The text after a question mark in a URL — like ?utm_source=newsletter&utm_medium=email — is called the query string, and it is very often used for tracking: recording where a click came from, which campaign or post it was part of, or which specific ad was clicked. This is a normal, widely used part of how websites and advertisers measure traffic, distinct from the security concerns covered elsewhere in this section, though it is worth understanding what these parameters do and do not reveal about you.
What a tracking parameter actually is
Referring back to How to Read a URL: Every Part Explained in Plain English, the query string is the part of a URL after the question mark, made of key-and-value pairs separated by ampersands. A parameter like utm_source=newsletter tells the receiving site “this visit came from a newsletter,” which the site owner can then use in their analytics to understand which channels drive traffic.
Common tracking parameter types
| Parameter pattern | What it typically indicates |
|---|---|
utm_source, utm_medium, utm_campaign |
Google Analytics-style campaign tracking, showing where a visit originated |
fbclid |
A click identifier added when a link is clicked from Facebook |
gclid |
A click identifier associated with Google Ads |
ref or referrer |
A general-purpose marker for where the click came from |
| Affiliate or partner IDs | Used to credit a referral for commission purposes |
Are tracking parameters dangerous?
On their own, no — a tracking parameter attached to a link from a legitimate site is a normal analytics mechanism, not a security threat by itself. That said, two things are worth keeping in mind: first, these parameters can reveal which specific email, post, or ad you clicked from, which is a privacy consideration even without being a security one; second, and more relevant to link safety, scammers sometimes add convincing-looking tracking parameters to a malicious link specifically to make it look more like a legitimate marketing link at a glance. The parameters themselves do not make a link safe or unsafe — the domain does, per How to Read a URL: Every Part Explained in Plain English.
Step-by-step: reading a link with tracking parameters
- Ignore the query string at first and identify the actual domain using the method in How to Read a URL: Every Part Explained in Plain English.
- Evaluate the domain on its own safety merits — a legitimate domain with ordinary tracking parameters attached is not made unsafe by their presence. There are narrower exceptions worth knowing about: a parameter named something like
redirect,next, orreturn_urlcan, on some sites, control where you end up after an action completes, which is a different mechanism from ordinary analytics tracking and worth reading carefully rather than assuming every parameter is purely cosmetic. - If you want to remove the tracking parameters before sharing a link with someone else, you can generally delete everything from the question mark onward, as long as the site does not require that data to load the intended page (most content pages do not).
A worked example
https://example.com/article/how-to-budget?utm_source=facebook&utm_medium=social&fbclid=abc123
The real domain is example.com, and the page is /article/how-to-budget. Everything after the question mark just tells example.com‘s analytics that this visit arrived via a Facebook share. You could remove everything from the question mark onward and, on most sites, still reach the exact same article.
The official parameter set, briefly
Google’s own documentation for its Campaign URL Builder tool defines five standard parameters: utm_source, utm_medium, and utm_campaign as the commonly used ones, plus optional utm_term and utm_content fields for more granular tracking. Marketers use a dedicated builder tool, hosted separately from any analytics dashboard, specifically to keep these values consistent — inconsistent values (like “twitter” in one link and “Twitter” in another) fragment reporting on the marketer’s end without affecting anything from a visitor’s perspective.
How privacy-focused browsers treat these parameters
Some browsers now automatically strip certain tracking parameters — particularly click-identifier parameters like fbclid or gclid, which can be linked to a specific ad click — when you copy or share a link, as a privacy protection. General campaign parameters like utm_source are typically left alone by these protections, since they identify a channel rather than an individual click. This is a browser-level privacy feature working in the background; you do not need to do anything for it to apply, and its presence or absence has no bearing on whether the link itself is safe to click.
Limitations
Not every parameter is purely cosmetic — some pages genuinely require specific query parameters to function correctly, such as a search results page or a page displaying a specific item by ID. Removing parameters indiscriminately from every link can occasionally break the page. When in doubt, leave the link as received.
Frequently asked questions
Can a tracking parameter identify me personally?
Typically, a tracking parameter identifies the channel or campaign a click came from, not you personally by name — though combined with other data a site already has (like being logged in), it can contribute to a broader picture of your activity on that site.
Should I always strip tracking parameters before sharing a link?
It is a reasonable privacy habit but not a safety requirement. If you are sharing a link and want a cleaner, shorter version, removing everything from the question mark onward is usually safe to try.
Do tracking parameters affect what happens after I click, described elsewhere?
See What Happens After You Click a Link: DNS, Redirects, and Cookies for how tracking parameters and redirects fit into the broader process of what happens when you click a link.
