UTM tracking and attribution: where your sales really come from

In short: UTM parameters are tags at the end of a link (utm_source, utm_medium, utm_campaign) that tell GA4 and your store where a buyer came from. Attribution decides which channel gets the credit for an order. In GA4 the default model is data-driven, and CloudCart saves the source of the first visit in the session against every order, with or without Google Analytics.

This guide is for online stores selling anywhere in Europe, whether you run one store or a separate store per country with its own language and currency. Below: the UTM rules, a naming guide with examples, how GA4 sorts traffic into channels and models, why Meta and Google report more sales than you actually have, what EU cookie consent does to your numbers, and how CloudCart records the source of each order. Google's rules come from the Google Analytics Help Center; CloudCart facts come from the platform documentation and the pricing page. How to connect GA4 to the store itself is covered in the guide to GA4 and Google Tag Manager.

What UTM parameters are and which ones you need

A UTM parameter is a name and value pair after the question mark in a link, for example ?utm_source=facebook&utm_medium=paid_social&utm_campaign=black_friday. Google says you should always use the three core parameters utm_source, utm_medium and utm_campaign, and strongly recommends utm_id and utm_source_platform as well. A missing parameter shows up in reports as "(not set)" (Google Analytics Help: collect campaign data with custom URLs).

Parameter	What it says	Example	Where you see it
utm_source	Who sends the visitor	facebook, google, instagram, newsletter	GA4 and CloudCart
utm_medium	What kind of channel it is	paid_social, cpc, email, sms, social, affiliate	GA4 and CloudCart
utm_campaign	Which campaign or promotion	black_friday	GA4 and CloudCart
utm_content	Which version of the ad or link	video_15s, carousel_a	GA4
utm_term	The keyword in paid search	womens_boots	GA4
utm_id	The campaign ID	bf01	GA4
utm_source_platform	The platform that buys the traffic	meta_ads	GA4

Google also accepts utm_creative_format and utm_marketing_tactic, but GA4 does not show them in reports yet. Values are case sensitive: utm_source=Facebook and utm_source=facebook are two different sources in the report. That makes "lowercase only" the first rule of any naming guide.

Important: never put personal data in a UTM value. Google states that URLs and campaign parameters sent to Analytics must not contain personally identifiable information such as email addresses (Google Analytics Help: avoid sending PII). A link like utm_content=anna@example.com in a newsletter breaks Google's terms and puts a customer's email address into a third-party report. Use a campaign or segment name instead.

How to build a UTM link: the builder and the rules

The quickest way to build a UTM link is Google's Campaign URL Builder: you enter the page address and the values, and the tool assembles the link. A link you type by hand works exactly the same way, as long as it follows the same rules.

1. Pick the landing page. Send people to the product or category from the ad, not to the home page.
2. Fill in the three core parameters. utm_source, utm_medium and utm_campaign, from the naming guide below. If the address already contains a ?, the UTM part starts with &.
3. Add a version. utm_content tells two ads, or two buttons in one email, apart.
4. Log the link in a shared sheet. One sheet with the start date, channel and link keeps the naming consistent across your team and agencies.
5. Test before launch. Open the link in a browser window where you are not logged in to the admin, accept analytics cookies in the banner, and check the visit in GA4 under Reports → Realtime.

Important: do not put UTM tags on links inside your own store, such as a home page banner pointing to a category. That link changes the source in GA4 in the middle of the visit, and the real channel (the ad, the email) loses the credit for the order. CloudCart keeps the source of the first visit, so the two reports start to drift apart.

If your store is connected to an AI assistant through a PAT token (Claude Code, ChatGPT Codex, Gemini CLI or Cursor), you can ask for the links in one sentence: "Create UTM links for the black_friday campaign for Facebook, Instagram and the newsletter, following our naming guide, all lowercase."

A UTM naming convention: how to name your campaigns

A UTM naming convention is the list of allowed values for source and medium plus a pattern for the campaign name. It decides whether the report puts all your Facebook orders in one row or splits them into "Facebook", "facebook" and "fb".

Channel	utm_source	utm_medium	utm_campaign	GA4 channel
Paid Facebook ad	facebook	paid_social	black_friday	Paid Social
Paid Instagram ad	instagram	paid_social	black_friday	Paid Social
Organic post or profile link	instagram	social	new_collection	Organic Social
Newsletter from another tool	newsletter	email	black_friday	Email
SMS	sms_list	sms	black_friday	SMS
Influencer on commission	influencer_name	affiliate	influencer_name	Affiliates
Banner on a partner site	partner_site_name	display	black_friday	Display
QR code in the parcel	parcel	qr	second_purchase	Unassigned

A campaign pattern of year_month_topic (for example the year and month in digits, then black_friday) sorts campaigns in date order in the report and keeps one year's sale apart from the next. Use Latin letters only, underscores instead of spaces, and one source value per channel. Agree on the list once and send it to everyone who creates links, including your agency and influencers.

For Google Ads, do not add UTM tags by hand. With auto-tagging on, each click carries a gclid, and GA4 takes the source, medium and campaign from it even when the link also has UTM tags. CloudCart recognises these clicks by the gclid as well.

GA4 has no rule for the medium "qr", so visits from the QR code land in Unassigned, while CloudCart shows them with the exact values. If the GA4 channel matters more to you, use utm_medium=referral.

Several country stores: put the market in the campaign name

If you sell across the EU with a separate store per country, each with its own language and currency, keep the same source and medium values in every store and add the market to the campaign name, for example black_friday_de and black_friday_at. The channel rows stay comparable across countries, and the campaign row shows which market the money came from. How to run a store per country is explained in the guide to multilingual and multi-currency stores.

How GA4 sorts traffic into channels

GA4 puts every visit into a channel (the Default channel group) by rules on source, medium and campaign name. A wrong medium therefore sends a paid ad into Unassigned or into organic traffic. Channel rules themselves are not case sensitive, but the source and medium values in your reports are (Google Analytics Help: default channel group).

GA4 channel	Rule (simplified)	What it means for your UTM tags
Paid Social	Source is a social network and medium matches ^(.*cp.*|ppc|retargeting|paid.*)$	paid_social, cpc and ppc work; "ads" with source facebook goes to Organic Social
Organic Social	Source is a social network, or medium is social, social-network, social-media or sm	A paid ad with medium "social" is counted as organic
Email	Source or medium is email, e-mail, e_mail or e mail	"newsletter" as a medium is not enough; use email
SMS	Source or medium is exactly sms	"sms_campaign" as a medium does not land here
Affiliates	Medium is affiliate	For partners and influencers on commission
Display	Medium is display, banner, expandable, interstitial or cpm	Banners on other sites
Referral	Medium is referral, app or link	Links from other sites
Direct	Source is (direct) and medium is (none) or (not set)	A typed address, a bookmark, or a link without source data
Unassigned	No rule matches	A sign that your naming guide has a mistake

GA4 attribution models: data-driven or last click

An attribution model is the rule that splits one purchase between the channels on the buyer's path. GA4 offers three models: Data-driven, Paid and organic last click, and Google paid channels last click. Google has retired the first click, linear, time decay and position-based models (Google Analytics Help: attribution settings).

Model	How it splits the credit	When it helps
Data-driven	Splits the purchase between touchpoints by their contribution, which is why reports show fractions (for example 0.6 and 0.4 purchases)	The default choice for most stores
Paid and organic last click	The whole purchase goes to the last channel before it, ignoring direct visits	Comparing with the order-source report in your store
Google paid channels last click	The whole purchase goes to the last Google Ads click; without one, it falls back to the last non-direct click	When you judge Google Ads on its own

Every GA4 model leaves direct visits out of the credit unless the path to the purchase consists only of direct visits. A buyer who clicked your email and typed the store address three days later counts as Email.

The lookback window for first_visit and first_open is 30 days (or 7), and for all other key events, purchase included, 90 days (or 30 or 60). A model change affects only key event reports with event-scoped dimensions such as Source, Medium and Default channel group; Session source and First user medium stay the same. A model change also rewrites historical data, while a lookback window change applies only from that point on (Google Analytics Help: get started with attribution).

Why Meta Ads and Google Ads report more sales than your store

Meta Ads and Google Ads count the purchases their own ads took part in, and each platform sees only its own touchpoints. A buyer who saw an ad on Instagram and then clicked an ad on Google counts as a sale in both accounts. That is why the total across ad accounts almost always exceeds the orders in your store.

In Meta Ads Manager the default attribution setting for a new ad set is 7 days after a click or 1 day after a view. Ads Manager gives the purchase to the last ad the person clicked, or to the last ad they saw if they did not click, and reports the purchase on the date the ad was shown (Meta Business Help: how conversions are attributed).

Where you look	What it counts	When it says "sale from the ad"
Meta Ads Manager	Purchases after a click on or a view of a Meta ad	Up to 7 days after a click or 1 day after a view (default)
Google Ads	Purchases after an interaction with a Google ad, by the model of the conversion action	Within the window set in the conversion action
GA4	All channels together, by the model you chose	By visits to the site and the chosen model
CloudCart, Analytics	Every order once, with the source of the first visit in the session	Only if the order came from a session that started with the ad

An example: the store has 100 orders in a month, Meta reports 60 and Google Ads reports 50, 110 in total. Make budget decisions on store revenue against total ad spend (MER) and on orders by source in the store, and use the ad accounts to compare campaigns inside each platform. The formulas are in the guide to ROAS, ROI and MER.

For Meta ads, put the UTM tags in the URL parameters field of the ad. Meta fills in dynamic parameters such as {{campaign.name}} and {{ad.name}} by itself, so utm_source=facebook&utm_medium=paid_social&utm_campaign={{campaign.name}}&utm_content={{ad.name}} shows the campaign and ad name in GA4 without typing them for every ad. Keep campaign names lowercase in Ads Manager too, because the dynamic value carries the name exactly as written. Setting up the ads themselves is covered in Meta Ads for an online store and Google Ads for an online store.

What EU cookie consent does to these numbers

In the EU, analytics and advertising cookies may be set only after the visitor agrees in the cookie banner. When a visitor declines, GA4 and the ad pixels see less of that visit, while the order itself is still saved in your store. The share of visitors who decline differs from country to country and from banner to banner, so the gap between GA4 and your orders is not the same in every market you sell to. The rule and the Consent Mode v2 setup are explained in the guide to GDPR and cookies.

How CloudCart records UTM tags and the source of every order

CloudCart saves the source against every order at the moment of the first visit in the session, whether or not you have connected GA4. If a buyer comes from a Facebook ad, leaves and comes back later in the same session by typing the address, the order stays with Facebook.

On the first visit in a session, the store checks three things:

1. Ad click parameters. gclid, gad_source, gbraid and wbraid mean Google Ads, fbclid means Meta Ads, ttclid means TikTok Ads. From gad_source CloudCart also recognises the network: 1 is Google Search, 2 Search Partners, 3 Display Network, 4 YouTube Search, 5 YouTube Videos, 6 Discover.
2. The UTM parameters. utm_source, utm_medium and utm_campaign from the first link are saved against the order.
3. The site the visitor came from. Without parameters, the source is set from the previous page's address and sorted into a group: search, social, email, paid, news, payments. With none of the three, the order is "Direct".

Where you see UTM data in the admin

Place in the admin	What it shows	What you use it for
Analytics → Sales by Source / Medium	Revenue and orders by utm_source / utm_medium, with a drill-down to each utm_campaign and a daily chart	Which campaign brings in money; orders without UTM tags are not included here
Analytics → Sales by traffic source (referral)	Revenue by the site or ad the buyer came from, Direct included	All revenue by channel, including orders without UTM tags
Orders → order details	The "Order source" card: UTM source, medium, campaign and referrer	Where one specific order came from
Customers → profile → Orders	UTM Source, UTM Medium, UTM Campaign and Referer filters	How one customer keeps coming back; the filter looks for an exact match
Marketing → Segments	A condition on the order's utm_source, utm_medium or utm_campaign	A "bought through the influencer campaign" segment for your next email
Marketing → Marketing Suite	The Marketing sales tile: revenue from orders tied to campaigns by UTM and from recovered abandoned carts	The return on your emails, SMS and abandoned cart messages

Revenue in the Analytics reports excludes shipping and counts orders by the statuses selected in Settings → Analytics → Order statuses (by default paid, completed, pending, authorised and fulfilled). In "Sales by Source / Medium" a row opens to campaigns only if it has at least one utm_campaign. All reports are described in the guide to sales analytics in CloudCart and on the Analytics page.

Important: in the feature table on the pricing page, "UTM tracking" is marked in CC Pro and CC Master, while Google Analytics is in every plan. Before you plan your reporting around UTM data in the admin, check what your plan includes.

Which links CloudCart tags by itself

• Email campaigns. Every link in an email sent from CloudCart campaigns gets utm_source=cloudcart, utm_medium=email and a utm_campaign with the campaign title. In GA4 these visits land in the Email channel. The steps are in the step-by-step email campaign guide.
• Abandoned cart messages. The recovery link carries utm_campaign=abandoned_restore_link and a utm_source by channel, so recovered orders show up separately. How to set up the message is on the Abandoned carts page.
• Product feeds. The Google AdWords feed in the XML Feed app and the catalogue feed in the TikTok app have fields for utm_source, utm_medium and utm_campaign, which are added to every product link in the feed.

301 redirects do not carry utm_content and utm_term, so when you compare creatives, point the ad straight to the new address.

How to check attribution in GA4 and in your store

Check once a month: orders by channel in the store against GA4, and any rows outside your naming guide.

1. Traffic acquisition in GA4. Reports → Acquisition → Traffic acquisition, dimension Session default channel group. Look at the share of Unassigned and Direct. A large Unassigned share means a wrong medium.
2. Source / medium in GA4. Switch the dimension to Session source / medium and look for duplicates like facebook / paid_social and Facebook / Paid_Social. Fix the naming guide and the live links.
3. Attribution model. Under Admin → Data display → Attribution settings, check the model and the lookback window. Write them down, because a model change also rewrites historical reports.
4. Model comparison. Under Advertising → Attribution → Model comparison, compare Data-driven with Paid and organic last click.
5. Orders in CloudCart. Open Analytics → Sales by Source / Medium for the same period and compare campaign revenue with GA4.
6. One order by hand. Pick an order from the campaign and open its details. The source card should show the same UTM tags as the link in the ad.

The numbers in GA4 and in the store will never match exactly, for these reasons:

Reason	What happens	What you do
Declined cookies	When cookies are declined GA4 sees fewer visits; CloudCart still records every order	Compare trends and shares, not exact counts
Different model	CloudCart gives the order to the first visit in the session, GA4 data-driven splits it between touchpoints	Use last click in GA4 for reconciliation
Different revenue	CloudCart reports exclude shipping and follow the selected statuses	Compare order counts first, then amounts
UTM tags on an internal link	GA4 records a new source in the middle of the visit	Remove UTM tags from banners inside the store
Redirect that drops UTM tags	A link shortener or a third-party site strips the parameters	Test every short link before launch

The most common UTM and attribution mistakes

• Capital letters and synonyms. Facebook, facebook and fb are three rows in the report.
• A medium GA4 does not recognise. "newsletter" or "sms_campaign" send traffic to Unassigned, and "ads" with source facebook sends paid ads to Organic Social. Use the values from the channel table.
• Manual UTM tags on Google Ads. With auto-tagging on, the click carries a gclid and GA4 takes source, medium and campaign from it, so manual tags only add utm_content and utm_term. Let Google Ads tag by itself.
• Personal data in a link. An email address or customer name in utm_content goes to Google with every visit. Use segment or campaign names.
• Adding up the ad accounts. Meta and Google count the same purchase twice. Set the budget by the orders in your store.
• Deciding after one week. Meta reports a purchase on the day the ad was shown, so with a 7-day click window, past days keep filling in for several more days. Compare closed periods.

Questions about tracking in your store: write to support@cloudcart.com.

Frequently asked questions