UTM parameters for a QR code: measure print campaigns in GA4

Why print is blind without UTM parameters

A visitor who arrives from a flyer looks, to Google Analytics, exactly like a visitor who typed your address by hand: direct traffic, source unknown. Print has no referrer. That is why a campaign with 20,000 flyers and 300 posters can produce a visible bump in sessions and still leave you unable to say which of the two did it. This guide covers UTM parameters, QR code placement and the short link that ties them together, so the bump gets a name.

UTM parameters are small labels added to the end of a URL. GA4 reads them on arrival and files the session under the source, medium and campaign you specified. Put them on the destination of a QR code and the flyer stops being invisible.

What utm_source, utm_medium, utm_campaign and utm_content do

Google's own documentation, URL builders: Collect campaign data with custom URLs, checked 16 September 2026, defines the parameters and says which are required. utm_source is the referrer, with Google's own examples being google, newsletter4 and billboard. utm_medium is the marketing medium, for example cpc, banner or email. utm_campaign identifies the product, slogan or promotion, for example spring_sale. utm_content is used to differentiate creatives, such as two links in the same email. utm_term is for paid keywords and utm_id for a campaign ID; neither is needed for print.

Google states that you should always use utm_source, utm_medium and utm_campaign together. A URL with only one of them will still load, but GA4 will not file the session the way you expect. Treat those three as mandatory and utm_content as the fourth that makes print measurable at the level of a single placement.

A naming convention for print

The value of UTM tagging depends entirely on consistency. If one designer writes Flyer, another writes flyers and a third writes flyer-A5, GA4 reports three sources and you spend an afternoon merging rows in a spreadsheet. Agree on a convention once and write it down where every campaign brief can see it.

A convention that works for most print teams: utm_source names the physical carrier in lowercase singular, so flyer, poster, mailing, packaging, receipt or sign. utm_medium is always qr, because the medium is the mechanism the visitor used, and keeping it constant lets you filter all print traffic with one click. utm_campaign is the campaign name plus the period, such as autumn-2026 or store-opening-utrecht. utm_content describes the specific placement or creative: a5-front, a5-back, window-left, shelf-talker-aisle3. Use hyphens rather than spaces, never capitals, and never a customer number or anything that identifies a person.

A tagged destination then looks like this: https://www.example.com/autumn?utm_source=flyer&utm_medium=qr&utm_campaign=autumn-2026&utm_content=a5-front. Keep a register, one row per placement, with the code name, the four values and the print date. When the campaign ends, the register is your map from GA4 rows back to physical objects.

UTM parameters, QR code, short link: what goes where

Here is the mistake that costs the most: encoding that long tagged URL directly into the printed QR code. Three things go wrong. First, the code gets dense. According to Denso Wave's page on QR code versions, more data means more modules and a larger symbol, so a 95-character URL prints as a far finer pattern than a 20-character one at the same physical size, and fine patterns fail on glossy paper, in low light and at a distance. Second, a typo in the tag is a reprint. Third, you can never change the tag or the destination once the flyer is out.

The fix is to put the tagged URL behind a dynamic QR code. The printed code contains only a short redirect address on qreu.eu; the destination, with all four UTM parameters, lives on the server and can be edited at any time. The code prints small and clean, and if the landing page moves or the campaign name changes, you update the destination and the flyers keep working. EUQR's short links include a built-in UTM builder, so you fill in source, medium, campaign and content in four fields rather than assembling the query string by hand and risking an ampersand in the wrong place.

One code per placement, one UTM set per placement

The naming convention only pays off when each placement has its own code. A restaurant chain printing a spring menu insert for 12 restaurants, plus a window poster and a table card in each, needs 36 codes, not one. Each code carries the same utm_source per carrier type, the same utm_medium and utm_campaign, and a utm_content that names the restaurant and the placement: rotterdam-insert, rotterdam-window, rotterdam-table.

That looks like more work than it is. The 36 destinations differ only in utm_content, and every one of them is a dynamic code you can re-point next season without reprinting. On EUQR, Starter covers 10 dynamic codes and 50 short links for €0.99 per month, Pro covers 50 codes and 250 short links for €9 per month, and every plan counts unlimited scans; the full table is on the pricing page.

Reading the results in GA4

Google's documentation names the report: session source, session medium, session source/medium and session campaign appear under Acquisition, in the Traffic acquisition report. Filter session medium to qr and you have every print visit in one view. Add session campaign as a secondary dimension to split by campaign, or open an exploration with session manual ad content, which is where utm_content lands, to compare placements. From there, the usual GA4 metrics apply: engaged sessions, conversions, revenue if you have e-commerce tracking.

Two cautions. GA4 attributes sessions with its own models and time windows, so numbers can shift for a few days after the campaign. And GA4 only sees visitors whose browser was allowed to run the tag, which brings us to consent.

Consent: what the UTM does and what GA4 does

A UTM parameter is plain text in a URL. It sets no cookie, stores nothing on the phone and identifies nobody; it is a label on the visit, not on the visitor. GA4 is different. Google's page on cookie usage on websites, checked 16 September 2026, lists the _ga cookie, used to distinguish users, and the _ga_ container cookie, used to persist session state, both with a default expiration of two years.

Storing and reading identifiers like that on a device is exactly what consent rules in most EU countries attach conditions to, which is why your landing page shows a banner and why a share of visitors never reaches GA4. This article does not judge the lawfulness of GA4 in any specific country; that is a question for your privacy officer.

The practical consequence for print is a two-layer measurement. The scan count from EUQR analytics is the baseline: every scan of every code is counted, per placement, per country, device, browser and language, without a cookie and without raw IP addresses, so it needs no consent and misses nobody. GA4 is the deeper layer: for the visitors who accept, it adds pages, engagement and conversions. Expect GA4 to report fewer sessions than EUQR reports scans, and treat the ratio between the two as a useful number in its own right, because it tells you what share of your print audience consents.

A checklist before the files go to the printer

Agree the naming convention and write it in the brief. Create one dynamic code per placement and fill in the four UTM fields on each short link. Open the tagged destination on a phone to confirm the landing page loads over https and that GA4 shows the visit under medium qr in the real-time report. Record every code in the register. Print a test sheet at real size and scan it with two different phones. Only then send the files. If the campaign changes afterwards, edit the destination in EUQR; the printed codes will not notice.