Unfortunately, or not, GA makes it very easy to work around this. By default, it will do its UTM parsing serverside these days based on the page URL the webmaster sends to it.

So all I have to do as a webmaster is start using `?aaa_source=foo&aaa_medium=bob`

Then I do `ga(‘send’, ‘pageview’, location.pathname.replace(/aaa/g, ‘utm’)`

A more robust implementation would have to modify the web request to GA itself, assuming the goal is to destroy that data.

EDIT: Upon looking at the actual implementation (`chrome.webRequest.onBeforeRequest`), the points above should be addressable: the key is to strip out potentially URL-encoded utm values in the requets sent to GA [1], which may be either in the query string or the (beacon) POST payload shipped to google-analytics.com).

i.e. `google-analytics.com/collect?v=1&dp={url-encoded-path-with-utm-values}` should be purged as well.

[1]: https://developers.google.com/analytics/devguides/collection...