B2B Form Attribution Study: 85% Capture the UTM (2026)

“B2B attribution is broken” is one of the most repeated claims in marketing — and one of the least measured. So we measured it at the source: do public B2B demo forms actually carry the campaign data (the UTM and the Google click-ID) into the lead they submit? We submitted real test leads to 20 forms by hand and read the actual network request each one sent.

The answer surprised us, and it reverses the usual story. Most forms do capture the campaign data — and the automated scanners people use to check are undercounting it by roughly 3x.

The finding, in one sentence

Among 20 B2B demo forms we submitted real test leads to and inspected by hand, 17 (about 85%) carried the campaign data into the actual submitted lead. An automated scanner reading the same forms detected only 29%. The scanner was undercounting real capture by roughly 3x, because most forms capture the data at the instant of submission — exactly where a read-only scan cannot see.

Why this study exists

UTMs and click-IDs are how a B2B company knows which campaign produced a lead. If a demo form drops them, the lead lands in the CRM with no source, and the campaign that paid for it gets no credit. “Attribution is broken” is a popular claim — but almost nobody has measured, form by form, whether the data actually survives into the submitted lead. We set out to measure it. The trap we walked into first — and the reason this report is interesting — is that the obvious way to measure it is wrong.

How we measured it (and why the easy method lies)

We started with an automated audit of 150 public B2B demo, contact, and signup forms. A read-only script loaded each form carrying a test UTM and click-ID, then inspected the page’s form fields, cookies, and dataLayer. It produced a tidy number: 29% (44 of 150) capture the UTM into an actual form field.

We did not trust it, for a simple reason: a script reading the page can only see what is in the page. It cannot see what a form adds to the network request at the instant you hit submit. So we hand-validated a stratified sample of 23 forms the only way that settles the question — by submitting one real test lead to each and reading the actual submission request.

The protocol, applied identically to every form:

• One submission per form, from a single dedicated address on our own domain, then stop. No automation, no resubmission.
• Each form was reached through a unique tagged URL (utm_source=ivris-research … gclid=ivrisHAND-<n>), so any captured value is unambiguously ours.
• We read the actual submission POST body and searched it for our sentinel values.
• Capture counts only if the value is in the submission payload. Analytics pixels, request headers, the Referer, first-party cookies, and the page URL do not count — they are not the lead record.
• Where the real payload could not be observed (server-rendered, third-party iframe, or a blocked route), the form is recorded as unverifiable and excluded — never guessed.

Three of the 23 were unverifiable (AgencyAnalytics, Customer.io, Buildertrend), leaving 20 forms with a definitive answer.

What the hand pass found

Among those 20 forms, 17 captured the campaign data into the submitted lead and 3 did not — a capture rate of about 85%, versus the 29% the scanner reported on the full set.

The three genuine misses were Dreamdata (a Squarespace form that posted only its visible fields), HockeyStack (the UTM field names were present but the values were blank, and the tag was lost on a redirect), and Attio (a custom API that posted a clean, contact-only body). The interesting part is how the other 17 captured:

The headline: automated form audits undercount capture ~3x

Lining up the scanner’s prediction against the hand-read truth, form by form, on the 20 verifiable cases:

So the 29% an automated audit reports is a floor, not the truth. The real rate, read from the actual lead payloads, was roughly three times higher. The practical inversion worth remembering: a form scanner is reliable when it says “yes, captured” and unreliable when it says “no.” Use its positives; verify its negatives by hand.

Even attribution vendors aren’t special

We tagged every company with whether it sells attribution, analytics, or martech tooling — the “do they eat their own cooking” control. The result is undramatic in an interesting way:

The full dataset — all 23 forms

Every form we attempted, the platform behind it, what the automated scanner concluded, and what we found by reading the actual submission. Rows where the scanner said “none” or “cookie-only” but the form did capture are its blind spots.

The arrow (→) marks the nine forms where the automated scanner predicted “no capture” but the form did capture — its blind spots. The UTM survived the homepage→form journey on 20 of the 22 forms where that was observable (≈91%).

Two clean findings from the wider 150-form audit

The capture detector undercounts because capture happens off-page. But the scanner is perfectly reliable for things that are in the page — so these two figures from the full 150-form audit stand as measured:

• Bot protection ≈ 47%. Of 150 forms, 71 use a managed CAPTCHA (56 reCAPTCHA, 13 Cloudflare Turnstile, 2 honeypot); 79 use none. A floor, since silent honeypots are undercounted.
• “How did you hear about us” is rare — ≈15%. Just 23 of 150 forms ask, and only 12 make it required. And 31 of the 40 martech sellers in the sample (78%) don’t ask at all — the companies most equipped to value self-reported attribution mostly skip it.

Methodology and provenance

This page reports a descriptive finding on a small, stratified sample, not a market-wide census. Every figure is “among the forms we audited,” and we report counts beside percentages on purpose.

• Parent sample: 150 public B2B demo/contact/signup forms, automated read-only audit, collected June 2026.
• Hand-validation subsample: 23 forms, stratified across the scanner’s three verdict classes (form-field / cookie-only / none) and deliberately weighted toward suspected false negatives. Submitted and read by hand on 2026-06-17.
• Capture definition: a UTM or click-ID present in the actual submission POST body. Headers, cookies, referrers, analytics pixels, and page URLs explicitly excluded.
• Evidence: a payload screenshot was preserved for every row; per-vendor observation notes are published in the dataset.

A note that cuts the same way: we also tried to widen the sample with an automated client that records the full outgoing request body. On three more forms the scanner had scored “none” (Trigger.dev, Replit, Toggl), the lead submission happened server-side, with no campaign data in any client-side request — the sentinel surfaced only in third-party analytics pixels, which we do not count. That independently reinforces the core finding: on the forms a scanner calls “no capture,” capture (or its absence) is decided off the page, where neither an automated scan nor an automated submitter can see. The only instrument that settles it is a human reading the actual submission payload — which is what the 20-form pass above did.

Frequently Asked Questions

Research and analysis by Mahesh Sirvi, Ivris Tech. Methodology, dataset, and per-vendor evidence published in full for replication. Part of The State of B2B Attribution & Tracking Hygiene 2026.