There's a ton of information on the web about how UTM parameters can be used to aid marketing efforts, but I'm looking for a technical explanation of how they work in the first place.

For example, if someone from web page A clicks on a link (with UTM parameters enabled) and moves to web page B, what exactly happens in the background (at the level of the server) that enables the click or conversion to be tracked?

3 Answers 3


I'll approach this from a Google Analytics POV seeing at that is my main experience...

When a user clicks on a link that contains a UTM parameter, it sends that data to the analytics engine (GA4). Depending on the parameters used, it will know more information about that particular session. Typically there is:

  • utm_campaign which assoicates the traffic to a marketing effort,
  • utm_source which communicates the source of the traffic (ex: facebook, X, ect) and
  • utm_medium which is what they interacted with (ex: cpc, banner, images)

GA4 will collect this data and store it in the proper variables (Campaign, Source, Medium, and Source/Medium). Going forward in their session, their activity can now be tracked back to the campaign. This includes any and all pages they have viewed, actions / events they have completed, and any conversions they might have done that you are looking at. This is how you are able to attribute conversions back to your specific campaign.

This UTM / Analytics relationship is only used to its fullest if you have setup the event tracking on the analytics side of things. This would typically be done via your tag management system or in partnership with developers pushing events manually to your analytics platform.

  • So even if they move from Page B to Page C, their actions and/or conversion can be tracked? (Assuming pages B and C belong to the same domain).
    – Joebevo
    Nov 27, 2023 at 15:25
  • Yes. Their session will be captured under their campaign ID. So you should be able to create audiences based on that to see where people are going and what they are doing as it relates to that session. Nov 27, 2023 at 16:31
  • I think you need to clarify what "it" is. The link doesn't do anything itself.
    – OrangeDog
    Nov 27, 2023 at 23:14
  • @OrangeDog It is the server Nov 27, 2023 at 23:39
  • Which server? There are at least three involved.
    – OrangeDog
    Nov 28, 2023 at 9:14

When the user follows a link with utm_* parameters, the following will happen:

  • The browser will send the URL to the server and retrieve the page

    • In most cases, the server will actually ignore those utm_* parameters, but you can set up your server to process them however you want
  • The page will load a script (the Google Analytics script) which will look at the current page URL, and find those utm_* parameters

    • That script will store them in persistent storage (cookies, but there may be alternate means nowadays, I haven't followed the latest on that). It also stores identifiers that allow the user/session to be tracked.

    • It will also send those parameters in calls to Google Analytics servers, so when the visit to that page is recorded, along with details of the date, time, page visited, etc, it will also include those parameters.

  • When the user moves to a different page (of the same site), even if there are no utm_* parameters in the URL of the new page:

    • The Google Analytics script on that new page will not find utm_* parameters in the URL, but will find them through cookies, along with session/user identifiers.

    • So calls to Google Analytics servers (to track the page visit, or to track events such as conversions) from that page will also have the information about the original utm_* parameters.

All in all, you only need the utm_* parameters on the initial link (from the ad which you are trying to measure the performance of to your landing page), and then it will follow on subsequent pages via cookies (like items in your shopping cart or your login session follow you from page to page).

Note however that if you switch to a different domain, cookies may not follow. In those cases you need special handling for the tracking to cross to the new domain (exactly how you do this depends on whether the two domains are subdomains of the same "top" domain, like www.example.org and shop.example.org or if they are completely separate, www.example.org and www.example.com).

Of course I mentioned only Google Analytics to simplify, but any other analytics solution would work similarly (though some of their own parameters instead of the utm_*).


Technically, they are key-value pairs.

Consider https://example.com?param1=value1&param2=value2

param1 and param2 are keys, and value1 and value2 are their corresponding values.

An ampersand (&) is used to separate multiple key-value pairs.

When a web server receives a URL with query parameters, they are parsed and used to modify or adjust its response. They're effective for querying databases, adjusting the content of a web page, tracking user behavior, and passing state information.

An example of passing state information is on Amazon when you click around products and make selections you'll notice the query parameters in your URL bar changing.

A_Patterson's answer well articulates how they're stored and used in Google Analytics.

  • 1
    "query parameters are notoriously used for SQL injection and cross-site scripting" - uh, any input to the server is. There is nothing special about treating input from parsed query parameters. And no, you should not sanitise the input, you should escape the output.
    – Bergi
    Nov 28, 2023 at 13:13
  • 2
    Thanks, I'm not a security expert and I appreciate your correction. I thought sanitizing any input was important. Feel free to edit that portion of the answer with correct information or I'll just remove that part later. Next time, hold the sass. Nov 28, 2023 at 15:06
  • @MikeCiffone "sanitizing" any input is the wrong approach. See e.g. my answer on sec.SE or this answer on SO.
    – marcelm
    Nov 28, 2023 at 22:09
  • @marcelm I get it now. Nov 28, 2023 at 23:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.