter use a deliverability pixel? Yes, it may be possible if the newsletter is a service requested by the user and the pixel is limited to deliverability. The sender should limit the data and avoid reusing that signal for scoring or uncovered personalisation. Are tracking links covered? The recommendation directly covers pixels in emails. Tracking links are not directly covered by that text, but they should be analysed using the same principles: purpose, transparency, possible consent and minimisation. What should we do first if pixels are enabled everywhere? Start by disabling uses with no clear purpose, then separate deliverability, aggregate measurement and individual tracking. After that, update information, preferences, consent evidence and tool settings. SourcesCNIL, Tracking pixels in emails: CNIL publishes recommendations to better protect privacy, 14 April 2026 CNIL, Q&A - recommendation on tracking pixels in emails, 22 July 2026 Légifrance, Article 82 of the French Data Protection Act EDPB, Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, final version, 16 October 2024 CNIL, Cookies and other trackers topic page
- 20 Jul, 2026
Acquisition pages: seven signals to track without building an analytics maze
An acquisition page does not need fifty metrics to be managed well. It needs to answer a short chain of questions:are the right people arriving? do they understand the proposition? do they move toward the intended action? do they complete it? are the resulting leads or sales useful? does the page work properly? is the measurement reliable enough to support a decision?This chain prevents two common mistakes. One is judging a page only by traffic volume. The other is adding behavioural events without connecting them to a business decision. For an SME or B2B SaaS team, seven signals are usually enough for a sound diagnosis. Define the page's job before its metrics Not every acquisition page has the same objective. A page may aim to:generate demo requests; start trials; collect quote requests; sell a product; deliver a resource; register attendees; move visitors to pricing; qualify a need before a sales conversation.Its primary KPI follows from that job. An educational content page should not be judged like a demo page. An awareness campaign should not be read like high-intent search. Document four elements first:Element QuestionAudience Who is the page for?Promise Which specific problem does it solve?Source Which channel or campaign brings visitors?Action What useful action should follow the visit?This short brief becomes the reference point when the numbers change. Signal 1: qualified entries by source The first signal is not raw session volume. It is the distribution of entries by source, campaign and intent. Two hundred visits from a precise query may be more useful than two thousand loosely targeted visits. Conversely, low volume does not prove quality if none of the visitors belong to the intended segment. Review at least:visits or sessions starting on the page; source and medium; campaign; identified ad or link content; organic query where Search Console provides it; country or commercial region when genuinely relevant; direct traffic, interpreted cautiously.GA4's Landing page report associates the first pageview in a session with metrics such as sessions and key events. It can also use Session source / medium as a secondary dimension. Search Console complements this view for Google Search with clicks, impressions, CTR, position, queries and pages. The tools do not measure the same thing. Search Console describes visibility and clicks in Google results. Analytics describes activity observed after arrival, within its collection limits. Their totals should not be expected to match visitor by visitor. For campaigns, a stable UTM convention matters more than a sophisticated dashboard. Our guide to UTMs, referrers and direct traffic explains how inconsistent labels fragment reports. Signal 1: Decision question Is the page attracting the audience its message was designed for? Signal 2: intent-to-message fit A page can receive relevant traffic and still fail because its promise does not match the reason behind the click. Compare:the ad copy; the keyword or query; the newsletter link; the visible headline; the supporting proof; the requested action.Someone clicking “compare analytics tools for multiple websites” should encounter that topic immediately. Opening with generic digital-transformation language creates a gap even when the design is polished. No single rate captures this signal. Use several clues:conversion by source or campaign; primary CTA clicks; movement toward the expected section; very fast exits, interpreted cautiously; feedback from sales or support; focused user tests.Engagement time can flag an anomaly, but it is not proof of interest. A long duration may mean close reading or confusion. A short duration may mean abandonment or an immediate answer. Signal 2: Decision question Does the visitor clearly find the promise that brought them to the page? Signal 3: primary call-to-action activity The primary CTA is the first observable commitment toward the objective. Track an action that matters, such as:clicking Request a demo; opening a form; moving to pricing; adding to cart; starting a trial; confirming a download; scheduling a meeting.Do not label every click as a conversion. Accordion opens, tab clicks and scroll depth can support diagnosis, but they do not carry the same intent as a commercial action. A useful measurement sequence is usually:page entry; primary CTA click; form or flow start; successful completion.This separates a messaging weakness from a form problem. If few visitors click, investigate what happens before the CTA. If many click but few finish, inspect the next step. A minimal analytics tracking plan helps keep those definitions stable. Signal 3: Decision question Does a sufficient share of qualified visitors choose to continue? Signal 4: conversion completion The final conversion is the action the business considers useful. It must be unambiguous. Examples include:an accepted form submission; a confirmed appointment; an account creation; a completed payment; an activated trial; a delivered download.Always name the denominator. “Eight per cent conversion” is meaningless without knowing whether it refers to visitors, sessions, form opens or CTA clicks. For a form, measure at least:opens; starts; errors; abandonment; successful completion.Do not send field values to analytics. Form content may contain names, email addresses, phone numbers, free text and other personal data. The business system needs the content. Analytics usually only needs a technical or functional status. Signal 4: Decision question Where does the journey lose people who already expressed intent? Signal 5: post-conversion quality A page can achieve a strong conversion rate and create poor commercial outcomes. For B2B teams, the decisive signal often appears after the form:fit with the target profile; a request genuinely related to the product; an attended meeting; an opportunity created; continued sales progression; revenue or value created; spam and off-target demand.Connect acquisition to the CRM with proportionate granularity. You do not always need to send personal CRM data back into analytics. An aggregate table by campaign, source or landing page may be enough to answer which entries produce useful demand. Agree on a short sales classification:qualified; unqualified; duplicate; spam; outside market; no next step; opportunity.This prevents marketing from optimizing only for form volume. Signal 5: Decision question Does the page create useful outcomes rather than submissions alone? Signal 6: technical performance and errors A slow or unstable page can damage the experience before the message is evaluated. Core Web Vitals provide three field indicators:LCP for main-content loading; INP for interaction responsiveness; CLS for visual stability.Complement them with operational checks:JavaScript errors; forms that cannot submit; blocked resources; mobile CTAs hidden by layout; incorrect redirects; a 404 after submission; missing or duplicated tracking; consent logic applied incorrectly; abnormal server response time.Do not confuse correlation with causation. A technical improvement may accompany a conversion increase without being its only cause. Use performance data to identify differences by device, release and period. Signal 6: Decision question Is a technical constraint preventing part of the audience from progressing? Signal 7: measurement health The seventh signal concerns the data itself. Before interpreting a change, verify:event volume relative to visits; duplicated tags; consent changes; missing or inconsistent campaign parameters; redirects that lose parameters; sensitive values in URLs; form changes; releases during the period; time-zone differences; internal filters and exclusions.A 30 per cent increase may come from a successful campaign, a duplicated event or a changed definition. Document measurement changes before assigning a business cause. Our guide to privacy-first URL parameter filtering helps prevent identifiers and sensitive values from entering reports. Signal 7: Decision question Does the observed change describe the market, or a change in the measurement system? A minimal dashboard A landing-page dashboard can use this structure:Block Primary measure Useful breakdownAudience Qualified entries Source, campaign, deviceMessage CTA clicks / entries Source, variantJourney Starts and completions Step, deviceOutcome Useful conversions Campaign, segmentQuality Qualified leads Source, pageTechnical Vitals and errors Device, releaseMeasurement Documented anomalies Date, deploymentLimit comparisons to segments that can lead to action. A filter that changes no decision adds complexity without improving control. Review cadence Weekly Check:traffic breaks; form errors; misattributed campaigns; extreme changes; mobile problems; performance incidents.Monthly Review:source quality; conversion trends; lead quality; pages and campaigns to improve; tested hypotheses; decisions made.Put the conclusion into the monthly web report rather than sending a separate export from each tool. Metrics not to over-interpret Bounce rate Its definition varies by tool and context. A short visit to a page that answers a question immediately is not necessarily a failure. Scroll depth It may show how far content was traversed, but not what was understood. It is useful for comparing variants, not for proving intent. Time on page It combines attention, confusion, abandoned tabs and measurement constraints. Heatmaps They can help form a hypothesis, but they do not replace conversion data or user research. They also involve more detailed collection that should be assessed separately. Click volume It only matters when the action matches an explicit objective and the event is not emitted more than once. Conclusion An acquisition page should be managed as a chain, not as a ranking of metrics. The seven useful signals are:qualified entries; intent-to-message fit; CTA activity; conversion completion; post-conversion quality; technical performance; measurement health.Start with this structure. Add a metric only when it answers a question the team is prepared to act on. FAQ What is the primary KPI for a landing page? It is the useful action defined for that page: a qualified request, trial, purchase, meeting or another explicit result. Traffic and engagement mostly explain that result. Should scroll depth be measured? Only when it tests a specific hypothesis, such as whether an important proof point is rarely reached. Scroll should not be treated as a conversion. Why do GA4 and Search Console show different figures? They measure different stages and scopes. Search Console measures appearances and clicks in Google Search. GA4 measures sessions or events observed on the site, according to its setup and consent choices. How can a landing page be connected to revenue? Preserve source, campaign and landing-page context in the CRM or a controlled attribution table, then analyse aggregate cohorts. Avoid sending unnecessary personal CRM data back to analytics. How many events should be tracked? For most B2B pages, four levels are enough: entry, CTA click, journey start and success. Add diagnostic events only when they address a known problem. Sources Sources checked on June 21, 2026.Google Analytics, Landing page report Google Search Console, Performance report web.dev, Web Vitals Google Analytics, collect campaign data with custom URLs CNIL, cookies and other trackers
- 25 May, 2026
UTM tags, referrers and direct traffic: read acquisition sources correctly
A rise in direct traffic does not necessarily mean more people typed your domain into a browser. A UTM-tagged visit does not prove that one campaign created the demand. A missing referrer does not prove that the visit had no source. These concepts appear in the same acquisition reports but describe different signals:UTM parameters are labels deliberately added to a URL; the referrer is information a browser may transmit; direct traffic is a classification used when the analytics system has no more specific usable source under its rules.Reliable reporting starts with that distinction. It also accepts that web attribution is a reconstruction from incomplete signals, not a complete history of a person's journey. UTM tags are declarations attached to a link A campaign URL might look like this: https://www.example.com/guide/?utm_source=newsletter&utm_medium=email&utm_campaign=launch_juneCommon parameters are:utm_source: the declared origin, such as linkedin, newsletter or a partner; utm_medium: the channel family, such as paid_social, email or referral; utm_campaign: the initiative name; utm_content: a creative, placement or link variant; utm_term: historically used for keywords, and best used only when there is a clear need.Google documents additional manual campaign parameters, but most small teams gain little from more dimensions. Three required fields and one optional variant are usually enough. UTM values are not detected by the browser. A person or system writes them into the link. Treat them as declared campaign metadata, with the strengths and weaknesses of any declared data. What UTM tags do well They help when the referrer is missing, generic or insufficient:newsletters; QR codes; PDF documents; email signatures; organic or paid social posts; partner campaigns; in-app links.They also distinguish two links to the same destination, such as a newsletter hero button and footer link. What they do not prove A UTM tag does not prove that the campaign caused all demand. It says that the measured visit arrived with that label. The URL may have been copied into a private channel, forwarded by a colleague, opened much later or altered by an intermediary. The visitor may have discovered the brand elsewhere first. Reports should therefore describe visits and conversions attributed under the measurement rule, not certain causality. The referrer is conditional browser information When a browser follows a link, it may send the HTTP Referer header to the destination. The historical misspelling remains part of the protocol. What is sent depends on referrer policy, protocol, browser, opening context and the source site's choices. The modern default policy, strict-origin-when-cross-origin, generally sends:the full URL for same-origin navigation; only the origin for HTTPS cross-origin navigation; no referrer when moving from HTTPS to HTTP.A site can apply a stricter policy, an app can open a webview, and redirects or privacy protections can remove the signal. Referrers are useful but never guaranteed. Referrer and UTM can coexist A visit may provide:referrer: linkedin.com; utm_source: linkedin; utm_medium: paid_social; utm_campaign: webinar_june.The analytics platform then applies its own precedence rules. GA4 exposes manual source, medium and campaign dimensions while channel groups follow documented rules that can evolve. Do not compare reports without checking scope. First-user source, session source and key-event attribution answer different questions. Direct means that no better source was assigned In everyday language, “direct” suggests a typed URL or bookmark. Those visits exist, but the channel can also contain visits whose source was lost. Common examples include:untagged links in mobile apps or messaging tools; local documents, PDFs and presentations; redirects that drop parameters; restrictive referrer policies; secure-to-insecure navigation; email campaigns without UTM tags; copied links shared in private channels; analytics deployment errors; URL cleanup before campaign parameters are read.A safer interpretation is:The platform did not assign this visit to a more specific source with the data available.A large direct share is not automatically a problem. It becomes an audit signal when it changes abruptly, concentrates on a campaign landing page, or differs unexpectedly between tools measuring the same scope. Build a controlled UTM taxonomy The main risk is not a missing tag. It is inconsistent naming that fragments reports. 1. Use a closed vocabulary for utm_medium The medium should represent a channel family. Keep a controlled list, for example: email paid_search paid_social organic_social partner affiliate display offlineDo not mix paid-social, paidsocial, cpc_social and social_paid. Platforms may treat case and spelling variants differently, and reports will often show separate rows. 2. Use source for a platform or partner Examples: linkedin google customer_newsletter partner_acme event_parisDo not put the campaign name in the source, or you lose the ability to compare the same source over time. 3. Give campaigns a readable structure A simple convention is: goal_offer_periodExamples: lead_demo_2026q2 launch_product_2026june retention_webinar_2026q3Choose one language, case and separator. Lowercase with underscores is easy to validate. 4. Reserve utm_content for useful variants Examples include:hero_button; footer_link; video_a; creative_02; partner_banner.Never use it for recipient information. 5. Centralise link generation A validated spreadsheet, small internal generator or controlled form removes most variants. Store destination URL, source, medium, campaign, optional content, owner, creation date and status. Never place personal data in UTM tags Query parameters spread across many systems. They may appear in:browser history; web-server and CDN logs; analytics tools; support tools; screenshots; copied links; some referrer data; exports and reports.Do not put an email address, name, phone number, customer ID, token or other person-level identifier in a UTM value. For example: utm_content=customer_12345 utm_campaign=renewal_alice@example.comThese values turn campaign metadata into a personal-data distribution channel. Use a category or creative variant, not a person. Your data collection summary should state which parameters are allowed, retained or removed. Five mistakes that distort reporting Using UTM tags on internal links Internal UTM tags can create new attribution or overwrite prior context depending on the platform. Use an event or internal dimension to compare navigation placements. Tagging everything without a question A tag is unnecessary when the referrer provides enough information and no variant needs to be separated. Campaign metadata should answer a decision, not simply add columns. Changing convention mid-campaign linkedin, LinkedIn and linkedin.com can become three rows. Correct naming at generation time and keep a change log. Cleaning the URL too early Removing visible parameters after capture can produce a cleaner address. Removing them before analytics reads them loses the campaign. Test execution order. Comparing tools without aligning definitions Platforms can differ in session definitions, attribution windows, source lists and precedence rules. A discrepancy is not automatic proof that one tool is broken. Diagnose a rise in direct traffic 1. Locate the change Inspect landing pages, devices, countries and time patterns. A home-page increase differs from a spike on a campaign-only page. 2. Review deployments Look for changes to redirects, routing, CMP behaviour, tag managers, analytics scripts or URL cleanup. 3. Audit live campaign links Open the actual links in emails, ads, profiles, QR codes and documents. Do not rely on the planning sheet. 4. Test the complete journey Follow the link in its real context: app, messenger, embedded browser, PDF or QR code. Inspect the collection request and final report. 5. Accept residual uncertainty Dark social and no-referrer contexts cannot be reconstructed with certainty without more intrusive tracking. Responsible analytics sometimes keeps an unknown bucket rather than manufacturing false precision. A minimal acquisition dashboard For a small B2B team, four views are often enough:visits by source and medium; landing pages by source; meaningful conversions by source; direct and unassigned trends.Add cost and revenue only when definitions and joins are reliable. An apparently precise ROAS built on incomplete identifiers may be less useful than a well-defined cost per qualified request. Review trends over several weeks. Low volumes make daily changes noisy. Conclusion UTM tags, referrers and direct traffic are not three versions of the same field. They are separate mechanisms that complement and sometimes contradict one another. A sound acquisition setup uses:a short, controlled UTM taxonomy; no personal identifiers in URLs; a realistic view of referrer limits; a cautious definition of direct; documented attribution rules; regular checks of the links actually distributed.The goal is not to eliminate all direct traffic. It is to make important campaigns readable without pretending to reconstruct every journey. FAQ What is the difference between utm_source and the referrer? utm_source is deliberately added to a link. The referrer is a signal the browser may send from the previous page. Either, both or neither may be present. Does direct traffic mean people already know the brand? Sometimes, but not exclusively. It also includes visits for which no usable source was assigned, including some apps, documents and untagged campaigns. Which UTM parameters are essential? For most teams, utm_source, utm_medium and utm_campaign are the baseline. Use utm_content for a meaningful variant and add other parameters only for a defined question. Should internal links use UTM tags? Usually not. They can disrupt attribution. Use dedicated events or dimensions for internal navigation. Can UTM parameters be removed after arrival? Yes, once they have been captured correctly. Test execution order and retain the values only according to your collection and retention policy. SourcesGoogle Analytics, Traffic-source dimensions, manual tagging and auto-tagging Google Analytics, Default channel group definitions MDN, Referer header MDN, Referrer-Policy header OWASP, Information exposure through query strings in URL CNIL, The six GDPR principles