I'm trying to understand UTM parameters in relation to Analytics and Tag Manager governance. I understand what the various parameters (utm_source, utm_medium & utm_campaign) are for, and that you append these as querystring parameters to a link that you want to promote in order to track where a visitor from your site came from. However, I'm unsure as to how this is governed. For example, if someone was running a campaign with a link like this:


...do those source, medium and campaign values need to be set up in Analytics or Tag Manager in order to ensure that they're legitimate? What would stop someone spamming my data by using their own values?:


Many thanks.

1 Answer 1


Nothing stops someone from spamming your campaign data, except that there's not much reason for anyone to do so. They'd have to post a marked-up link somewhere where it would get enough clicks to matter, and there's not really any way for them to know whether you notice or care. In many years of GA use, we've never had it happen to us. Note also that sometimes bloggers will mark up links on their own, which means you'll get some campaign data that is not yours, but also isn't malicious.

So I would say unless you actually saw this happen in a way that had actual reporting consequences for your data, don't worry about it. However, for the sake of completeness, there is an option. I don't think I would call it "governance", though; it is a bit coarser than that.

In GTM it would be possible to "preprocess" the parameters, blanking them out if they did not match a particular list. However, you'd have to update it whenever there were new parameters, and so it carries the risk of losing data you want. You would do this with a Custom JavaScript variable (per parameter) that you would use to replace the value of the GA field in your settings variable (or your individual tags - this is an example of why using a settings variable is a huge work-saver).

In GA I don't believe there is an option. You would have to find a regular expression to edit URLs that don't match your approved list, but GA does not support regex lookarounds and I don't know a way to do it without them (but again, whenever you're approving instead of excluding, you risk losing data due to a tardy update to the list).

  • This is super useful, thank you! So really, if you had a multi-website implementation where there were different marketing teams working on each site, pushing data through the same Tag Manager container, the best you could do would be to instruct them of the conventions you'd expect them to use for their UTM params, to keep things as uniform across the sites as possible. They could still make their own idiosyncratic conventions if they wanted to disobey, but the only way to stop them would be using the Tag Manager custom JS to filter out anything not approved?
    – Briquette
    Oct 14, 2020 at 17:04
  • 1
    Ah, unruly marketers. That is correct. And of course you could use patterns in your filter to keep things uniform without having to have everything written out - our email team always uses the send date in their params, and it would not be sustainable to hard-code that! I would still proceed with caution, though, since there's no analogue to an unfiltered View when you make the edits on the GTM side.
    – Reve
    Oct 14, 2020 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.