Link Decoration and Tracking Parameters: The Privacy Issue Marketers Miss

Link Decoration and Tracking Parameters: The Privacy Issue Marketers Miss

A marketer shares a campaign link. A visitor clicks it. The landing page opens, analytics records the visit, and the team can see which ad, email, or social post brought the person there.

Now look at the address bar. Instead of a simple page URL, you might see something like:

https://example.com/demo?utm_source=linkedin&utm_campaign=autumn_launch&gclid=example-click-id

Those extra pieces are called URL parameters. Adding them to a link for measurement is commonly known as link decoration. The important question is not simply whether a URL contains tracking parameters. It is what those parameters reveal, where they travel, and how your website or advertising tools use them.

---

What Is Link Decoration?

Link decoration means adding information to a URL beyond what is needed to open the page. This information usually appears after a question mark, with multiple parameters separated by ampersands.

For example:

https://example.com/guide?utm_source=newsletter&utm_medium=email

Here, the parameters tell the website that the visit came from a newsletter email. They do not, by themselves, identify a particular subscriber.

Link decoration becomes more sensitive when it carries a unique click identifier, account identifier, or other value that can be associated with a person or device. That value might be saved in a cookie, passed to another page, recorded in a server log, submitted with a form, or shared with an advertising platform.

The UK Information Commissioner's Office (ICO) specifically includes link decoration and navigational tracking in its guidance on storage and access technologies. In other words, tracking does not become irrelevant to privacy rules just because it is visible in the URL rather than hidden in a cookie.

---

UTM Parameters vs Click IDs: Know the Difference

Marketers often group every URL parameter under the label “tracking”. But different parameters do different jobs.

| Parameter | Typical purpose | What to watch for | | --- | --- | --- | | utm_source, utm_medium, utm_campaign | Identify a campaign or traffic source | Usually campaign-level labels, unless someone puts personal information in them | | gclid | Identify a Google Ads click for attribution | May be associated with advertising activity and stored or shared by tags | | fbclid | Identify a click from a Meta platform | Can form part of a wider advertising measurement flow | | msclkid | Identify a Microsoft Advertising click | May be captured for conversion attribution | | li_fat_id | Support LinkedIn advertising attribution | Review how it is collected, retained, and passed to partners | | Custom user_id, email, or contact_id | Identify a particular person or account | Particularly sensitive; avoid exposing personal identifiers in URLs |

A UTM parameter saying utm_campaign=product_launch is different from putting a customer's email address in a link. Even a unique click ID is not automatically a person's name, but it can become personal data when it is linked to an identifiable individual or used with other information.

---

Where the Privacy Problem Starts

Imagine someone clicks a LinkedIn ad and lands on your website with a tracking identifier in the URL.

Your website might then:

1. Read the identifier from the address bar.
2. Store it in a first-party cookie or browser storage.
3. Keep it as the visitor moves between pages.
4. Add it to a demo request or checkout event.
5. Send it to an advertising or analytics service to connect the visit to a conversion.

The original click ID might look like a random string, but it can become part of a record connecting advertising activity, browsing behaviour, and a lead or purchase.

There are also less obvious places where a full URL may appear: website access logs, analytics page-location fields, error monitoring, support screenshots, saved browser histories, and some redirects. Depending on browser settings and the destination, URL information can also be exposed through referrer data.

---

Does Link Decoration Require Cookie Consent?

Not every decorated URL automatically requires consent. A simple campaign label is not necessarily the same as reading a unique identifier from a device for advertising.

The answer depends on the technology and purpose. For example, if a tracking system stores an advertising click ID in a cookie or accesses information on the visitor's device, UK electronic privacy rules may apply. The ICO explains that link decoration and navigational tracking fall within those rules when they involve storage or access on the user's device.

In the EU, the European Data Protection Board's guidance on the technical scope of ePrivacy rules also examines URL-based tracking and similar technologies.

If parameters or associated records relate to an identifiable person, GDPR or UK GDPR requirements may apply too. Those requirements are not limited to cookies, and they include transparency, a valid legal basis, data minimisation, and appropriate retention.

---

What About Google Consent Mode and URL Passthrough?

This is where the topic gets especially important for paid media teams.

Google Consent Mode lets supported Google tags adjust their behaviour based on a visitor's consent choices. But disabling advertising cookies does not necessarily mean all click information disappears from the URL or every measurement request.

Google documents an optional feature called URL passthrough. In eligible configurations, it can carry advertising click information through same-domain links when ad_storage is denied, helping maintain some measurement functionality without storing that information in advertising cookies.

Google also explains that, depending on settings, measurement requests may still include page URLs containing ad-click information. Its documentation describes additional ads data redaction controls.

That does not mean URL passthrough is a universal workaround for consent. Whether a specific implementation is appropriate depends on the legal requirements, the data involved, the tag configuration, and the actual processing taking place.

If you use Google Ads or GA4, review your configuration rather than assuming that ad_storage=denied automatically removes every identifier from every request. CookiePal's Google Consent Mode solution can help connect consent choices to supported Google tags, but the wider parameter and data-sharing setup still needs testing.

---

Why Server-Side Tracking Is Not a Free Pass

Some marketing teams move attribution from browser scripts to server-side systems. Instead of allowing an advertising script to read a click ID directly, the website collects the parameter and sends conversion details through a server-to-server connection.

A server can still receive a click ID, associate it with a lead, and share it with an advertising provider. If a browser identifier is collected or accessed as part of the process, device-storage rules may also be relevant. And if the information is personal data, GDPR principles still apply regardless of whether the final transfer happens in the browser or on a server.

---

Five Common Mistakes Marketers Make

Putting personal information in URLs. Email addresses, telephone numbers, account numbers, and CRM contact IDs should not be casually added to campaign links. URLs can be copied, forwarded, logged, and exposed in places marketers never intended.

Keeping identifiers longer than necessary. A click ID might be useful for a defined attribution process. That does not mean it needs to follow the visitor across every page indefinitely or remain attached to every later event.

Confusing campaign attribution with permission to profile. Knowing that a visit came from an email campaign does not automatically authorise cross-site advertising, remarketing, or identification of individual visitors.

Assuming cookie blocking covers every route. A consent management platform can help control cookies and scripts, but custom code, server-side capture, and URL forwarding must be reviewed separately.

Never testing the rejected-consent journey. Teams often test only whether conversion tracking works after “Accept All”. They also need to know what is collected and transmitted when someone rejects optional tracking.

---

How to Audit Tracking Parameters on Your Website

1. List your incoming parameters. Check Google Ads, Microsoft Ads, Meta, LinkedIn, newsletters, affiliate links, and custom campaign URLs.
2. Separate labels from identifiers. Identify ordinary UTMs, unique click IDs, and anything containing a person-specific value.
3. Follow the visitor journey. Open a campaign landing URL, browse additional pages, submit a test form, and observe which parameters persist.
4. Inspect storage and requests. Use browser developer tools to check cookies, local storage, network requests, and submitted form fields before and after different consent choices.
5. Review server-side destinations. Ask where click IDs enter your CRM, backend, conversion APIs, analytics, logs, and reporting systems.
6. Remove unnecessary exposure. Do not add personal information to URLs; minimise identifiers, restrict retention, and consider removing unneeded parameters from displayed URLs once required processing is complete. Test attribution before making changes.
7. Update your disclosures. Explain relevant advertising measurement and tracking uses in your privacy and cookie documentation.

A CookiePal website compliance scan is a useful starting point for discovering cookies and trackers. However, a cookie scan alone cannot reveal every custom URL parameter, backend data transfer, or server-side attribution process. Combine scanning with a technical review of your links and data flows.

---

Make Consent Part of Campaign QA

Before a campaign launches, confirm that the consent management setup is active on the landing page, that non-essential technologies respond appropriately to consent, and that click identifiers are not being unnecessarily copied into forms or external links.

Then test both “Accept” and “Reject” journeys. Check whether identifiers are stored, passed between pages, or included in network requests. Review any optional URL passthrough or server-side conversion features with your technical team.

Finally, keep your cookie policy and wider privacy notice aligned with what your actual marketing tools do. A generic sentence about “improving our services” is not a useful explanation of advertising attribution and retargeting.

---

Better Attribution Starts With Better Transparency

Link decoration is not inherently bad. UTM parameters help marketers understand which campaigns work, while click identifiers support important advertising measurement processes.

The mistake is assuming that no visible cookie means no privacy issue.

A tracking parameter can move through browsers, forms, analytics tools, servers, and advertising systems. The privacy implications depend on whether it identifies someone, what it is used for, where it is stored or accessed, and who receives it.

Start by understanding your tracking setup. Use CookiePal's free compliance scanner to identify website cookies and trackers, then review your URL parameters and consent-dependent data flows alongside them.

This article provides general information, not legal advice. Consent and privacy requirements depend on your technologies, purposes, visitors, and applicable laws.