When Sharing Isn't Caring: A Guide to Tracking Links

As a content creator, I understand the value of analytics. It's crucial for me to understand what content did well and why or if my website views are decreasing. As a privacy advocate, it's also important to me to keep those analytics reasonable.

Unfortunately, most companies feel that there's no such thing as too much data in their quest to understand, predict, and nudge our behavior to their benefit. To this end, they often take every opportunity they can to sneak in just a little bit more surveillance. And thus, this week, I'd like to introduce the "tracking link" to those who've never heard of it: what it is, how it threatens the privacy of you and your loved ones, and how to easily avoid it.

What Is a Tracking Link?

A tracking is a link that lets the website (and usually other parties like advertisers) understand where a link came from, where it was shared, and who used it.

A tracking link is often created when you press the "share" button on a web page or in an app, but sometimes it can be embedded in a website or news aggregator (like an RSS reader) so that you can fall victim to them simply by clicking it.

Consider the following link I made as a hypothetical example. This was made using a tool that helps you create links with Google Analytics, so while it's not active, this is a realistic example:

https://thenewoil.org?utm_source=newsletter&utm_medium=email&utm_campaign=spring_sale&utm_id=216&utm_term=privacy&utm_content=variation_1

This example is on the smaller side. I've seen links that are several lines long.

In this link we can see my root website (thenewoil.org) as well as some revealing information. For example, this link would probably have been embedded in my email newsletter regarding a spring sale. There's also keywords (privacy), different versions of the same ad campaign (varation_1), and a unique campaign ID (216).

How Tracking Links Betray Your Privacy

On it's face, this is invasive but not terrible. After all, at the time of this writing I have just over 150 subscribers, so even if I did run campaigns like this I shouldn't be able to identify every one of you, right?

Except some tracking campaigns can be far more granular or even individually unique, tracking you and everyone you shared it with, violating the privacy of both you and the recipient(s). The data that can be gleaned from this kind of process is vast, but one of the most prominent is that it creates a map of your social network, since everyone who clicks that unique link most likely got it from you and therefore knows you in some way.

This may not seem important to you, but governments are certainly interested in this kind of data, which means others (like advertisers) probably are too. It's also worth noting - as always - that while you may be willing to be transparent with your social network, there are many valid reasons that others may not be. Activists, journalists, and many others may find it important to hide this kind of information. Consider for example, a whistleblower at a government agency who gets correlated with a journalist they may otherwise have no friends or interests in common with. It's pretty easy to draw conclusions.

How To Stop Tracking Links

Thankfully, tracking links are usually easy to defeat. There are ways to manually do it, but let me start with the automated ways.

• uBlock Origin: If you're using the uBlock Origin extension in your browser (which you should be except in Brave and Tor) you can open the settings, go to the Filter lists tab, and enable "Adguard/uBO - URL Tracking Protection" under the "Privacy" category. This will automatically strip tracking links in most (but not all) websites when you copy from the address bar.
• Brave: If you're a Brave user, open the Filter lists (you can do this by visiting any website, clicking the lion icon in the address bar, and selecting "Filter lists" at the bottom of the pop-up or by opening the browser settings and navigating to "Shields" > "Content filtering"). There you'll find a filter list called "AdGuard URL Tracking Protection Filters." This will remove most tracking links automatically when you copy them from the address bar in Brave.
• AdGuard: If you're already an AdGuard user, they offer a filter to remove trackers from links, so simply make sure that's enabled in the settings.
• Manually from the browser: In most privacy-respecting browsers like Brave or Firefox, you can right-clicking the link (even in the address bar) and there should be an option to "copy clean link" or something similar. This should copy the link without the tracking portions.
• Using the Share Button: Usually when you go to share a link from an app or website using the "share" button, you'll have an opportunity to modify it before sending. In most (but not all) cases, the tracking portion of a link is anything after the question mark (as in my earlier example). Sometimes it may include a small part just before the question mark, such as ref=, fbclid, or something similar.

Sadly, companies are getting a lot trickier about tracking links and starting to encrypt them. Facebook and TikTok are two offenders I'm aware of who do this, but I'm sure there's others. The advantage for end-users is that shared links look a lot cleaner, but the drawback for the privacy-conscious is that it becomes impossible to strip out the tracking portion without making the whole link useless.

Encryption would make a tracking link go from something like https://thenewoil.org/en/guides/prologue/?utm_source=newsletter&utm_medium=email&utm_campaign=spring_sale&utm_id=216&utm_term=privacy&utm_content=variation_1 to something more like https://thenewoil.org/?=q2ZAh3qsVPJ3uSvfZv50xJ0Xe. Trying to remove everything after the question mark would take you to the home page, which is problematic when you're trying to link to a specific page.

Thankfully link encryption remains relatively uncommon for now.

Privacy Is A Team Sport

It's important to note that eliminating tracking links is just one step toward improving your privacy and that of those around you. Tracking links are just one of a vast pantheon of ways that companies track you, including fingerprinting, scanning messages, persistent identifiers (like using the same email address across multiple services), and more. That said, it's an easy thing to eliminate, and it benefits the people around you, too. Every little step adds up.

The vast majority of privacy is based in personal responsibility - you can choose to use a password manager, encrypted email, switch to browsers that reduce fingerprinting, and more without relying on others. But there are certain spots where privacy requires teamwork: using encrypted messengers, not posting someone's photo online without their consent, and being mindful how we interact with them online, to name just a few. When we care about the privacy of those around us just as much as our own, we're helping protect everyone and raising the default privacy level of everyone along the way.