102

For two days, I have noticed that the URL that I publish on Facebook, there is a parameter is added:
?fbclid=uFCrBkUgEvKg...
To be more precise something like: http://example.com?fbclid=uFCrBkUgEvKg...

Does anyone know what this parameter does?
What is it for and what is the use of the developers?

Thanks for your comments.

8
  • 6
    To me it just looks like facebook is trying to bypass cookie laws... Part from that... seems no one found any documentation on this tracer... Oct 22, 2018 at 16:28
  • 28
    This behavior is so annoying, it's causing all referral traffic to show as unique urls in my analytics reporting since the query param is different per user. Nov 2, 2018 at 15:45
  • 5
    There's some discussion about fbclid in this HN thread (lots of informative links buried in there somewhere): news.ycombinator.com/item?id=18275061
    – ahiijny
    Nov 3, 2018 at 3:53
  • 11
    I wrote a Chrome extension that removes it. chrome.google.com/webstore/detail/…
    – R OMS
    Dec 15, 2018 at 2:21
  • 2
    I have to kind of take my last comment back. It seems it is not ALWAYS sent. I thought I could rely on it being present - but it isn't there - notably it wasn't there within the Facebook App when I clicked on my ad. Presumably because they can track it themselves without the parameter. So basically don't count on it! Oct 13, 2019 at 2:26

4 Answers 4

35

I know that gclid, is short for (Google Click Identifier)
It's a unique tracking parameter that Google uses to transfer information between your Google Ads account and your Google Analytics account.

Facebook must be doing the same thing or something similar with fbclid to improve tracking analytics systems.

4
  • 44
    while breaking caching worldwide :D at the same time. for many people
    – Luka
    Jan 7, 2019 at 16:58
  • 7
    @Luka - you can still use caching. You just need to exclude fbclid, gclid and utm parameters from your cache :) Plenty of solutions support this.
    – LucasRolff
    Feb 14, 2019 at 5:15
  • 2
    Some caching plugins don't have such option and what they do is actually for each url create separate cache page which equals to no caching (cuz fbclid is never the same). Nginx implementation to remove it is the best. gist.github.com/lynt-smitka/…
    – Luka
    Feb 14, 2019 at 20:47
  • 9
    If the point of this query is to track visitors then should have been stated in docs or in privacy policy. It seems that the fblcid is unique per user. If that is indeed the case there is a huge privacy issue and a GDPR violation.
    – fat_mike
    May 29, 2019 at 22:23
17

This helped me: https://greasyfork.org/en/forum/discussion/44083/fbclid-tracking-parameter-attached-by-facebook

Here is cite from the link:

Put this code in your .htaccess file:

RewriteCond %{QUERY_STRING} "fbclid=" [NC]
RewriteRule (.*) /$1? [R=301,L]

If you work in WordPress:

RewriteEngine On
RewriteBase /
RewriteCond %{QUERY_STRING} "fbclid=" [NC]
RewriteRule (.*) /$1? [R=301,L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
4
  • 3
    Who does not work the options above try using this: RewriteCond %{QUERY_STRING} ^(.*)&?fbclid=[^&]+&?(.*)$ [NC] RewriteRule ^(.*)$ /$1?%1%2 [R=301,L] Oct 25, 2018 at 18:14
  • 9
    The solution in this answer will override your entire query parameters, e.g. everything after '?' will get thrown away. This may break some functionality of webpages that use query parameters. So, make sure this is what you want. Also, look at answers on stackoverflow / serverfault for how to remove specific query parameter. Nov 15, 2018 at 14:13
  • 1
    thanks u save my day
    – sayalok
    Mar 12, 2019 at 17:47
  • 2
    Makes me think all web servers should rewrite to something random and forward a new request to FB's servers ;) Aug 29, 2019 at 2:46
16

As I understand it, the parameter is a means of tracking the site visitor so that if your site includes advertising from Facebook, they can customise it to match the recorded browsing habits of the visitor.

The Apache mod_rewrite solution above is problematic because it strips the entire query string. If the URL already had a query string, this will break it. To strip just the fbclid parameter, it's useful to note that Facebook always appends it to a URL, so it's always last. That simplies the mod_rewrite code a little. This is what I do:

# Strip Facebook spyware tokens
RewriteCond %{REQUEST_METHOD} =GET [NC,OR]
RewriteCond %{REQUEST_METHOD} =HEAD [NC]
RewriteCond %{QUERY_STRING} ^(.*)&?fbclid=[^&]+$ [NC]
RewriteRule ^/?(.*)$ /$1?%1 [NE,L,R=301,E=limitcache:1]
Header always set Cache-Control "max-age=604800" env=limitcache

The E=limitcache:1 flag and Header directive is to limit how long the 301 redirect is cached. By default many browsers cache it literally forever. This reduces that to one week (or 604,800 seconds). I may be in a minority in thinking this, but that seems good practice to me. I don't know how long fbclid tokens persist, but if they're long-lasting, it means Facebook will be directing visitors to the same URLs for a long time, and if you ever want to support Facebook's targeted adverts, or if they start using the fbclid for other functionality that you need, you may find these permanently-cached redirects come back to bite. But if you're willing to risk it, you can delete both the Header directive and the E=limitcache:1 flag.

The two tests of %{REQUEST_METHOD} are to prevent Apache from redirecting POST requests (or more esoteric requests like PUT or DELETE, if they're relevant). Most browsers change the request to be a GET requests on a 301 or 302 redirect, which is explicitly allowed by RFC 7231. There is a new 308 redirect code must not have its method rewritten, but unfortunately it's not supported by Internet Explorer on Windows 7 (and probably never will be).

1
  • Don't contribute to mass surveillance. Remove that Header line if you use this, you're not gonna want to make use of the fbclid. Funny that "permanent" redirects can have an expiry date, but that's the organic nature of the web for you. :-)
    – clacke
    Mar 11, 2019 at 19:33
13

Another approach, how to remove this parameter (so your users can share your URL without removing it manually) is to use JavaScript and history.replaceState.

All credits go to original author - https://www.michalspacek.cz/zmena-url-a-skryvani-fbclid-pomoci-javascriptu

Code from link:

(function() {
        var param = 'fbclid';
        if (location.search.indexOf(param + '=') !== -1) {
                var replace = '';
                try {
                        var url = new URL(location);
                        url.searchParams.delete(param);
                        replace = url.href;
                } catch (ex) {
                        var regExp = new RegExp('[?&]' + param + '=.*$');
                        replace = location.search.replace(regExp, '');
                        replace = location.pathname + replace + location.hash;
                }
                history.replaceState(null, '', replace);
        }
})();
1
  • one liner to remove everything: history.replaceState(null, '',location.origin+location.pathname)
    – Zibri
    May 9, 2019 at 14:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.