Compliance brief
Built to the Google Ads Transparent Click Tracker guidelines.
Since 2023 Google only allows certified click trackers in Google Ads URLs and re-opens the certification form each year from September 1 to November 30. Non-compliant trackers are decertified and ads using them are disapproved. This page maps every published requirement to how WhichClick implements it.
Requirement matrix
Requirement → implementation.
| Google requirement | WhichClick implementation |
|---|---|
| Visible query parameter indicating the next immediate hop | Every WhichClick URL carries url=. The value may be URL-encoded (up to triple escaping is unwrapped). |
| Transparency parameter functional on all paths used in Google Ads | There is a single redirect path, /c/{slug}. No alternative paths exist that could bypass the parameter. |
| Redirect must follow the parameter, not a backend-configured target | With force_transparent=true the stored default destination is ignored. Without a url value the request is rejected with HTTP 400. |
| No unspecified intermediate click-tracking domains | The tracker answers with one 302 straight to the landing page. Nested trackers are only supported when the customer confirms they are certified. |
| Only non-foreign parameters may be appended | The engine appends a single first-party identifier (wc_click_id). UTM, affiliate or partner parameters are never injected. A self-test proves this on every deploy. |
| Subdomains via CNAME to a certified domain need no separate certification | Customers CNAME go.brand.com → WhichClick. Domain verification requires the subdomain to belong to the final-URL domain. |
| Consistent behaviour in browser and automated inspection | No user-agent sniffing, no cloaking, no JavaScript. HEAD and GET return identical redirect semantics. |
| Privacy policy covering tracking activity | Our privacy policy documents precisely what is collected per click, retention windows and IP hashing. |
What the redirect does
- Reads `url` (or `u`, `redirect`, `dest`) and unwraps escaping.
- Validates an absolute http(s) URL.
- Appends `wc_click_id` if absent.
- Responds 302 with `Cache-Control: no-store`.
- Persists the click asynchronously.
What it never does
- Redirect to a destination that is not in the visible parameter.
- Chain through another domain we do not own.
- Add UTM, affiliate, sub-id or partner parameters.
- Serve HTML, JavaScript, interstitials or cookies on the redirect.
- Vary behaviour by user agent, IP or referrer.
Certification support
We prepare your application with you.
The Google form asks for company details, a privacy policy that covers tracking, every domain to certify and a live example URL. The dashboard generates all of it and runs a transparency self-test identical to Google's review criteria.