UTM tagging and consent: what to keep out of your parameters
Tracking parameters are not a neutral place to put information. What belongs in a UTM, what does not, and why the distinction matters more than it used to.
UTM parameters are visible in the URL, stored in analytics, and frequently shared in referrer headers. That makes them a poor place for anything you would not want logged or forwarded.
Keep out
- Identifiers that resolve to a person — internal user IDs, email addresses, hashes of either.
- Anything from a sensitive category, where the URL itself would reveal it to anyone who sees the link.
- Internal-only vocabulary that would be confusing or revealing if a customer saw the URL in their browser.
Keep in
Channel, campaign, source, and the minimum content identifier you need to attribute the click. If a parameter is not used in reporting, it is not carrying its risk.
Consent state belongs in your consent tooling, not in a UTM. A tag that tells you whether someone consented, sitting in a URL that is already being logged, is the wrong shape.
This is general guidance, not a privacy assessment. What you may collect depends on your consent basis and your jurisdiction.