Anti-Tracking Guide

Tracking parameters in links

What utm_, fbclid and similar parts of a link do, how Firefox and Safari strip them, what the EDPB says about tracking links, and a private link cleaner.

Official source: Mozilla, Query Parameter Stripping (Firefox Source Docs). Verified on

2 min read · Review scheduled for 2027-01-20

Contents

In short

  • A link can carry an identifier. Parts added after a question mark, such as fbclid, mkt_tok or utm_source, can tell a site where you came from, or tie your click to a campaign or a person.
  • Firefox strips a list of them. Mozilla's documentation says query stripping removes known tracking parameters before you navigate, and that it is on by default in Enhanced Tracking Protection Strict mode (Mozilla).
  • Safari does it in Private Browsing. WebKit says Private Browsing removes known tracking query parameters before navigation (WebKit).
  • EU regulators treat tracking links as tracking. See EU rules.

The Mozilla list

The initial list in Mozilla's documentation names these parameters: mc_eid, oly_anon_id, oly_enc_id, __s, vero_id, _hsenc, mkt_tok and fbclid (Mozilla). The documentation says the real list comes from a preference and from Remote Settings, so it changes, and sites on an allow list are skipped.

How it works

Mozilla's page says stripping happens when a page loads, when the browser loads an address and during HTTP redirects. It also notes that the release version keeps the feature to Strict mode, a longer list runs in Nightly, and it was considering Private Browsing.

The tool above removes the eight Mozilla parameters, plus utm_ ones, gclid and msclkid, which we added because they are common. It works on the text you paste; it does not open the link. If a link stops working after cleaning, a parameter it needed was removed: use the original.

Why it helps, and its limits

  • It helps when you share a link: your name or campaign tag does not travel with it.
  • It does not hide you from the site you visit. The site still sees your IP address and browser details, which is where fingerprinting starts.
  • It does not stop trackers that do not use parameters.

Outside this page: We did not test any browser's stripping ourselves, and we did not read a full current list. Mozilla's page says the list is stored outside the page.