The Link You Saved in a Note Still Carries Its Tracking Tag

A link you paste into a note keeps every tag it arrived with — utm_source, fbclid, gclid — for as long as the note exists. Browsers clean links when you copy, share or open them, never after you have saved them. Search your notes for the known tracking keys, strip only those, and test each link.

The tags are ordinary. Marketers add them so analytics can tell which newsletter or ad sent a visitor, and Google documents nine utm_ keys for exactly that job.¹ Ad platforms add a click ID on top.

The browsers noticed. Firefox 120 shipped a clean-copy command on 21 November 2023,² and Apple announced Link Tracking Protection on 5 June 2023.³ Neither one reads your notes.

A web clip, a reading list or a reference section keeps the URL exactly as you pasted it. Share or publish that note, and every reader who clicks sends the tag along to the site — months or years after your own visit.

Demand for a cleanup is not small. ClearURLs, a Firefox add-on that removes tracking elements from URLs, reported 522,428 average daily users on 25 October 2026.⁴ This post gives the tags in their owners' words, shows why the browser fixes stop at the note, then hands you one search and one tested rule. For the link syntax itself, see write the link once, read it anywhere.

What the tags on your links are

Saved links carry two kinds of tag. utm_ keys are campaign labels — source, medium, campaign name — and read the same for everyone who clicked that link. Click IDs such as gclid and fbclid belong to the click itself. One tells a site which campaign sent you; the other can tell it which click was yours.

Google's URL-builder help page lists nine campaign keys: utm_id, utm_source, utm_medium, utm_campaign, utm_source_platform, utm_term, utm_content, utm_creative_format and utm_marketing_tactic.¹ The definitions are plain. utm_id is "Campaign ID. Used to identify a specific campaign or promotion." utm_source is "Referrer, for example: google, newsletter4, billboard". utm_medium is "Marketing medium, for example: cpc, banner, email".¹

Click IDs work differently. Google Ads explains that "auto-tagging adds a bit of additional information a parameter called GCLID, short for "Google Click Identifier" to the URLs people click through." It also gives the shape: "the final URL will look like www.example.com/?gclid=123xyz".[^5]

Meta documents fbclid the same way. Its Conversions API page shows an "Example URL with ClickID: https://example.com/?fbclid=IwAR2F4-dbP0l7Mn1IawQQGCINEz7PYXQvwjNwB_qa2ofrHyiLjcbCRxTDMgk" and tells advertisers: "Whenever present in the URL query parameters, try to obtain the parameter server-side by reading it from the HTTP request URL's query string."⁵

That sentence is the whole mechanism. The ID rides in the URL — and the site reads it on arrival.

The last row is deliberate. msclkid, mc_eid and Spotify's si all sit on Firefox's strip-on-share list,⁶ but this post found no page from Microsoft, Mailchimp or Spotify that says what they encode. So this post makes no claim about them beyond the list.

None of this is sinister on the sender's side. Campaign tags are how a newsletter learns which issue worked. The point is narrower: your notes should not forward them unexamined.

Why a note keeps what the browser would clean

Every browser protection acts at a moment — when you copy a link, share it, or navigate to it. Firefox cleans the link you copy. Apple cleans links shared in Messages and Mail, and links in Private Browsing. Safari strips before navigation. None of them opens a note you saved last year and edits the URL inside it.

Mozilla's release notes for Firefox 120 describe the feature in one line: "Firefox supports a new "Copy Link Without Site Tracking" feature in the context menu which ensures that copied links no longer contain tracking information."²

The menu item has since been renamed. In the current English strings it reads Copy Clean Link, and the translators' note explains that "Firefox will remove things from the link you copied, like items that identify you for advertising purposes".⁷ The setting behind it is on by default on desktop — the source reads // Enable Strip on Share by default on desktop.⁸

Apple's announcement is scoped the same way, to a moment of sharing or private browsing: "Some websites add extra information to their URLs in order to track users across other websites. Now this information will be removed from the links users share in Messages and Mail, and the links will still work as expected. This information will also be removed from links in Safari Private Browsing."³

WebKit's engineers — John Wilander, Charlie Wolfe, Matthew Finkel, Wenson Hsieh and Keith Holleman — gave the timing in July 2024: "This is done prior to navigation, such that these values are never propagated over the network."⁹

The note sits outside all three moments.

There is a second gap. The browsers do not agree on what counts as tracking. Firefox's strip-on-share list holds 247 keys — 182 global, and 65 more across 14 site-specific lists — and 37 of the global keys begin with utm_.⁶ Safari, by WebKit's own description, "removes a subset of query parameters that have been identified as being used for pervasive cross-site tracking granular to users or clicks."⁹

Campaign tags are not in that subset. "As its name suggests, the campaign above represents a parameter that's only used for campaign attribution, as opposed to click or user-level tracking. Safari allows such parameters to pass through."⁹ A link shared from an iPhone can still carry utm_campaign.

Two vendors, two lists, two moments. A list you can read in your own notes — four entries long — is the one you can check.

Why the click IDs matter more than the campaign names

Two peer-reviewed studies measured how often links carry identifiers rather than campaign names. A 2022 crawl found user IDs smuggled through URLs on more than eight percent of the navigations it made. A 2024 study found link decoration abused for tracking on nearly three-quarters of the websites it examined — often carrying cookies and email addresses.

The 2022 paper, by Audrey Randall and colleagues at UC San Diego and Brave Software, defines the technique: "UID smuggling modifies a user's navigation requests by adding information to the navigation URLs in the form of query parameters."¹⁰ Their crawler found it "present on more than eight percent of all navigations that we made," and on 8.11% of the unique URL paths it took.¹⁰

A disclosure worth making: one co-author, Peter Snyder, is at Brave Software — a browser vendor that ships tracking protection. The paper was peer-reviewed at ACM IMC 2022.

The 2024 paper, by Shaoor Munir and colleagues and presented at USENIX Security, is blunter. They found "link decoration is abused for tracking on nearly three-quarters of the websites, often to share cookies, email addresses, and fingerprinting information."¹¹

Their conclusion is the one a notes folder can use: "Since trackers need to share information from the client-side to the server-side through link decoration regardless of the tracking technique they employ, a promising orthogonal approach is to detect and sanitize tracking information in decorated links."¹¹

Hold both findings at their real size.

A plain utm_campaign=spring_sale names a sale, not a person. The weight sits in click IDs and in site-specific keys whose meaning only the site knows. That is why the rule below targets the documented families and leaves the unknown alone.

The single habit: strip only the keys you can name, then test

Remove only a short list of well-known keys — the utm_ family, gclid, fbclid, msclkid — and leave every other parameter alone. Some parameters are the link: a YouTube t= is the start time, an id= is the product. Google itself notes that some sites error on parameters they do not expect, so click-test after cleaning.

YouTube's own help page builds the start time into the link: "Start at: To link to a specific part of the video, check this box and enter the start time before you copy the link."¹² Strip t=137 and the note no longer points to the moment you meant — the reason timestamped video notes keep that parameter on purpose.

Google's auto-tagging page carries the warning in the other direction: "A small percentage of websites don't allow arbitrary URL parameters and serve an error page when auto-tagging is turned on."¹³ Its advice is a test, not a theory: "If the link to your site works, then you can use auto-tagging."¹³ A URL's parameters are input to the page. Change them, then check the page.

The full catalogue of tracking keys is long. ClearURLs' rule file holds 733 rules for 206 providers, including 48 global rules.¹⁴ A notes folder does not need all of them. It needs a short list a person can read, run and audit in a diff.

Four families is that list. Anything else stays — until you know what it does.

The five-minute version: find them

One read-only search lists every link in a notes folder that carries one of the four key families, with the file and line number. It changes nothing, so run it first and read the output. If it prints nothing, you are done. If it prints hundreds of lines, you know which notes to clean before you share them.

1. Open a terminal in the folder that contains your notes. Thirty seconds.
2. Run the search below, replacing <notes-folder> with the folder's name. Thirty seconds.
3. Read the output. Each line is file:line:match. Two minutes.
4. Mark the notes you share or publish. Clean those first. One minute.

grep -rnoE '[?&](utm_[A-Za-z_-]+|fbclid|gclid|msclkid)=[^&#)> ]*' <notes-folder>

The pattern reads left to right. [?&] is the start of a parameter. The group names the four families — utm_ followed by letters, underscores or hyphens, then the three click IDs. =[^&#)> ]* is the value, up to the next &, #, ), > or space.

The hyphen in the utm_ class is there for a reason. Firefox's list includes utm_social-type,⁶ and a letters-only pattern would miss it.

Output looks like this:

notes/reading.md:1:?utm_source=newsletter
notes/reading.md:1:&utm_medium=email
notes/reading.md:1:&utm_campaign=spring_sale
notes/clips.md:3:&gclid=123xyz
notes/clips.md:4:?fbclid=IwAR2F4-dbP0l7Mn1Iaw

A match can show a trailing period or comma when the link ends a sentence — ?utm_source=a. is one. The search only reports. The strip rule in the next section leaves that period in the sentence.

The thirty-minute version: strip them and check the diff

Save the three-rule sed script below, run it over a copy or a committed folder, and read the diff line by line. It deletes the four key families and their values, repairs the leftover ? or &, and leaves every other parameter, fragment and sentence-ending period in place. Then click a sample of the cleaned links.

1. Make the change reversible. Two minutes. Commit the folder in git, or copy it: cp -r notes notes.orig.
2. Save the rule as strip.sed. One minute.
3. Run it on every Markdown file. Under a minute.
4. Read the diff. Ten to twenty minutes. git diff, or diff -r notes.orig notes.
5. Run the search again. Thirty seconds. It should print nothing.
6. Click-test. Five minutes. Open a handful of cleaned links, especially any with other parameters left in them.

s/&(utm_[A-Za-z_-]+|fbclid|gclid|msclkid)=([^&#)> ]*[^&#)> .,;:!?])?//g
:a
s/\?(utm_[A-Za-z_-]+|fbclid|gclid|msclkid)=([^&#)> ]*[^&#)> .,;:!?])?&/?/
ta
s/\?(utm_[A-Za-z_-]+|fbclid|gclid|msclkid)=([^&#)> ]*[^&#)> .,;:!?])?([#)> .,;:!?]|$)/\3/g

find <notes-folder> -name '*.md' -exec sed -E -i -f strip.sed {} +

Each rule has one job. The first deletes any tracking key that follows an &, with its value. The loop (:a … ta) handles a tracking key right after the ?: it drops the key and keeps the ? for whatever parameter follows. The last rule removes a tracking key that is the only parameter left, and puts back the character that ended it.

The value pattern is the careful part — and the one that took three tries. [^&#)> ]*[^&#)> .,;:!?] lets a value contain dots — news.example.com — but refuses to end on one. A sentence-ending period or comma stays outside the link.

On a test folder of four files and twelve lines, the rule produced this:

Three lines stayed exactly as written: a prose sentence with ? and & in it, a plain ?id=7 link, and the words "utm_source" in a sentence. The second search found nothing.

Two earlier versions of this rule failed the same test. One deleted question marks from ordinary sentences. The other swallowed the period after a link. That is why the value pattern looks fussy — and why you read the diff.

Known limits. The commands were tested with GNU sed 4.9 on Linux. macOS ships a BSD sed whose -i flag works differently — use GNU sed, or test on a copy first.

The rule does not handle HTML-escaped &: the search misses a tag that follows &, and a tag right after the ? can leave a broken ?amp; behind — the diff shows it. It does not reach inside a redirect wrapper such as …/url?q=https%3A…, where the wrapper itself is the tracker. Keys outside the four families stay. Where a link ends is its own puzzle — see the period after your link is not part of the URL.

Stop new ones at the door

Cleaning the folder once does not stop tomorrow's clip. Copy links with a clean-copy command where your browser has one — Firefox calls it Copy Clean Link — and know what Safari's protection leaves in. An add-on such as ClearURLs cleans as you browse. Then re-run the search before any note leaves your hands.

Firefox. Right-click a link and choose Copy Clean Link. People still search for the old name, "Copy Link Without Site Tracking", which is how the feature shipped in version 120.² Menu labels move between versions — check yours.

Safari. WebKit's post says the Private Browsing protections "are also available in regular browsing", and gives the paths. "On iOS, iPadOS and visionOS go to Settings > Apps > Safari > Advanced > Advanced Tracking and Fingerprinting Protection and enable "All Browsing"." On a Mac: "Safari > Settings > Advanced and enable "Use advanced tracking and fingerprinting protection"".⁹ Campaign tags still pass, by design.

An add-on. ClearURLs has run since 2017 and lists version 1.27.3 as current.⁴ Its rules are a public file you can read.¹⁴

Before you share. Run the search on the note or folder you are about to send. If you publish a folder of notes as a site, run it on the folder before every build.

Common mistakes

Most cleanups go wrong in one of five ways: cutting everything after the ?, editing the only copy, tidying URLs that are case sensitive, trusting a phone to have removed campaign tags, and assuming a clean copy cleans the past. Each one either breaks working links or leaves the tags in place. All five are cheap to avoid.

• Deleting everything after ?. It removes utm_source and v= together. The video link now opens a different page, or none.
• Running sed -i on the only copy. In-place means in place. Commit or copy first, then read the diff.
• Lowercasing or "tidying" URLs. Google says "Parameter values are case sensitive",¹ and Meta warns its "ClickID value is case sensitive - do not apply any modifications before using, such as lower or upper case."⁵ Change only what you mean to remove.
• Trusting Safari to have removed utm_. It lets campaign-only parameters through.⁹ A link from an iPhone can still carry them.
• Assuming a clean copy cleans the past. Copy Clean Link fixes the link you copy today. The note from 2023 still has its tag.

The quiet one is the last. Every protection works forward in time.

Frequently Asked Questions

These questions come from people cleaning up tracked links — four of them in the words people used on Hacker News between 2023 and 2026, two as people type them into a search box. Each answer is short enough to act on and points back to the section it depends on. None needs a particular note app.

What is fbclid?

fbclid is Meta's click identifier. Meta's developer documentation calls it a "ClickID", shows it on the end of an example URL, and tells advertisers to read it server-side from the URL's query string. It is added to the link, not to a campaign, so it is heavier than a utm_ tag. The strip rule removes it; click-test the link afterwards.

Did you manually set those utm_source parameters?

Usually not — the sender did. A newsletter tool or ad platform adds utm_ tags so its analytics can tell which campaign sent a visitor. Google documents nine of them. Your note simply keeps whatever was on the link when you pasted it, and forwards it to anyone who clicks.

iOS 17 automatically removes tracking parameters from links you click on — does that cover my notes?

No, on two counts. Apple's Link Tracking Protection removes a subset of click- and user-level parameters, and WebKit says campaign-only parameters pass through. It also acts when links are shared in Messages and Mail, opened in Private Browsing, or opened anywhere once you turn on "All Browsing" — never on a URL already stored in a note.

How to remove UTM parameters from URLs in Chrome

For links already in your notes, the browser does not matter: run the read-only search on the folder, then the three-rule strip script on a copy, and read the diff. For new links, use a browser or add-on that cleans on copy. This post does not cover a built-in Chrome feature.

Any URLs where cleaning breaks expected behavior?

Yes, when the cleaner removes too much. A YouTube t= is the start time; an id= or page= is the page. Google notes that some sites error on parameters they do not expect. The rule here removes only four key families, keeps every other parameter and fragment, and asks you to click-test afterwards.

How do I copy a link without tracking in Firefox?

Right-click the link and choose Copy Clean Link. Firefox 120 introduced the feature in November 2023 as "Copy Link Without Site Tracking", and the current English label is Copy Clean Link. It cleans the link you copy, not the links already saved in your notes.

A browser cleans a link on its way out. A note keeps it exactly as it came in — so the cleaning is yours.

mnmnote.com keeps your notes as open Markdown on your own device — plain text where every URL you pasted stays visible, and yours to edit.