Sometimes the tracking identifier is not hiding in a cookie.
It is sitting in the address bar.
A URL can carry extra information after a question mark or fragment:
shop.example/?campaign=summer&id=847219
Some of that information is harmless campaign attribution.
Some of it can identify or help recognize a particular user.
This technique is often called link decoration.
The link becomes the courier
Suppose a social site knows a user as account 847219.
When that user clicks a link to a store, the social site can append a click identifier to the destination URL. The store, or a script running there, can read that identifier and potentially connect the visit back to the source.
WebKit documented this pattern while describing Safari’s tracking defenses. Its example shows a social network adding a click ID to outgoing links; once the user lands on another site, embedded scripts can read the identifier and store or report it. See WebKit’s explanation of cross-site tracking via link decoration.
MDN’s current privacy guide makes the same broader point: URL parameters can carry campaign information, email addresses, or other identifiers from one context into another. See MDN’s Privacy on the web.
Not every decorated link is surveillance
A parameter such as:
utm_campaign=spring_sale
may simply tell a merchant which advertisement or newsletter produced the visit.
That is different from attaching a stable user-specific ID that can be associated with activity across destinations.
The important question is what the parameter represents and what happens after it arrives.
A campaign label describes the traffic source.
A persistent user identifier can describe the visitor.
Those uses should not be collapsed into one accusation merely because both live in a query string.
Removing one obvious parameter may not end tracking
Browsers and privacy tools increasingly strip, limit, or defend against known forms of link decoration. Safari, for example, has long restricted storage behavior associated with cross-site tracking through decorated links.
But the URL is only one possible connection.
The destination may also recognize a logged-in account, receive server-side data, use a first-party identifier, derive a fingerprint, or connect the visit through another advertising system.
Deleting ?id=847219 removes that particular visible signal.
It does not prove that all other links between the two services disappeared.
That is why decorated URLs are so useful for studying the Surveillance Economy.
They expose the plumbing.
For a moment, the identifier is not buried in a database or browser storage.
It is literally traveling inside the link.