UTMs Get Lost at Checkout. Here's Why

The sale your campaign didn't get credit for

You ran a paid campaign. Tagged the links properly. Someone clicked, browsed for six minutes, added to cart, paid. Then you open the report and that revenue is sitting under direct traffic, or under a referral from your own store.

The campaign worked. The record of it didn't survive checkout.

We see this constantly, and it's almost never somebody's mistake. It's structural. Checkout is usually the moment your visitor stops being on pages you control.

Query strings don't survive a change of domain

UTM parameters live in the URL. That's their entire existence. ?utm_source=meta&utm_medium=paid rides along only as long as the visitor keeps moving through links that carry it forward.

Checkout breaks that chain twice over.

The domain changes. A Shopify store serves its storefront from yourbrand.com and has historically handed checkout to a Shopify-controlled host. GA4 sees a new hostname, no campaign parameters on it, and a referrer pointing back at your own store. That's the self-referral pattern, and it's why a paid sale shows up as direct or as a referral from myshopify.com.

Then there's the redirect problem. Every hop between the ad click and the confirmation page is another chance for a query string to get quietly dropped, and nothing anywhere warns you when it happens. We wrote about the general shape of this in campaign URL tracking. The tag is one layer of three, and it's the flimsiest.

The Shopify deadline that makes this urgent

If your store papered over this with a script on the Thank You page, that patch has an expiry date. It's close.

Shopify's own help docs are blunt: "August 26, 2026 is the deadline for stores on a non-Plus Shopify subscription plan to upgrade their existing Thank you and Order status pages to the new version of those pages." Miss it and Shopify auto-upgrades the pages for you, which means custom tracking on them goes away.

Plus stores already lived through this. Their deadline was August 28, 2025, and the additional scripts section has been view-only ever since.

So the things that break: tracking pasted into additional scripts, checkout.liquid customisations, and apps that work through script tags, all on the Thank You and Order status pages. Web pixels and checkout blocks are the replacement. If your attribution currently depends on any of the first list, you have about a month.

One caveat, and I want to be precise about it because we've been burned treating a vendor blog as if it were platform policy. Shopify doesn't publish anything saying "checkout drops your UTM parameters." Their conversion summary docs confirm UTMs get read into order records and stay silent on loss. The deadline above is documented fact from Shopify. The parameter loss is field observation, reported by merchants across the domain switch for years. Different confidence levels, and you should hold them differently.

Stripe does the same thing, deliberately

Stripe's hosted Checkout is another domain, so the same break applies. What's useful is that Stripe documents the contract plainly: nothing carries your campaign data through to the success_url or the webhook unless you put it there yourself. The fields are client_reference_id and metadata.

That's not a gap. It's a design decision, and honestly the better one. It makes the handoff explicit instead of pretending a query string will survive a payment flow.

What actually holds up

• Capture on arrival. Read the UTMs on the first pageview and store them first-party, in a cookie or localStorage or your own session record. Reading them at checkout is too late. They're already gone by then.
• Pass them on purpose. Cart attributes in Shopify, metadata on the Stripe session, a hidden field on the order. Something you wrote deliberately, not something you hope survives.
• Kill the self-referral. Exclude your checkout host in the GA4 data stream settings. Worth knowing this one is community consensus rather than documented Google policy, but it does work.
• Keep a record the browser can't lose. A click logged at redirect time exists whether or not the destination page, the consent banner and the payment processor all cooperate.

That last one gets skipped most often, and it's the one that saves you. When the click is recorded at the redirect, you have a timestamped record of the campaign that fired before any of the fragile stuff happens. It won't tell you the order value on its own. It will tell you the campaign was real, which is exactly the fact that goes missing in the checkout handoff. That's the layer Attri's link tracking is built on.

If the symptom you're actually chasing is a direct-traffic number that keeps growing for no reason, checkout is one suspect among several. Why GA4 shows so much direct traffic walks the rest of the lineup, and fixing messy GA4 data covers the cleanup once you've found the culprit.

Put the calendar reminder in for August 26 either way. A checkout that silently stops reporting your campaigns is bad. A checkout that does it the same week Shopify auto-upgrades your pages, while you're trying to work out what changed, is genuinely painful.