BeirutA forwarded link carries the sender’s tracking data.
Query strings like utm_source and fbclid tell the site who you are, which campaign brought you, and who forwarded the link.
Browser extensions like ClearURLs strip parameters before the page loads — eliminating the leak before it reaches the server.
Sources: SMEX
WHAT UTM ACTUALLY IS
UTM stands for Urchin Tracking Module — named after Urchin Software, which Google acquired in 2005 to build Google Analytics. The five parameters (source, medium, campaign, term, content) became a de facto web standard despite never being formally standardized.
THE CLICK ID FAMILY
Beyond UTM, platforms inject their own click identifiers: fbclid (Facebook), gclid (Google Ads), msclkid (Microsoft), ttclid (TikTok), igshid (Instagram). These are unique per click and let the platform reconcile a server-side conversion back to a specific ad impression — bypassing cookie blockers entirely.
WHY THE FORWARDING LEAK MATTERS
When you copy a link from a newsletter and paste it into a private chat, the click ID encoded for you travels with it. The recipient's click is then attributed to your identity — the platform thinks you visited twice, or worse, learns the social graph between sender and recipient.
THE REFERER HEADER
Separate from URL parameters, browsers send a Referer header (misspelled in the original 1996 HTTP spec, never corrected) telling the destination which page sent you. Modern browsers truncate this to the origin by default, but URL parameters are a workaround that survives the privacy hardening.
WHY STRIPPING WORKS CLIENT-SIDE
ClearURLs and similar extensions intercept the request before it leaves the browser, removing known tracking parameters using a maintained ruleset. The server never sees them — unlike cookie blocking, there is no fingerprint of the strip itself, because the request looks identical to a clean link.
THE SMEX CONTEXT
SMEX is a Beirut-based digital rights organization that has documented surveillance and data exploitation across the Arab world since 2008. Their guidance reflects a region where forwarded links carry political risk — a leaked attribution chain can map dissident networks for state security services.