Why your lead source data is wrong

Ask a new lead where they came from and you get a story. Look at the URL they landed on and you get a record. These two accounts of the same event disagree constantly, and the disagreement is not random noise - it is systematically biased in ways that flatter some channels and erase others.

Most teams have only one of the two accounts, and usually it is the story: a dropdown on the form labeled "How did you hear about us?". The record - the UTM parameters and ad click IDs that arrived with the visit - either was never captured or broke somewhere between the ad click and the spreadsheet. This essay is about both failures: why the story misleads, and where the record silently dies.

Self-reported attribution measures memory, not causation. People report the touchpoint that was most memorable, most recent, or easiest to type. "Google" on a form can mean a paid search ad, an organic result, a branded search after hearing about you on a podcast, or simply "the internet." A distinctive podcast episode gets named; the six retargeting impressions that preceded it do not, because nobody remembers display ads.

None of this makes the answers dishonest. It makes them a different instrument. Self-reported source is a measure of salience - which touchpoints people noticed and could recall under mild time pressure. That is genuinely useful information. It is just not a record of which click produced the visit, and treating it as one assigns budget by memorability.

Here is the counterargument, and it is a good one: captured attribution has blind spots that only humans can fill. A link pasted into a private Slack, a recommendation over dinner, a conference hallway conversation, a podcast mention - none of these carry query parameters. If you drop the "How did you hear about us?" field, dark social and word of mouth vanish from your data entirely, and those are often your highest-intent leads.

So the answer is not to pick a side. Keep the question. Capture the parameters too. Put them in adjacent columns of the same lead attribution ledger and read them together: the record tells you which click arrived, the story tells you what the person believes moved them. The interesting rows are the ones where they disagree.

Now for the ways the record dies. The first is redirects. A link shortener, an http to https upgrade, a www to bare-domain rewrite, a trailing-slash rule, a country or language redirect - any hop in that chain that was configured without care can drop the query string. The ad platform faithfully appended ?utm_source=google&gclid=..., and by the time the browser settles on a final URL, the parameters are gone.

This failure is invisible in the moment. The page loads, the visitor converts, and the row says nothing about its origin. If a suspicious share of your paid traffic shows up as direct or untagged, audit the redirect chain before blaming the ads: paste a tagged URL into a browser and watch what survives to the address bar.

The second break point is the multi-page journey. Attribution parameters arrive on the landing page, but the form usually lives somewhere else - /contact, /quote, a pricing page reached three clicks later. Any capture script that naively reads the current page URL at submit time finds nothing, because the parameters were left behind two navigations ago.

The fix is persistence: store the parameters in the browser on first touch and replay them when a form is finally submitted, whether that is thirty seconds or three days later. We wrote up the mechanics separately in our guide to multi-page form attribution; the short version is that first-touch capture plus localStorage persistence turns "the form page had no parameters" from a data hole into a non-event.

The third break point is the form stack itself. Plenty of form tools only forward the fields they were explicitly configured to know about. A hidden input holding utm_campaign gets silently discarded because it was never added to the field list. Some builders only serialize visible inputs. Some email-forwarding backends flatten everything into a message body where parameters go to die unparsed.

The cruel part is that the data made it all the way to the browser. The click carried its tags, the redirects behaved, the persistence worked - and the submission pipeline threw the context away in the last hundred milliseconds. When you evaluate a form backend, the question is not "can it receive a hidden field" but "does it deliver every field it receives, into a structure where each one keeps its name." That structure is a column, which is why we are partial to spreadsheets as the destination - see how it works.

The fourth break point deletes the whole row, not just its source. Aggressive spam filtering silently discards borderline submissions, and paid leads are disproportionately borderline: short messages, fast completion times, unusual geographies. When a filter drops a real lead, no one is notified. The ad platform records a conversion, the sheet records nothing, and the discrepancy gets waved off as tracking noise.

This is why we think spam handling for lead forms should quarantine rather than delete: suspicious submissions get held for one-click review instead of vanishing. A false positive should cost you ten seconds, not a customer and a corrupted dataset. The argument is laid out in quarantine vs CAPTCHA.

Put the biases together and you get a predictable distortion. Self-reported data over-credits memorable channels: podcasts, brand campaigns, communities. Broken capture under-credits everything that depends on parameters surviving: paid search, paid social, email. The net effect is a report that says your most measurable channels are underperforming and your most narrative channels are carrying the business.

Budgets follow reports. So money drifts toward what people remember and away from what actually converts, and nobody can prove the drift is wrong because the data that would prove it was never captured. The channels that suffer most are precisely the ones where spend is easiest to adjust - which means the error is not just present in your data, it is actively steering your spend.

With captured attribution flowing into a ledger you trust, three decisions change character. First, kill and scale decisions become defensible: you can pause a campaign because its rows never turn into qualified leads, not because it feels expensive. Second, you stop optimizing for leads per channel and start optimizing for qualified leads per channel, because the same sheet that holds the source columns holds the sales team's status column.

Third, and most consequentially, you can close the loop with the ad platforms. A captured gclid next to a "qualified" status is exactly what offline conversion uploads are made of, and feeding qualified outcomes back to the platform changes what its bidding optimizes for. None of that is possible when the source columns are empty.

The full prescription fits in six lines:

1. Tag every paid and owned URL with UTM parameters, and let the platforms append their click IDs.
2. Test the redirect chain so the tags survive to the landing page.
3. Persist parameters in the browser from first touch, so the form page does not need them in its own URL.
4. Deliver every field, named, into its own column - a spreadsheet row, not an email body.
5. Quarantine suspicious submissions instead of deleting them.
6. Keep the "How did you hear about us?" question, in its own column, next to the captured truth.

This is, not coincidentally, what SheetLink Forms does out of the box: our embed script captures utm_source, utm_medium, utm_campaign, utm_term, and utm_content plus gclid, wbraid, gbraid, fbclid, and msclkid, persists them across pages, and lands them in named columns of your sheet. You can watch a real form feed a public spreadsheet on the live demo, and the ad landing page use case walks through the full setup.

Should we remove the "How did you hear about us?" field?

Which parameters should every paid URL carry?

Do redirects always strip UTM parameters?

How long should attribution persist before a form submit?

Is a gclid or UTM value personal data under privacy law?

Why do so many of our rows have no source at all?

What is the difference between gclid and utm_source=google?

How does SheetLink Forms capture attribution without custom code?