What Is a Tracking Link? How Affiliate Links Track Clicks

What is a tracking link?

A tracking link is a URL that sends a visitor through a tracking server before the destination page, so the click can be recorded and later matched to a sale, sign-up, or install. The tracker logs who sent the click (an affiliate or publisher ID), which offer it was for, and any sub IDs you added, then creates a unique click ID and redirects the visitor to the advertiser with that ID in the URL. When the visitor converts, the advertiser sends the click ID back, and the network knows exactly which click and which partner earned the commission.

Every affiliate network, CPA network, and offerwall works this way, even when the link looks like a plain web address.

Anatomy of a tracking link, with an example

Here is a made-up affiliate tracking link of the kind a network gives a partner. The domain and values are examples only.

https://track.example-network.com/click?offer_id=1042&aff_id=318&sub1=blog&sub2=review-page&sub3=oct-email

After the click, the tracker redirects the visitor to something like this:

https://advertiser.example.com/signup?click_id=8f3a2c91d4e0b7a6&utm_source=example-network&utm_medium=affiliate

The advertiser’s tracking template told the network where to put the click ID, usually with a macro such as {click_id} that the tracker fills in. The UTM tags are optional and only feed the advertiser’s own analytics. Parameter names differ between platforms (cid, transaction_id, aff_sub), but the jobs are the same. For a deeper look at the two kinds of IDs, read click IDs and sub IDs explained.

What happens when someone clicks a tracking link

The visitor only sees the final page, but several things happen first.

1. The browser requests the tracking URL. The tracking server reads the offer ID, partner ID, and sub IDs, plus request details such as IP address, user agent, and time.
2. The tracker checks the click. Is the offer live? Is the visitor’s country and device allowed? Is the click a duplicate or from a blocked network? A click that fails can be sent to a fallback page instead of the offer.
3. The tracker creates a click ID and stores it. The click ID is saved in the network’s database with everything it learned, so the click can be found again later.
4. The tracker redirects. It answers with an HTTP redirect, usually a 302, whose Location header is the advertiser URL with the click ID filled in. Some setups add more hops, for example a second tracker run by the advertiser.
5. The advertiser keeps the click ID. Its landing page or server saves the value with the visitor’s session, and then with the new account or order.

MDN’s guide to redirections in HTTP explains the redirect codes: 301 and 308 are permanent, 302, 303, and 307 are temporary. Trackers use temporary redirects because the same link must be counted every time, and a browser may remember a permanent redirect and skip the tracker on the next visit. The same guide notes that every redirect adds an extra round trip, which is why long chains lose visitors on slow mobile connections.

Cookie-based vs server-side tracking

There are two ways to remember the click until the conversion happens.

Most networks now settle payouts on server-side tracking and keep pixels as a backup. Postback vs pixel tracking compares the two in detail, and what is server-to-server tracking? covers the S2S basics.

How the conversion ties back to the click

The other half of the system is the conversion report that carries the click ID home. With server-side tracking:

1. The visitor signs up, buys, or reaches the in-app event the offer pays for, maybe minutes later, maybe days later.
2. The advertiser’s server looks up the click ID it saved for that user and calls the network’s postback URL, for example https://track.example-network.com/postback?click_id=8f3a2c91d4e0b7a6&event=signup.
3. The network finds the click, checks that it falls inside the offer’s conversion window and has not been reported before, and records the conversion against the partner and sub IDs saved with the click.
4. The network then sends its own postback to the partner, with the payout and the sub IDs, so the partner’s reports or user balances update too.

This is why a click ID must be unique and must survive the trip intact: it is the only key that connects the two halves. A postback without a valid click ID cannot be paid. The format, macros, and statuses of these calls are covered in what is a postback URL?, and the checks that stop forged calls in postback security.

UTM parameters vs affiliate tracking parameters

UTM tags and affiliate parameters often sit in the same URL, so they get confused. They answer different questions for different people.

Ad platforms add their own click IDs as well. Google Ads’ auto-tagging help page describes the GCLID, a Google Click Identifier added to the landing page URL, such as ?gclid=123xyz. It plays the same role as a network’s click ID, but inside Google’s own measurement. If you want the naming rules and pitfalls for UTMs, see UTM parameters explained.

Link cloaking, shorteners, and why networks restrict them

Raw tracking links are long and full of IDs, so many partners hide them. There are two common ways:

• Link cloaking (pretty links). A link on your own domain, such as yoursite.com/go/budget-app, that redirects to the tracking link. It looks cleaner, lets you swap the offer in one place, and is common on blogs.
• URL shorteners. A third-party short link that redirects to the tracking link. Handy on social media, but it adds a hop you do not control.

A simple redirect on your own domain to a disclosed affiliate link is a convenience. The word “cloaking” is also used for something very different: showing reviewers, ad platforms, or search engines one page and real visitors another. That is what the rules target. Google’s Circumventing systems policy for Google Ads says cloaking is not allowed and that using appropriate click trackers and redirects is okay as long as they are not used to hide content that breaks the policies. Google’s search spam policies define cloaking as presenting different content to users and search engines, and treat paid links as fine only when they carry rel="sponsored" or rel="nofollow" (checked on October 22, 2026).

Networks and advertisers restrict cloaking and shorteners for practical reasons too:

• They cannot see or review where the traffic really comes from, so brand bidding, spam, or banned placements are harder to catch.
• A hidden redirect can be used for cookie stuffing, dropping tracking cookies on people who never clicked.
• Every extra hop is another place where parameters can be dropped.

Tracking links and browser privacy features

Browsers now limit tracking that follows people across sites, and tracking links are in scope (checked on October 22, 2026):

• Safari Link Tracking Protection. Apple’s June 2023 privacy announcement says tracking information some sites add to URLs is removed from links shared in Messages and Mail and from links in Safari Private Browsing. WebKit’s Private Browsing 2.0 post explains that Safari removes a subset of query parameters identified as used for cross-site tracking before the navigation, and lets campaign parameters used for attribution pass through. Apple does not publish the list of removed parameters.
• Safari cookie limits. WebKit’s Tracking Prevention page says that when Intelligent Tracking Prevention detects link decoration such as a click ID, it caps cookies created in JavaScript on the landing page to 24 hours. A click ID kept only in such a cookie can be gone before a slow conversion happens.
• Firefox query stripping. Mozilla’s Enhanced Tracking Protection matrix lists Query Parameter Stripping as off in Standard mode and on in Strict mode, for normal and private windows.
• Referrer trimming. MDN’s Referrer-Policy reference says the default policy, strict-origin-when-cross-origin, sends only the origin on cross-origin requests, not the path or query. Never rely on the referrer to identify a page or a partner.

The practical answer is the same in every case: save the click ID on the server at the first chance, tie it to the user’s account or order, and report the conversion by postback. Test your own links in Safari Private Browsing and in a link sent through Messages or Mail to see what arrives. A click ID is also an online identifier, so treat it as personal data where the law does, and never put emails or names in a link.

Common ways tracking links break

When conversions go missing, the cause is usually one of these:

• A redirect drops the query string. A move from http to https, a www redirect, or a language redirect on the advertiser’s site rebuilds the URL without the click ID.
• An unfilled macro. If the advertiser sees click_id={click_id} or click_id= in their logs, the macro name does not match the tracker’s.
• Broken encoding. An unencoded &, #, space, or + in a sub ID cuts the value short or creates a new parameter. A # is never sent to the server at all.
• The click ID is overwritten. The visitor browses a few pages, a second tracker or a page reload stores a new value, and the conversion is reported with the wrong ID or none.
• The click ID is kept only in the browser. A cookie set by script, a short session, or a switch from the phone to a laptop loses it before the conversion.
• App store handoffs. A web link to an app store does not carry query parameters into the installed app. App offers need the store’s referrer, a deep link, or a mobile measurement partner.
• Too many hops. A shortener, then a cloaked link, then two trackers. Each hop adds delay and another chance to lose a parameter, and in-app browsers make it worse.
• The postback never fires or is rejected. Wrong postback URL, a firewall blocking the network, a failed signature check, or a conversion sent after the window closed.

To test, click your own link in a private window, follow every hop in the browser’s network panel, and confirm that the final URL still has the click ID. Then run a test conversion and check that it shows up in both sides’ reports with the same ID.

Tracking links on an offerwall

On an offerwall, the publisher never handles single tracking links. Users open one wall link carrying their user ID and any sub IDs, and the wall builds the tracking link for each offer a user starts. When the advertiser reports the conversion, the network sends a postback to the publisher’s server so the user’s balance updates. What is an affiliate network? covers the roles, and offerwall vs affiliate links compares running one wall with placing single links yourself.

Frequently asked questions