Transparency & certification

Google Ads accepts third-party click trackers in tracking templates only if they are transparent, and accounts that started using click trackers after 28 August 2023 may only use trackers Google has certified. TrackCrown is operated by Web Cue LLC, which applies for certification of its tracking domains. Questions or reports about a tracking link: https://www.trackcrown.com/contact.

What Google requires#

1. The immediate next hop of every click is in a visible query parameter of the tracking URL.
2. The server follows that parameter instead of a destination configured on the server, on every URL path used in Google Ads.
3. No unspecified intermediate hops — only a same-host HTTP → HTTPS upgrade is tolerated.
4. Only the tracker's own, declared parameters may be added — never "foreign" ones such as UTM tags or partner sub IDs.
5. The tracker may refuse unexpected targets server-side, but never divert them elsewhere.
6. Every nested tracker in the chain must be certified too.

What TrackCrown guarantees#

For every request that carries url= — on /c/, and on /r/, /click and /s/ links when url= is present:

1. The next hop is visible. url= (encoded or not) is the next hop. The optional secondary parameter force_transparent=true may precede it; it is accepted, ignored and never forwarded.
2. The server follows it. The answer is one 302 whose Location is exactly that URL.
3. No extra hops. No intermediate redirect, JavaScript or meta refresh; the 302 has an empty body and Cache-Control: no-store. http:// requests on a tracking domain get a 308 to the same URI on https://.
4. Nothing foreign is added. The only changes are macros you placed inside the URL yourself ({click_id}, {transaction_id}, {aff_id}, {offer_id}, {sub1}–{sub10}, {source_id}) and, when Append the click ID to transparent redirects is on, your click-ID parameter. Nothing is removed, reordered or re-encoded; HTTP is not upgraded to HTTPS.
5. No conditional destinations. The destination never depends on bots, reviewers, country, device, IP address or time. Caps, targeting, paused offers, inactive partners and traffic controls are recorded on the click (status reasons cap_over, targeting, paused, not_approved, workspace_inactive) but do not change where it goes. Fraud signals are flags only.
6. Refuse, never divert. An invalid URL, a host that is not allowed, or a host Google Web Risk lists as malware, social engineering or unwanted software gets an HTML error page — never a redirect elsewhere.
7. No cookies. Transparent redirects never set or require a cookie.
8. Same answer for every method. GET, HEAD and POST receive the identical redirect; other methods get 405 without a Location.
9. Parallel tracking works. https://google.com/asnc/… and https://www.google.com/asnc/… are always followed — see Parallel tracking.
10. Deleted links fail open. An unknown link key with url= still redirects when the target is the asnc endpoint or allowed by one of the brand's active workspaces (status reason unknown_link); otherwise it answers the 404 page.

Responses#

GET /c/demo?gclid=abc&force_transparent=true&url=https%3A%2F%2Fshop.example.com%2Fsale%3Fcolor%3Dred HTTP/1.1
Host: trackcrown.com

HTTP/1.1 302 Found
Location: https://shop.example.com/sale?color=red
Cache-Control: no-store
Referrer-Policy: no-referrer-when-downgrade

The allowlist and the decoding of url= are described in Set up Google Ads tracking (step 2) and the ValueTrack reference.

Certification status of a domain#

Each tracking domain has a status, shown on Tracking domains and in the template builder:

The operator records the status; nothing in TrackCrown claims certification before Google confirms it. The marketing site calls domains "certified" only when they are marked certified.

CNAME subdomains. A subdomain on the advertiser's own final-URL domain that points to a certified tracking domain with a CNAME (for example track.yourshop.com → trackcrown.com) needs no separate certification. Add it on Tracking domains as type Advertiser CNAME (Advertiser CNAME tracking domains).

Nested trackers. If your final URL redirects through another tracker (an affiliate network, a second tracker), that tracker must be certified as well. The tester's full-chain mode and the simulator flag such hops.

The certification kit (platform operators)#

Platform admins prepare the application under Platform admin → Certification (/admin/certification), per brand:

• Window countdown — Google accepts applications from 1 September to 30 November.
• Applicant & mailboxes — the applicant e-mail must be on the brand's own domain; the page checks its MX records (re-checked hourly) and sends a test e-mail to each mailbox.
• Readiness — <brand> — live checks per tracking domain: DNS points to this platform, HTTPS reachable, TLS certificate valid for more than 14 days, Root information page names the legal entity, Privacy policy page is live, Transparency test (single 302 to url=), Parallel-tracking substitute (google.com/asnc) → 302, POST request → identical 302, Live example URL, Certification status.
• Domain ownership & certificates — an RDAP lookup per domain (registrar, registrant, dates, TLS expiry) and an upload for the registrar receipt when the registrant is redacted.
• Example live URL and Application answers — copy-paste values for Google's form (company, website, contact, privacy policy, domains, example URL, next-hop parameter url, secondary parameter force_transparent=true, the non-foreign click-ID parameters, the service description and the statement on intermediate hops).
• Submission log — record each submission and Google's decision; the domains' statuses follow it. Individual domains can also be changed under Platform admin → Domains → Certification….
• Domains added since certification — generates the answers for Google's "New Click Tracker domains" form.
• Export .md — the whole kit as a Markdown file.

The cert-check suite#

Operators can run the same checks Google's reviewers do against a live host from the repository:

bash scripts/cert-check/cert-check.sh -r <offer>/<affiliate> -s <smartlink> \
  trackcrown.com <workspace slug> https://www.<allowlisted-landing>/

It prints a PASS/FAIL table and exits 1 on any failure: TLS (valid chain, more than 14 days left, TLS 1.2+), HTTP → HTTPS, root and privacy pages naming the entity, robots.txt not blocking AdsBot, one 302 with a byte-equal Location for every {lpurl} form and landing-page variant, the asnc endpoint on every path, GET/HEAD/POST, seven user agents, no Set-Cookie, Cache-Control: no-store, refusals without Location, 405 for other methods, only the click-ID parameter added, force_transparent handling, fragments, long URLs and latency (p95 under 300 ms over 20 requests). Options: --allow-missing (report NEEDS-URL when no landing page is given), --base, --entity, --blocked-url, --click-id-param, --latency-n, --latency-max, -v. Its requests are ordinary clicks of that workspace.

Tracking-domain pages#

The root page of every tracking domain says that it is a click-tracking domain operated by Web Cue LLC, what data is collected and how to reach us, and links to the privacy policy and terms; /privacy and /terms are served on the tracking domain as well. robots.txt asks general crawlers to stay away but has no rule for Google's AdsBot, which crawls through tracking templates to check landing pages.

Continuous monitoring#

• Compliance probes request live links on every active tracking domain every 5 minutes — /c, /r and /s, with an allowlisted target and the asnc endpoint, GET/HEAD/POST and several user agents — and alert on any Location that differs from the target, a missing redirect, a Set-Cookie or a slow answer. Probe requests are signed and stored as test clicks (excluded from reports, billing and caps), and receive a byte-identical response.
• Certificates are checked hourly, with alerts 21 and 7 days before expiry.
• Domain reputation is checked hourly against Google Web Risk, Spamhaus DBL and SURBL.

Failures open incidents on Domain health (/admin/domains/health) and are e-mailed to platform admins.