The Privacy Cost of Tracking Query Strings
Every time you click a link online, there is a good chance that the address bar contains a hidden fingerprint. Those letters and numbers after the question mark in a URL, the so-called query string, are no longer just technical plumbing. They have evolved into one of the most widespread mechanisms for following individual users from site to site, device to device, and sometimes across years of browsing history.
In Australia, where regulators have started taking a harder look at how digital platforms harvest data, the humble query string sits at the centre of conversations happening at the Office of the Australian Information Commissioner and inside the ACCC. Understanding what these parameters actually do is the first step toward deciding how much of your digital life you want to leave behind in someone else's database.
Anatomy of a Tracking URL
A query string is the portion of a web address that begins with a question mark and contains key-value pairs separated by ampersands. A standard product page might legitimately use one to filter search results, but marketing teams also rely on the same syntax to attach identifiers: utm_source, utm_medium, utm_campaign, fbclid, gclid, msclkid, and dozens of bespoke variations created by individual platforms. Each of those tags can carry a unique identifier tied to your browser session, your account, or a click you made hours earlier in a completely different app.
Because the query string is part of the URL itself, it gets copied and pasted wherever links travel. Send a link to a mate over WhatsApp and the parameter goes with it. Post it to a community group on Facebook and the tracking code rides along. Bookmark the page and the identifier stays in your browser until you clear it. The information is rarely visible to the person doing the sharing, which is precisely what makes it so effective as a surveillance tool.
How Parameters Travel Between Sites
The reach of a single tracking string is often amplified by redirects, the automated forwards that send you from a short link, an ad, or an email button to a final destination. Each hop can append its own parameter, so by the time you arrive at the merchant's site, your URL might carry identifiers from the email platform, the social network, the affiliate network, and the advertiser's own tracking pixel. From the merchant's perspective, this appears as a single referral source; from your perspective, several parties now know you arrived.
In Australia, this kind of chained tracking is particularly visible in the affiliate marketing world that surrounds online retail, comparison sites, and even some government service portals. A Canberran comparing energy plans through a comparison website, for instance, will find that the final sign-up page receives a referral code identifying the comparison site, the specific campaign, and sometimes the search keyword that brought them there in the first place. That string then becomes part of the customer's record on file, often long after the transaction is complete.
The Ad Tech and Data Broker Pipeline
Query strings rarely stop at the first site that receives them. They feed into a broader pipeline of advertising technology, where identifiers are stitched together with cookies, device fingerprints, and logged-in profiles to build a continually updated portrait of each user. Real-time bidding systems, which auction ad space in milliseconds, rely heavily on these URLs to decide which advertisers get to bid on your attention. The query string you carry into a news article determines, in part, which ads compete to be shown next to it.
Australian consumers have begun to push back against this machinery. The ACCC's Digital Platforms Inquiry highlighted how data collected through seemingly innocuous mechanisms, including URL parameters, can end up in the hands of data brokers who sell enriched profiles to insurers, political campaigns, and credit reporting agencies. Once a query string identifier is linked to a name, an email, or a postal address, the technical artefact becomes a personal record under the Privacy Act 1988, and the obligations that flow from that classification are surprisingly strict on paper.
Australian Law and Where Query Strings Fit
The Privacy Act and the thirteen Australian Privacy Principles govern how organisations handle personal information, and personal information includes any data that can reasonably identify an individual. A bare tracking identifier on its own is not necessarily personal information, but the moment it is combined with other details held by the same entity, or shared with a third party that holds those other details, it can become one. The Office of the Australian Information Commissioner has repeatedly emphasised that collection must be lawful, necessary, and accompanied by clear notice.
Where things go wrong is when query strings are passed to organisations without the user's knowledge. A retailer's "share this product" button, for example, might embed a referrer identifier that identifies the sender's account to the recipient's email client. If the recipient then clicks through, the retailer may believe a new customer has arrived, when in fact a known customer has simply forwarded a link. Several consumer groups have published data privacy resources that walk through how Australian law treats these identifiers, and the notifiable data breaches scheme requires organisations to disclose serious incidents, a standard that has caught several companies out after query string mishandling exposed browsing histories tied to identifiable accounts.
Everyday Scenarios Across the Country
The mechanics become vivid when you look at specific Australian contexts. Online gambling platforms, including the real-money pokies sites that sit alongside the pub and club machines familiar from venues across Sydney, Melbourne, and regional Queensland, rely on affiliate networks that tag every click with a source identifier. Payment processors like Mastercard then receive a transaction record that may include the original referring parameter, linking a deposit to a specific campaign, and in turn to the player. Coverage of pokies payout report shows how deeply these identifiers can be embedded in routine payment flows.
The same pattern plays out in retail loyalty programmes, where members receive email offers containing member-specific codes. Banks use it too: when you compare home loans through a broker site, the application that lands at the lender's desk may carry a referral identifier that influences the commission paid and, sometimes, the interest rate quoted. Even Australian news sites, many of which have erected paywalls since the collapse of several metro mastheads, use query strings to track article sharing and to enforce metering rules. In each case, the URL is doing double duty, connecting the user to a destination while also connecting the user to whoever watched them arrive.
Reducing Your Exposure
None of these mechanisms are visible by default, which is why most Australians underestimate how much they leak. Practical steps begin with stripping parameters from links before sharing them. Browser extensions such as ClearURLs, uBlock Origin with its filter lists, and the tracking protection built into Firefox and Safari will quietly remove the tags before pages load. DuckDuckGo's email forwarding service and Brave's private tabs apply similar filtering on the fly. None of these tools are perfect, and a VPN will not hide query strings from the sites you actually visit, but together they narrow the surface area considerably.
Beyond tooling, it helps to read privacy policies with a sceptical eye, particularly the sections on "sharing with partners" and "analytics and advertising". Australian privacy law requires organisations to spell out these arrangements in plain English, and the OAIC has been increasingly willing to pursue companies that bury them in jargon. Where a policy is opaque, or where an opt-out toggle is hidden behind several menus, that is often a signal that the query strings involved are doing more work than the company wants to advertise.