When should you use Tracking parameters intact?
email-tracking-integrity · functional · recommended
When should you use this check?
Run this on any campaign whose performance you will be asked to account for. Two things hide in a link's query string: your attribution, and your subscribers. A parameter that shipped unresolved or was dropped through a redirect means the campaign has no attribution when someone asks what it earned — and that question is always asked after the send, when nothing can be changed. It runs source-only with no network by default, so it is cheap to include everywhere.
When should you not?
Skip it on mail that carries no tracking by design — plain transactional notices, internal messages. Note it is a judgement check rather than an inventory: if you only want to see what every link actually carries, without any verdict, the UTM inventory check is the instrument for that. Be aware too that unsubscribe and preference links are exempt from this check entirely, because they are per-recipient functional URLs and a raw address in one is a defect of the unsubscribe mechanism, owned by the opt-out check instead.
What does it inspect?
Tracking on email links must be intact: no unresolved merge tags, empty UTM values, typo'd utm_ keys, duplicate parameters, ad-platform click-ids, or raw email addresses in query strings. When tracked domains are configured, marketing links must carry the required parameters (UTM or custom names), match the required link pattern, and keep their parameters through redirect chains; a required tracking pixel can also be enforced. See docs/EMAIL-TRACKING-INTEGRITY.md.
What does a failure mean?
A failure falls into two very different classes. Attribution findings mean a parameter is missing, unresolved or lost through a redirect, and the cost is measurement — traffic arrives unattributed and the campaign cannot be defended. Privacy findings are more serious and are name-agnostic: an email address, a merge token or a click id written into any query parameter travels into browser history, server logs and the next site's analytics, and no send can be recalled once it has gone. The corpus's most common personal-data hit is not in a `utm_` parameter at all.
What are the Standard defaults — and why?
Nine parameters carry the check, and almost all are empty by default so it runs zero-config. `trackedLinkDomains` scopes the strictness layer and is the only trigger for fetching — empty means source-only hygiene with no clicks registered. `requiredTrackingParams` is empty so name-level enforcement is opt-in, and fully custom-nameable, because the UTM trio is Google's "always use" default rather than a constraint. `requiredUtmMedium`, `requiredLinkPattern` and `requiredTrackingPixelPattern` add optional shape rules. `enforceGa4Channels` defaults to `false` deliberately: UTM predates Google — the parameters are Urchin's — and GA4's channel groupings are one vendor's reading, so `utm_medium=newsletter` is correct on Matomo or Plausible and failing it would be our error. `allowedCustomUtmParams`, `allowedUtmSources` and `allowedUtmMediums` are the taxonomy hooks, empty until you declare your scheme.
How does an agent call it?
{
"type": "email",
"validations": [
"email-tracking-integrity"
]
}
Who governs the Standard?
Schemafirst.org publishes community-governed standards for digital QA. ArbiterQA is a sponsor and commercial licensee of those standards; citation does not mean Schemafirst operates ArbiterQA.
Author ArbiterQA · Reviewed by ArbiterQA · 2026-08-14