UTM Parameters and Cookies: How to Track Every Lead Back to Its Campaign

This guide is for Singapore business owners, marketers and developers who run Google Ads, social campaigns or email and want to know which of them actually produce enquiries, not just visits. It covers how UTM parameters and cookies work together, a ready-to-adapt script, what Safari and privacy rules change, and how to use the data once you have it.

It is written by Adssential Marketing, a Singapore digital growth agency. We set up tracking on the websites we build and on the Google Ads accounts we manage, because without it nobody can tell a good campaign from an expensive one.

What are UTM parameters, and why do they disappear?

UTM parameters are short tags added to the end of a link, such as ?utm_source=facebook&utm_medium=paid_social&utm_campaign=cny_promo. Google Analytics reads them and files the visit under that source, medium and campaign.

The catch is that the tags only sit in the address of the first page. As soon as the visitor clicks to your services page, then your contact page, the tags are gone from the URL. Analytics still remembers the session’s source, but your enquiry form does not, so the lead arrives in your inbox or CRM with no idea which campaign produced it. That gap is what cookie tracking fills.

The parameters Google Analytics 4 supports

Google’s GA4 guide to URL builders lists the parameters below and says to always include source, medium and campaign. Values are case-sensitive, so “Facebook” and “facebook” count as two different sources. If you are still setting up GA4 itself, start with our step-by-step guide to Google Analytics 4.

Google Ads does not need UTM tags for its own reporting if auto-tagging is on, because it uses its own click ID. You still want UTMs on every other channel, and many businesses add them to Google Ads too so the CRM sees the same campaign names as everything else.

How do cookies keep the campaign source until someone enquires?

A small script reads the UTM parameters on the landing page and saves them in a first-party cookie, which is a small file set by your own website. When the visitor reaches a form, a second piece of script copies those values into hidden form fields. The enquiry then arrives with the source, medium and campaign attached.

Two decisions matter before you write any code:

• First touch or last touch? First touch keeps the campaign that introduced the visitor; last touch keeps the one that brought them back to enquire. Storing both costs nothing and answers more questions.
• How long to keep it? Thirty days is a common choice for a lead-generation site. Longer sales cycles need a different approach, covered below, because browsers may cut the cookie short.

How do you set up UTM cookie tracking on your website?

You can add the script through Google Tag Manager (the easiest route on most sites) or directly in the theme. The example below stores first-touch and last-touch values and fills any hidden fields named after them. Treat it as a starting point and test it on your own site; your developer may need to adapt the form field names.

(function () {
  var keys = ['utm_source','utm_medium','utm_campaign','utm_term','utm_content'];
  var days = 30;
  function setCookie(name, value) {
    var d = new Date(); d.setTime(d.getTime() + days * 864e5);
    document.cookie = name + '=' + encodeURIComponent(value) +
      '; expires=' + d.toUTCString() + '; path=/; SameSite=Lax; Secure';
  }
  function getCookie(name) {
    var m = document.cookie.match('(?:^|; )' + name + '=([^;]*)');
    return m ? decodeURIComponent(m[1]) : '';
  }
  var params = new URLSearchParams(window.location.search);
  if (params.get('utm_source')) {
    keys.forEach(function (k) {
      var v = params.get(k) || '';
      if (!getCookie('ft_' + k)) setCookie('ft_' + k, v); // first touch
      setCookie('lt_' + k, v);                            // last touch
    });
  }
  document.addEventListener('DOMContentLoaded', function () {
    keys.forEach(function (k) {
      ['ft_', 'lt_'].forEach(function (p) {
        document.querySelectorAll('input[name="' + p + k + '"]').forEach(function (el) {
          el.value = getCookie(p + k);
        });
      });
    });
  });
})();

Step by step

1. Agree a naming convention (lowercase, underscores, one name per channel) and write it down where the whole team can see it.
2. Add hidden fields to every enquiry form: ft_utm_source, ft_utm_medium, ft_utm_campaign, and the same with lt_. Most WordPress form plugins support hidden fields.
3. Load the script through Google Tag Manager on all pages, after your cookie consent tool has recorded the visitor’s choice where consent is required.
4. Test it: open your site with a tagged link, browse three pages, submit the form, and check the values arrived in the email or CRM.
5. Map the fields into your CRM so every lead record carries its source.
6. Review monthly: look for “(not set)” values or new spellings creeping in.

Don’t forget WhatsApp and phone enquiries

In Singapore many buyers message on WhatsApp instead of filling in a form, and the cookie cannot follow them into the app. Track clicks on the WhatsApp and tap-to-call buttons as events, and consider adding a short campaign code to the pre-filled WhatsApp message (for example “Hi, I saw your CNY offer”) so your team can log the source when they reply.

What do Safari and privacy features change?

Quite a lot, and most guides to UTM cookies were written before it. Two changes matter.

What it means in practice: on iPhones and Macs using Safari, a script-set UTM cookie may last a week, not thirty days. For a café or a same-week service that hardly matters. For a B2B service where buyers come back after three weeks, the original source can be lost.

The best set-ups combine at least two of these. A simple “How did you hear about us?” drop-down still earns its place next to the most sophisticated script.

Do you need consent for UTM cookies under Singapore’s PDPA?

It depends on what the cookie holds and what you do with it. A cookie that only holds a campaign name is not, on its own, personal data. Once those values are attached to a form submission with a name, email or phone number, they become part of a personal data record, and the Personal Data Protection Act applies to how you collect, use and protect it.

• Say in your privacy notice that you record how visitors found you and why (to understand which marketing works).
• If you run a cookie consent tool, load analytics and advertising tags in line with the visitor’s choice.
• Do not put personal data into UTM values themselves (never an email address in a link).
• Keep lead records secure and only as long as you need them.

If you also advertise to visitors from the EU or other regions with stricter cookie laws, those rules apply to those visitors too. The old version of this guide pointed only to GDPR and California’s CCPA; for a Singapore business, the PDPA is the starting point.

Compliance note: this is general guidance, not legal advice. For data-heavy set-ups, check with your data protection officer or a lawyer.

How should you use the data once you have it?

Count enquiries and customers by source, not visits. The point of carrying UTM values into your CRM is to answer one question every month: which campaigns produced leads that became paying customers, and what did each cost?

1. Weekly: leads by source and campaign, with a quick check for broken or missing values.
2. Monthly: cost per lead and cost per customer by campaign, using ad spend from each platform.
3. Quarterly: move budget towards the campaigns that bring customers, and retire the ones that only bring traffic.

Feed the result back into your ad accounts. In Google Ads, importing the leads that became customers as offline conversions lets bidding learn from sales rather than form fills; our guide to tracking offline conversions explains how.

What mistakes break UTM and cookie tracking?

Frequently asked questions

What is the next step?

Start with a naming convention and hidden fields on your main enquiry form, test the script, and review leads by source after the first month. Add server-side cookies or offline conversion imports when your sales cycle is longer than a week or two.

If you want this set up properly, our Google Ads team builds conversion tracking into every account we manage, our web development team can add the script and form fields to your site, and our lead generation service ties search, ads and the website together around enquiries you can trace back to their source.