To remove tracking from a link, delete the tracking pairs after the ? before you send it: anything that starts with utm_, plus click and email IDs such as fbclid, gclid, msclkid and mc_eid. Keep every other pair, and anything after a #, as they are.
The rest of this guide explains what those pairs record, which ones your browser or Messages already removes, how to clean a link by hand, and the exact list Shareling removes from every link before it saves or sends one.
What are the extra bits on the end of a link (utm_source, fbclid, igsh…)?
They are tracking parameters: name=value pairs added to the link's query string, the part after the ?, that tell a website or an ad platform where the click came from. The page loads the same without them. They exist to feed the site's analytics.
A link copied from a newsletter might look like this:
https://example.com/article?utm_source=newsletter&utm_medium=email&utm_campaign=spring_sale&id=7
Everything from utm_source to spring_sale is tracking. id=7 may be the page's own data. Pairs are separated by &.
The common ones, and who adds them:
| Parameter | Added by | What its owner says it records |
|---|---|---|
utm_source, utm_medium, utm_campaign, utm_term, utm_content, utm_id | Anyone using Google Analytics campaign links | The referrer, the medium (such as email or cpc), the campaign, the paid keyword, which creative was clicked |
gclid | Google Ads auto-tagging | The ad click, with the campaign and other attributes of that click |
fbclid | Meta, on ad clicks from Facebook and Instagram | A ClickID for that click |
msclkid | Microsoft Advertising auto-tagging | A unique ID for the click |
twclid | X ads | A Click ID used to attribute actions on the site |
mc_cid, mc_eid | Mailchimp campaigns with e-commerce tracking | The campaign, and the recipient's email address |
_hsenc, _hsmi | HubSpot emails | Identity tracking and email click tracking |
Instagram share links often carry an igsh or igshid parameter. Meta publishes no page defining either, so this guide gives no meaning for them; Shareling strips both anyway.
Do they tell anyone who clicked?
Some of them identify the click or the person, and some only name a campaign. Google describes utm_ parameters as campaign data: utm_source=newsletter says which mailing sent the visit. They describe a campaign, not a person or a click.
Click IDs are different. Google says gclid is passed with ad clicks and identifies the campaign "along with other attributes of the click". Microsoft adds a unique msclkid to each click and reads it back in later tracking events "whenever the same customer visits your page". The Meta Pixel stores fbclid in a cookie, and the advertiser can send it back to Meta.
Email IDs go furthest. Mailchimp's mc_eid "identifies the recipient's email address", and the sender can look the address up from it. HubSpot labels _hsenc "identity tracking".
This matters when you forward a link. A copied link can carry an ID for the original click, the email recipient or the account that shared it, and the friend who opens your copy passes that ID back to the site. A press report from Android Authority said a Spotify link's si parameter is tied to the account that shared it, so the recipient's click can be connected to the sender. Spotify has not said so itself.
How do I remove them before I send a link?
Delete each tracking pair from the query string, and leave the rest of the link as it is:
- Paste the link somewhere you can edit it, such as a note or the message box before you send.
- Find the
?. Everything after it, up to a#if there is one, is the query: pairs joined by&. - Delete each pair whose name starts with
utm_or appears in the table above, along with the&that joined it. - If no pairs are left, delete the
?too. Leave anything after#alone. - Open the cleaned link once to check it still goes to the right page.
Keep any pair you do not recognise. Shareling takes the same approach and deletes only the names on its list.
Firefox can do this for you. Since Firefox 120, right-clicking a link offers Copy Link Without Site Tracking, which copies it with the tracking removed.
Which ones does my browser already strip?
Safari and Firefox strip some tracking parameters on their own, in limited places, and Safari lets utm_ campaign parameters through. For Chrome, the research behind this page found no Google page saying it strips tracking parameters, so this guide makes no claim either way.
Safari and Apple's apps. Apple announced in June 2023 that tracking information "will be removed from the links users share in Messages and Mail", and from links in Safari Private Browsing. On the Mac, Safari's Use advanced tracking and fingerprinting protection setting is on by default in Private Browsing, removes known tracking parameters from all URLs, and can be turned on for all browsing. WebKit says Link Tracking Protection removes only the parameters used for cross-site tracking "granular to users or clicks"; parameters used only for campaign attribution pass through. Apple does not publish the list.
Firefox. Since Firefox 102, Enhanced Tracking Protection in Strict mode and private windows strip a fixed list. The first release list was mc_eid, oly_anon_id, oly_enc_id, __s, vero_id, _hsenc, mkt_tok and fbclid. gclid and utm_ were not on it. You can add names through the privacy.query_stripping.strip_list preference.
What does Shareling remove, and what does it keep?
Shareling removes 34 named tracking parameters, plus any parameter whose name starts with utm_, from every link before it saves it to your library, and at launch before it sends it to a person. It keeps every other part of the link, including the #fragment.
Shareling is a Mac, iPhone and iPad app for sending a link straight to one person, with both of you keeping it in one library.
The list is frozen in one source file, and a test pins its size at 34:
- Campaign:
utm_source,utm_medium,utm_campaign,utm_term,utm_content,utm_id,utm_name,utm_reader,utm_social,utm_brand, and any otherutm_name - Google ads:
gclid,gbraid,wbraid,dclid,gclsrc - Other ad clicks:
fbclid,msclkid,twclid,ttclid,yclid - Instagram:
igshid,igsh - Email:
mc_cid,mc_eid,mkt_tok,_hsenc,_hsmi,vero_id,vero_conv - Other:
oly_enc_id,oly_anon_id,pk_campaign,pk_kwd,ref_src
Matching ignores case, so UTM_SOURCE goes too. If every pair was tracking, the ? goes with them.
The clean happens in the one step every new link passes through, whether you share it from the iPhone share sheet or import it from Chrome bookmarks, and at launch whether you drop it on yourself or on a person. Sending to a person and the notch drop are designed but not built yet; when they ship, the link your person receives is the cleaned one and the note you write travels with it unchanged.
What Shareling keeps:
- Every parameter not on the list. Its tests check that forty unrelated parameters come through a clean untouched.
- The
#fragment. Shareling keeps it in the saved and sent link and ignores it only when checking for duplicates, so two links that differ only after the#count as the same page. WebKit notes that some sites put tracking information in the fragment too; Shareling leaves that in place. www., the path's capitals and any non-standard port. It does lowercase the scheme and host, and drops:443and:80.
The trade-offs are real. si is not on the list, so a link that carries it, such as a Spotify share link, keeps it; delete it by hand if you care. A tracker invented after the list was frozen passes through until the list changes, unless its name starts with utm_. Shareling cleans the link as text, with no network request, so a shortened link is saved as the short link and never opened to see where it leads.
Stripping also catches duplicates. The same article reached from a newsletter and from an ad cleans to one address, so dropping both on the same person, or on your own library, keeps one link instead of two.
More guides on sending and keeping links are in the guides.
Frequently asked questions
Is it safe to delete utm_source and the rest of the utm_ parameters from a link?
Yes. Google Analytics uses utm_ parameters to record which campaign sent a visitor, and a page loads the same without them. Shareling deletes every parameter whose name starts with utm_, whatever comes after the prefix.
Does fbclid identify me?
Meta describes fbclid as a ClickID it adds when someone clicks an ad on Facebook or Instagram. The Meta Pixel stores it in a cookie, and the advertiser can send it back to Meta to attribute the visit, so it identifies the click rather than a campaign.
Does Shareling remove the si parameter?
No. si is not on the list Shareling strips, so any link that carries it, such as a Spotify share link, keeps it. Delete it by hand before you drop the link if you want it gone, and check the link still opens.
Does iMessage remove tracking from links?
Apple said in June 2023 that tracking information would be removed from links shared in Messages and Mail. It removes only the parameters Apple treats as cross-site tracking of users or clicks. Campaign parameters such as utm_ pass through, and Apple does not publish its list.
Does Shareling remove anything after the # in a link?
No. Shareling strips tracking parameters from the query, before any #, and keeps the #fragment in the link it saves and sends. WebKit notes that some sites put tracking information in the fragment too; Shareling leaves that in place.
Send a link to the person you mean it forShareling is a Mac, iPhone and iPad app for sending a link to one person and keeping the links you save, synced through your own iCloud.