How Firefox Strips Tracking Parameters From URLs

This article explains how the Mozilla Firefox web browser protects user privacy through its Query Parameter Stripping feature. It covers the function of tracking parameters like fbclid and utm_source, the technical mechanics of how Firefox intercepts and cleans URLs before loading a webpage, how the "Copy Without Site Tracking" tool functions, and how users can enable or customize these protections within the browser.

Understanding URL Tracking Parameters

Uniform Resource Locators (URLs) often contain query parameters—extra information appended to the end of a web address following a question mark (?). While many parameters are necessary for a website to function, such as ?page=2 or ?search=shoes, others are used exclusively for surveillance and analytics.

Companies append identifiers like fbclid (Facebook Click Identifier) or utm_source (Urchin Tracking Module) to links. When you click a link containing these parameters, the destination website reads them to learn where you came from, which specific link you clicked, and sometimes links your activity back to your personal social media or advertising profile.

The Mechanics of Query Parameter Stripping

Firefox neutralizes URL-based tracking by intercepting web requests before they leave the browser. The process happens automatically in milliseconds through the following steps:

  1. URL Interception: When you click a link or enter a web address into the navigation bar, Firefox pauses the network request before contacting the destination server.
  2. Parsing the Query String: The browser separates the base URL from the query string (everything after the ?). It breaks the query string down into individual key-value pairs, which are separated by ampersands (&).
  3. List Matching: Firefox compares the keys (the parameter names) against an internal blocklist of known tracking parameters maintained by Mozilla via its Remote Settings service.
  4. Targeted Removal: If a parameter matches the blocklist, Firefox deletes that specific key-value pair from the URL. It leaves all non-tracking parameters untouched so the website continues to function normally.
  5. Executing the Clean Request: Firefox reconstructs the URL without the tracking code and sends the clean request to the destination server. The server never receives the tracking identifier.

For example, if you click a link structured as https://example.com/?product=123&fbclid=IwAR123xyz, Firefox intercepts it, identifies fbclid as a tracker, strips it out, and loads https://example.com/?product=123 instead.

Firefox handles parameters like fbclid and utm_source slightly differently depending on the action you are taking, to prevent breaking legitimate website analytics while maximizing user privacy.

  • Automatic Navigation Stripping: When you click links to browse the web, Firefox automatically removes parameters that identify individual users across sites, such as fbclid (Facebook), gclid (Google), and msclkid (Microsoft).
  • Copy Without Site Tracking: Parameters like utm_source are generally campaign-level trackers rather than individual user trackers. To strip utm_source and dozens of other marketing parameters, Firefox includes a context-menu feature. When you right-click a link and select "Copy Without Site Tracking," Firefox runs the URL through a much larger, more aggressive blocklist before placing the cleaned link onto your clipboard.

How to Enable and Customize the Feature

By default, automatic Query Parameter Stripping is active in Private Browsing windows. To enable it for all browsing sessions, you must adjust your Enhanced Tracking Protection settings:

  1. Open Firefox and click the menu button in the top-right corner.
  2. Select Settings, then click Privacy & Security on the left sidebar.
  3. Under Enhanced Tracking Protection, select the Strict radio button.

For advanced users who want Firefox to automatically strip utm_source and other custom parameters during regular navigation without using the right-click menu, the blocklist can be manually modified:

  1. Type about:config into the Firefox address bar and press Enter.
  2. Accept the risk warning to proceed.
  3. Search for privacy.query_stripping.strip_list.
  4. Edit the value by typing in the parameters you want to automatically remove, separated by spaces (e.g., utm_source utm_medium utm_campaign).

Once added to this list, Firefox will treat those parameters the exact same way it treats fbclid, removing them automatically whenever a webpage loads.