For the last year I have asked every marketing team I talk to a thought experiment: if UTM parameters vanished tomorrow, how much of your pipeline attribution would you still have?
The honest answer for most teams is “almost none.” That is not a hypothetical anymore. AI browsers, agent traffic, walled-garden apps, and tightening privacy defaults are stripping UTMs at a rate that has gone from “annoyance” to “structural problem” in the last two years. Marketing teams who built their attribution stack assuming UTMs always survive are watching the chain break in production every day.
I am George, founder of Leadpipe. We run an identity graph behind 280M verified profiles, 5M websites monitored, and 60B intent signals refreshed every 24 hours. Identity-based attribution is the layer that survives the UTM problem because it does not depend on the click-time stamp. It depends on the persistent person.
This post is not a benchmark study. It is a framework: how attribution actually works without UTMs, what identity-based attribution catches, and the architecture you can run yourself.
Why UTMs are eroding
Three forces are eating UTM-based attribution.
| Force | Effect on UTMs |
|---|---|
| AI agents and LLM browsers | Often do not preserve query parameters when following links on the user’s behalf |
| Paste-share traffic | Anyone copying a link into Slack or email usually strips tracking params |
| Browser privacy defaults | Referrer policies tightening, cross-site cookies functionally dead |
If 20-40% of your real attribution is already flowing through “direct” in GA4 because UTMs got stripped, the GA4 report is structurally lying to you. We laid out the full thesis in Google Analytics is lying to you about pipeline. The point of this post is what you do about it.
The thesis
The UTM is a click-time stamp. Identity is the relationship. If you are optimizing your stack for the first, you are measuring the noise around the signal.
UTMs work when they survive end-to-end from ad-click to landing-page. They fail when anything in the chain strips them: a redirect, a copy-paste, a mobile SDK, a privacy policy. As the chain gets longer (multi-session journeys, multi-device buyers, multi-app referrers), the probability that the chain breaks at least once approaches certainty.
Identity-based attribution sidesteps the chain problem because it is not chain-based. It is anchored to the persistent person. If you can name the person, you can reconstruct the path, regardless of which session arrived with which parameter.
What “attribution without UTMs” actually means
It does not mean kill UTMs. UTMs are useful for paid-channel reporting and campaign-level performance. The teams that get this right are not deleting UTMs. They are stopping their attribution stack from depending only on UTMs.
The architecture has four layers:
| Layer | Source of truth for | What it does well | What it cannot do |
|---|---|---|---|
| UTMs / click-IDs | Channel-level paid reporting | Tag the click moment, when they survive | Survive copy-paste, browser policy, multi-session journeys |
| Session-based analytics (GA4 et al.) | Channel reporting on hygiene-clean sessions | Volume reporting, traffic shape | Stitch the same buyer across sessions, devices, and time |
| Visitor identification (deterministic) | Persistent person | Anchor the multi-session journey to one human | Help on visitors outside the identity graph |
| CRM | Pipeline outcomes | Tie the identified person to opportunities | Tell you what they did before the form fill |
Each layer answers a question the others cannot. The mistake is treating any single layer as “the attribution system.” The right model is layered: UTMs for what they are good at, identity for the multi-session backbone, CRM for the outcome.
What identity-based attribution catches
Five categories of attribution that UTM-based reporting either misses entirely or attributes wrong.
One: returning visitors whose original source is gone
A visitor arrives from organic search, then comes back 12 days later from “direct.” UTM-based attribution credits the eventual conversion to “direct.” Identity-based attribution credits it correctly to the original organic entry, because it is the same person across both sessions.
This is the single biggest correction. Most “direct” traffic in B2B is returning visitors whose first session was attributable but whose return sessions are not. Return visits matter more than sessions.
Two: dark social
Someone in your network shares a post about your pricing page on LinkedIn. A VP at a target account clicks through, visits the page, comes back four times over 10 days, books a demo. UTM-based reporting tags the first session as “direct” and the demo booking as “organic social” or “direct” again, depending on which session it credits.
Identity-based attribution shows the full sequence of the same person across four sessions, with the VP’s company matched on visit one. The “channel” was a LinkedIn post that was never going to carry a UTM. The pattern shows up only because identity persists.
Three: AI agent traffic
An AI agent (visible in the User-Agent and referrer pattern) returns your site for a buyer’s query. A user follows the link. UTMs almost never survive the agent hop. UTM-based reporting shows a “direct” visit. Identity-based attribution shows AI-mediated discovery, which is a channel most teams have not had a name for yet.
This category did not meaningfully exist three years ago. It is the fastest-growing slice of “direct” in our network now.
Four: paste-share
A customer drops a link to your site into a prospect’s Slack channel. Three people at the prospect’s account click through within 48 hours. Zero UTMs. UTM-based reporting has nothing to say. Identity-based attribution has the company, the three people, and their session patterns, which is enough context for an AE to reach out the right way.
Five: competitor and exclusion traffic
A competitor researches your pricing page across multiple sessions. UTMs say “organic.” Identity-based attribution flags it as a competitor (or matches it to a known suppression list) and excludes it from your pipeline reporting. UTMs cannot do that. The exclusion / suppression workflow is built on the identity layer.
A framework you can run
The architecture, in concrete steps. None of this requires replacing your existing analytics.
Step 1: Keep UTMs for paid channels
UTMs do their job on paid channels when the platform’s click-ID survives. Keep them for ad-spend reporting and campaign-level optimization. Do not depend on them for user-level attribution.
Step 2: Run identification as the identity backbone
Deploy a deterministic visitor identification pixel. We built Leadpipe for this; the website visitor tracking pillar covers the broader category. Every identified visitor is a person you can track across sessions, devices, and channels, regardless of what happened to the UTM.
For US B2B traffic, the deterministic match rate is 30-40%+ at the person level. That is enough volume to reconstruct the journey for the share of buyers who matter most.
Step 3: Add off-site intent
A meaningful chunk of the buyer journey happens off your site. Tools that read intent across the wider web (we built Orbit for this) surface buyers before their first site visit. The signal arrives before any UTM ever could, because the buyer has not arrived yet.
Step 4: Blend channel reporting with person reporting
Run two reports. UTM-based channel reporting for ad spend and campaign-level decisions. Identity-based person reporting for pipeline attribution. The two together are the actual picture. Either alone is misleading.
Step 5: Reattribute “direct” with a lookback
For every session GA4 calls “Direct / None,” check whether the same identified person has a prior session within 30 days from a known source. If yes, reattribute. If no, leave as truly direct. The full mechanism is in the UTM audit framework.
Step 6: Tag the AE workflow on the identity layer
The point of identity-based attribution is not just better reports. It is realtime. When an identified visitor hits your pricing page, the AE on the account gets a Slack alert with the page-context detail. UTMs cannot do that. The workflow is in Slack visitor alerts.
What good looks like in practice
A team running this architecture well has the following in place by end of quarter:
| Component | What good looks like |
|---|---|
| UTM hygiene | Quarterly audit, broken templates fixed |
| Identity layer | Deterministic pixel deployed, matching 30-40%+ of US B2B traffic |
| GA4 / channel reporting | Used for paid-channel reporting, demoted from “the attribution system” |
| Reattribution | ”Direct / None” reattributed via 30-day identity lookback |
| Person-level reporting | Pipeline-attributed to identified persons across the full multi-session journey |
| Realtime AE workflow | Identified visitors trigger contextual alerts to the right AE |
| Off-site intent | Orbit or equivalent surfaces in-market accounts before their first site visit |
The two reports (channel-level and person-level) live alongside each other. Neither is “the truth.” Together they are honest enough to make budget decisions on.
What this fixes about the report
Five concrete things change in your weekly attribution report when you layer identity on top of UTMs.
One. The “direct” bucket shrinks. Most of what was in it gets reallocated to the real upstream sources, mostly organic, dark social, and returning visitors.
Two. Organic search gets credited more honestly. Browser referrer policies systematically under-credit organic in UTM-only reporting. Identity-based reattribution recovers most of that loss.
Three. Dark social becomes a visible channel. It will not have a perfect attribution number, but it stops being invisible.
Four. First-touch credit moves earlier. The first-touch channel for most B2B buyers is invisible in last-click UTM reporting. Identity-based first-session-within-window attribution finds it.
Five. Competitor and noise traffic stops polluting your pipeline numbers. The identity layer flags it; UTM-only attribution treats it as real.
What this does not fix
Worth flagging clearly.
- Identity coverage is not 100%. Deterministic matching on US B2B traffic resolves a meaningful share, not all visitors. The reattribution applies only to the share you match. Visitors outside the identity graph still flow through UTM-based logic.
- International traffic resolves lower. EU/UK runs company-level by default with person-level requiring affirmative consent. The 30-40%+ baseline is US B2B; outside that, expect lower.
- The CRM is still the bottleneck for downstream reporting. Bad CRM data compounds attribution errors. See Salesforce is full of bad data for the broader hygiene issue.
- First-touch within a window is still a model. Identity-based attribution makes the model more honest, but every attribution model is a simplification.
What 2026 changes
The direction is one-way. UTM-only attribution gets worse every year as more of the internet stops carrying parameters. Identity-based attribution holds its ground because the person persists even when the parameter does not. The trend forces the architecture choice on every B2B marketing team within the next two years. The teams that build the identity-attribution backbone now will be running on signal while everyone else is still arguing about last-click vs multi-touch models inside GA4.
The four implications I would commit to.
One. UTMs are a signal, not a source of truth. Useful for channel-level reporting when they arrive intact. Not useful for user-level attribution, which is what your sales motion actually needs.
Two. “Direct” traffic is the lie. If Direct is your largest channel, you do not have a direct channel. You have an attribution-loss bucket. Start measuring it.
Three. Identity is the durable attribution layer. The person persists across sessions, channels, devices, and tracking gaps. If you can name the person, you can reconstruct the path. If you can only tag the click, you are at the mercy of the internet’s willingness to preserve your parameter.
Four. Content attribution gets clearer, not noisier. The more blog posts and comparison articles the person reads before converting, the clearer the picture becomes when identity is the spine. Content attribution with visitor data is a much more useful lens than last-click UTMs.
What you can ship in the next 30 days
A practical 30-day plan that delivers most of the value.
| Week | Action |
|---|---|
| Week 1 | Run a UTM hygiene audit. Fix the broken templates and redirects. |
| Week 1 | Deploy a deterministic visitor identification pixel. Verify the match rate on your traffic. |
| Week 2 | Build the realtime workflow: identified pricing-page visitors trigger Slack alerts to the AE. |
| Week 3 | Add the 30-day reattribution logic to your “Direct / None” bucket. |
| Week 4 | Run a parallel report: channel-level (GA4) alongside person-level (identity). Compare. |
By the end of the month, the team has both reports running, the AE workflow live, and a baseline for what the gap actually looks like. From there it is iteration, not architecture.
Architecture summary
The layered attribution stack:
UTMs / click-IDs → channel-level paid reporting
GA4 / session analytics → traffic shape, hygiene-clean channel reporting
Identity layer (Leadpipe) → multi-session, multi-device person backbone
CRM (Salesforce / HubSpot) → opportunity outcomes
Off-site intent (Orbit) → buyers researching before they arrive
Reports run on:
Channel report = UTMs + GA4
Person report = Identity + CRM
Watchlist = Off-site intent + IdentityEach layer feeds the layer above it. UTMs feed channel reports. Identity feeds person reports. CRM closes the loop on outcomes. Off-site intent gives you a weather forecast for what is coming.
Every plan ships with the same identity graph, 23 REST endpoints, webhooks, and a 27-tool MCP server. Start in 5 minutes →
