Google Analytics expert here.<p>This is missing some fundamental ones: gclid and dclid. Those are the parameters that identify <i>a specific click</i> from <i>a specific user</i> on <i>a specific ad placement</i>. They are the keys that Google uses on the back-end to join Google Analytics data with Google Ads (formerly AdWords) and DV360 (formerly DoubleClick) data.<p>The utm_ parameters are tame. They are very coarse-grained, usually representing "which budget did this ad come from" rather than anything about a user. They're ugly, which is enough reason to strip them, but gclid is also ugly, and much more identifying.<p>This is a bit of a fringe opinion, but I actually consider tools that block utm_ but leave gclid to actually be a <i>decrease</i> in privacy. A lot of people misconfigure their Google Analytics so that _utm params break the gclid. Stripping utms allows that join to happen.