Klaviyo UTM Tracking for Ecommerce and D2C

Klaviyo does not tag your links for you. UTM tracking is off until you turn it on, and until then every click arrives carrying _kx, an encrypted recipient identifier that your analytics cannot read.

That is how a brand runs Klaviyo for years while GA4 files most of its email revenue under direct.

Turn UTM tracking on at the account level, override it per message where it earns its keep, and stop expecting Klaviyo’s revenue number to match anyone else’s. It measures something different on purpose.

TL;DR

• Klaviyo appends _kx to tracked links by default. UTM parameters are opt-in, set under account settings.
• Set defaults at the account level, override per message. Those are the two levels Klaviyo documents.
• SMS uses the same UTM settings as email, as long as automatic link shortening stays on.
• Klaviyo’s attribution is profile-based and multi-channel, not a UTM or cookie match. Default windows: 5 days for email and SMS clicks, 5 days for email opens, 1 day for SMS opens, 12 hours for SMS deliveries.
• GA4 has default channels for both Email and SMS. utm_medium=email and utm_medium=sms are all you need, with no custom channel group.
• Link Tracking Protection strips neither _kx nor UTM parameters, so blaming it for Klaviyo attribution gaps is almost always wrong.

What Klaviyo Puts on Your Links

Klaviyo rewrites tracked links through its own redirect, records the click against the recipient’s profile, and forwards to your destination with _kx appended. The value is an encrypted recipient identifier. It is not a UTM parameter, and GA4 has no idea what it means.

UTM parameters arrive only if you switch them on. Without them a link looks like this:

https://shop.example.com/products/foo?_kx=encryptedblob

GA4 reads that as direct or referral traffic. With UTM tracking on:

?utm_source=klaviyo&utm_medium=email&utm_campaign=welcome_flow&_kx=encryptedblob

Now GA4 reads klaviyo / email / welcome_flow.

Klaviyo’s own dashboards are unaffected either way, because Klaviyo never attributed on UTMs. That gap is what brands discover when finance asks why Klaviyo claims a much larger share of revenue than GA4 does. Both numbers can be correct at once, and the reconciliation section below explains why.

Set Defaults Once, Override Per Message

Klaviyo documents two levels of UTM configuration: account defaults, and per-message overrides in a flow or campaign.

Set the account defaults to the values that never change:

Parameter	Value
utm_source	klaviyo
utm_medium	email
utm_campaign	dynamic, the flow or campaign name
utm_content	dynamic, the message name
utm_term	leave blank

Then override where the default is wrong. A Black Friday blast deserves a static utm_campaign=bf2026_main so it stays separable from flow traffic. A/B variants deserve their own utm_content, because if both variants inherit the same value the split never reaches your reports.

The failure mode is inheritance nobody thought about. Someone sets utm_campaign=newsletter at the account level, and six months of welcome-flow clicks arrive tagged newsletter. Keep account-level campaign values dynamic or blank, and be specific further down.

Klaviyo enforces nothing about the values themselves. They are free text, so Email, email and EMAIL can all coexist across brands and operators. Terminus, the marketing taxonomy governance platform, is where the controlled vocabulary lives, so the values you paste into Klaviyo match the ones every other channel uses.

SMS Uses the Same Settings

SMS is not a separate UTM system. It follows the same account settings, with one condition: automatic link shortening has to stay on, because the shortener is what applies the parameters at redirect.

Set utm_medium=sms for SMS sends. GA4 has a default SMS channel that matches on source or medium equal to sms, so that value alone files the traffic correctly with no custom channel group.

Three things worth knowing about SMS links:

Shortening is not cosmetic, it is economics. A GSM-7 segment is 160 characters and carriers bill per segment. A long product URL with five UTM parameters can push one message into three segments. Klaviyo’s short links keep the visible URL to roughly 20 to 30 characters.

A single emoji drops the segment to 70 characters, because the message switches to UCS-2 encoding. An emoji plus a long link is the fastest way to multiply your send cost.

A branded short domain unfurls properly. Configure branded short links in your domain settings. Klaviyo’s shared default short domain works, but your own domain previews better in iMessage and avoids the filters some carriers apply to unknown shorteners.

Klaviyo’s Number Measures Something Else

Klaviyo attribution is profile-based. It uses the integration data flowing between Klaviyo and your store, works across devices, and does not depend on a pixel, a cookie or a UTM parameter surviving the journey.

It is also not last-click. Klaviyo describes a cooperative, multi-channel model, where each Klaviyo channel carries its own configurable window.

New accounts default to:

Signal	Window
Email clicks	5 days
Email opens	5 days
SMS clicks	5 days
SMS opens	1 day
SMS deliveries	12 hours

That last row explains more disagreements than anything else on this page. A delivered SMS that nobody clicked can still take credit for an order placed within 12 hours, which no other tool in your stack would ever do.

Where the number drifts from expectations:

Your consideration window is longer than the attribution window. A brand with a three-day median from click to purchase is well served by five days. A furniture brand with a two-week consideration cycle is not, and those orders show up unattributed.

Several messages share credit. A Monday email and a Wednesday SMS both touching a Thursday order produce a different answer than any single-touch model.

Opens count. Open-based attribution is on by default for email, and Apple’s Mail Privacy Protection pre-fetches images for Apple Mail recipients, which inflates the open signal for that cohort. Decide deliberately whether open-based credit belongs in your reporting.

Checkout happens somewhere Klaviyo cannot see. Third-party or embedded checkouts can break the association between the visit and the order.

The honest framing: Klaviyo reports the value of orders from profiles that engaged within the window, across several channels. GA4 reports sessions it could attribute. Those are different questions, and expecting them to agree is the actual error.

Pair It With GA4’s Channels

GA4’s Email channel matches when the source or the medium equals email, e-mail, e_mail or e mail. Channel definitions are not case sensitive, so Email lands in the Email channel exactly as email does.

What casing does break is everything else. Email and email remain two separate rows in your source and medium reports and two separate values in any warehouse join, which is the real argument for standardising on lowercase.

A value like email-newsletter does not match, because the rule wants the value itself rather than a string containing it. Use email, put the newsletter identity in the campaign, and the channel takes care of itself.

For SMS, utm_medium=sms matches GA4’s SMS channel. No custom group required.

Sessions, and what does not create one

GA4 does not start a new session when the campaign changes mid-visit. That was Universal Analytics behaviour and it has not applied for years, so a recipient clicking two links in one email does not automatically produce two attributed sessions the way older guides claim.

The Klaviyo redirect creates nothing of its own either. It happens before your page loads, so GA4 only ever sees the final URL.

Three numbers, documented

• Klaviyo attributed revenue: profile-based, multi-channel, inside the windows above.
• GA4 email revenue: sessions tagged utm_medium=email, attributed by last non-direct click in acquisition reports.
• Shopify order UTMs: whatever the landing session carried at checkout.

Illustratively, a brand seeing 8 percent of revenue from email in GA4 and 22 percent in Klaviyo is not looking at a bug. It is looking at delivery-based credit, a five-day window and cross-device matching that GA4 cannot do.

Link Tracking Protection Is Not Your Problem Here

Apple’s Link Tracking Protection strips known click identifiers in Mail, Messages and Safari Private Browsing by default. Apple publishes no list of what it strips, so treat any claim that Apple’s documentation is authoritative as wrong, and treat the community lists as the best available evidence.

Neither _kx nor any utm_* parameter appears on those lists. Klaviyo’s click pipeline is unaffected.

Mail Privacy Protection is the feature that does touch Klaviyo, and it affects opens rather than clicks, by pre-fetching images for Apple Mail recipients. Given open-based attribution is on by default, that inflation flows into Klaviyo’s revenue number too.

For the full picture, see what link tracking protection strips.

Capture the First Touch Yourself

Even perfect tagging loses the customer who clicks, gets distracted, and returns three days later through search. Klaviyo and GA4 both credit the second visit.

The fix is your own capture:

1. On page load, inspect the URL at your edge or server.
2. When a fresh utm_* or _kx value appears, write it to a first-party cookie with a timestamp.
3. On later visits with no fresh parameters, read the cookie and pass the values into your analytics events and into the order at checkout.
4. Treat that stored value as the answer to “what originally brought this customer here.”

On Shopify, cart attributes travel through the Cart and Storefront APIs, and order metafields through the Admin API or Flow. Klaviyo’s own script persists _kx for its purposes but does not store your UTMs.

One caveat on lifetimes. Klaviyo’s __kla_id cookie is documented as long-lived, but Safari caps cookies written by JavaScript at 7 days, and at 24 hours in some tracking-parameter contexts. On an iOS-heavy D2C audience, that cap decides your real attribution window, not the number in the documentation.

Edge Cases That Surprise People

Profile merges. Klaviyo identifies people by email and phone, and merges profiles when it learns both. Merges move historical clicks and orders between profiles, so an order can gain or lose attribution retroactively. Run a merge audit before any historical reconciliation.

SMS double opt-in. The confirmation message is not marketing engagement, but its clicks look like it. Give it a distinct utm_campaign so you can filter it out.

Abandoned cart flows. The recipient was already on your site, so first touch says paid search, GA4 says the Klaviyo email, and Klaviyo says the same. All three are right, and none of them should be added together. Tag these flows distinctly enough to subtract them from incremental calculations, because the email did not bring the visitor to the site.

FAQ

What is the _kx parameter?

Klaviyo’s encrypted recipient identifier, appended to tracked links so Klaviyo can attach the visit and any resulting order to the right profile. It is not a UTM parameter and GA4 ignores it.

Does Klaviyo add UTM parameters automatically?

No. UTM tracking stays off until you turn it on in account settings. Once on, defaults apply to email and SMS, and individual flows and campaigns can override them.

Why does Klaviyo report more revenue than GA4?

Because it measures a different thing. Klaviyo credits orders from profiles that engaged within its windows across several channels, including SMS deliveries nobody clicked, and it matches across devices. GA4 credits sessions it could attribute, by last non-direct click. The gap is by design.

What are Klaviyo’s default attribution windows?

For new accounts: 5 days for email clicks, 5 days for email opens, 5 days for SMS clicks, 1 day for SMS opens and 12 hours for SMS deliveries. Check your own account, since older accounts may differ.

Is Klaviyo attribution last-click?

No. Klaviyo describes a cooperative, multi-channel model in which each channel has its own window, so more than one message can contribute.

How should I tag Klaviyo SMS for GA4?

utm_source=klaviyo and utm_medium=sms. GA4 has a default SMS channel that matches on source or medium equal to sms, so nothing custom is needed.

Does casing break my channel reports?

Not the channel. GA4’s channel definitions are not case sensitive, so Email still lands in Email. Casing splits your source and medium reports instead, and every join you run on those values.

Does Link Tracking Protection break Klaviyo attribution?

No. Neither _kx nor utm_* parameters appear on the community strip lists. Mail Privacy Protection is the feature that touches Klaviyo, and it affects opens rather than clicks.

Why doesn’t my Shopify order UTM match Klaviyo?

Shopify captures whatever the checkout session landed with. If the customer clicked your email, left, and returned through search, Shopify records the search visit while Klaviyo still credits the earlier engagement. Persisting the first touch yourself is the only way to reconcile them.

Should I use a custom tracking domain?

For most brands, yes. It improves deliverability, makes link previews recognisable, and unfurls properly in iMessage. Setup is a DNS record and a certificate Klaviyo provisions.