UTM Tracking Without Personal Data in URLs

Use UTM parameters to describe the campaign, never the person. Stick to a small naming convention for source, medium and campaign, use lowercase words and hyphens, and never put names, email addresses, phone numbers or customer IDs in any parameter. Automated checks can catch obvious mistakes, but they cannot prove a value is not identifying, so the convention itself must keep personal data out.

What UTM parameters are for

UTM parameters are tags added to a link so analytics can tell which campaign brought a visit. Google Analytics documents the standard ones in its guide to collecting campaign data with custom URLs: utm_source, utm_medium, utm_campaign, plus optional utm_term, utm_content and utm_id. They describe where the link was placed, not who clicked it.

A simple naming convention

Rules: lowercase, hyphens instead of spaces, no personal details, and a shared list everyone uses.

Illustrative URLs

Good:

https://example.com/offer?utm_source=instagram&utm_medium=paid-social&utm_campaign=spring-cleaning-2026&utm_content=photo-a

Bad (do not do this):

https://example.com/offer?utm_source=newsletter&utm_campaign=jane-smith&email=jane@example.com

The second link would send a person's name and email into analytics and could expose them in browser history, shared links and server logs.

Where personal data sneaks in

Google's guidance on avoiding sending PII to Analytics lists common leaks: URLs, page titles, campaign parameters and event parameters. Typical causes:

• Email tools that automatically append subscriber IDs or emails to links.
• Forms that submit with GET, putting field values into the URL.
• Thank-you pages that include the customer's name in the title.
• Staff creating one-off links named after a client.

Check your email tool's link settings, make sure forms submit data in the request body rather than the URL, and keep page titles generic.

Why automated checks are not enough

A script that blocks values containing "@" or long numbers will catch some mistakes, but it cannot know that utm_campaign=jane-smith is a person. Only the convention and the people using it can prevent that. Treat checks as a safety net, not proof.

Hypothetical example: a boutique clothing store

A fictional store's email platform was adding each subscriber's email address to every link. Visits from the newsletter were arriving in analytics with emails in the page URL. The owner turned off that setting, replaced links with the standard convention, and asked the platform's support how to remove the affected data using the analytics tool's data deletion options.

UTM checklist

• Shared naming list documented.
• No personal details in any parameter.
• Email tools not appending subscriber data to links.
• Forms not placing field values in URLs.
• Page titles do not include customer details.
• Links tested before a campaign launches.

Frequently asked questions

Can I use UTMs on internal links?

Generally no. Internal UTMs can overwrite the original campaign that brought the visitor. Use them on links from outside your site.

How do I track individual customers then?

In your CRM, which is designed to store customer records with access controls. Keep analytics aggregate. See measuring an inquiry separately from a sale.

Should I shorten UTM links?

Shortened links are fine for readability, as long as the underlying URL follows the convention.

Next step

Write your naming list today and audit your last few campaign links. For help setting up clean tracking, see our analytics service or the guide to capturing contact details without assuming consent.

Sources and further reading

• Google Analytics Help: Collect campaign data with custom URLs
• Google Analytics Help: Best practices to avoid sending PII

Editorial note: this planning guide was drafted with AI assistance for Rithm Digital and created on September 25, 2026. Examples are hypothetical. It is general marketing-operations guidance, not legal, medical, tax or financial advice. Prices refer only to Rithm's published Small Business Launch & Growth offer.