On this page
GCLID, the Google Click Identifier, is a URL parameter Google Ads adds to each ad click so a later conversion can be tied to that click and its campaign. GBRAID and WBRAID are Google's click parameters for some iOS traffic, and fbclid is Meta's click ID. On a healthcare site, keep the click ID with the outcome, never with health details. Curve Compliance, which keeps the ad click attached when a patient leaves your site to book, under a BAA it signs on every plan, checked Google's and Meta's own documentation for this guide on November 2, 2026.
Book a call. Losing the ad click when patients book on another site? Curve Compliance keeps ad attribution when a patient leaves to book in IntakeQ, Calendly, Acuity, Jane App and other schedulers, credits each booking to the original ad click and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What GCLID is
Google's definition reads: “Google Click ID (GCLID) is a URL parameter passed with ad clicks. This parameter identifies the campaign along with other attributes of the click associated with the ad for ad tracking and campaign attribution.” Google adds: “In Google Ads, this is activated by turning on the auto-tagging setting. It's required for Google Ads website conversion tracking” (Google).
Google's own example: if someone clicks your ad for www.example.com, “the final URL will look like www.example.com/?gclid=123xyz” (Google). The value is a code. It names no person and no condition, but it points to one click on one ad, and that is what lets a booking made days later be credited to the right campaign.
GBRAID and WBRAID
Google's Ads API documentation defines the click identifiers it accepts for conversions, including the two for iOS (Google Ads API). Meta's click ID is in the last row:
| Click ID | Platform | When it appears | Source |
|---|---|---|---|
| gclid | Google Ads | “GCLIDs are identifiers that are captured from URL parameters when an individual clicks on your ad and navigates to your website.” | Google Ads API |
| gbraid | Google Ads | “A gbraid is a URL parameter that is present when a user clicks on an ad on the web and is directed to your iOS app.” | Google Ads API |
| wbraid | Google Ads | “A wbraid is a URL parameter that is present when a user clicks on an ad in an iOS app and is directed to your webpage.” | Google Ads API |
| fbclid | Meta (Facebook and Instagram) | “ClickID is a Meta-generated parameter that is passed with the URL of an advertiser's website when a user clicks an ad on Facebook and/or Instagram.” | Meta for Developers |
For a clinic website, the wbraid case is the one to know: a click on an ad inside an iOS app that lands on your web page. Google's reference describes gbraid as “The URL parameter for clicks associated with app conversions” and wbraid as “The URL parameter for clicks associated with web conversions” (Google Ads API). One limit matters for uploads: “Google Ads does not support custom conversion variables when wbraid or gbraid is used without a gclid” (Google Ads API).
fbclid and other click IDs
Meta's example URL ends in ?fbclid= followed by a long code. Meta's advice is to read it on your server: “Whenever present in the URL query parameters, try to obtain the parameter server-side by reading it from the HTTP request URL's query string.” It also warns that the “ClickID value is case sensitive” (Meta). Other ad platforms add their own click IDs to ad links. The rule is the same for all of them: the ID identifies a click, so treat it as an identifier.
How auto-tagging works
- It is on by default for new accounts. Google says “Auto-tagging is now on by default for new accounts” (Google).
- You can check it in your account. In Google Ads, open Admin, then Account settings, then the Auto-tagging section, where the box reads “Tag the URL that people click through from my ad” (Google).
- Redirects can drop it. Google says “If your website uses redirects, it's also important to make sure the GCLID is passed to the final landing page in order to track conversions” (Google).
- Some sites reject it. Google notes that “A small percentage of websites don't allow arbitrary URL parameters and serve an error page when auto-tagging is turned on” (Google).
- It can start at the impression. Google says “Sometimes the GCLID is created at the time of an impression, rather than a click” (Google).
If a Google Analytics tag is on the page, Google says the GCLID “is stored in a new Google Analytics cookie on your site's domain” (Google). On a health site, that is one more reason to know which Google tags load on which pages; see Google Tag Assistant on a healthcare website.
Is a click ID PHI?
On its own, a click ID is a code, not health information. HIPAA's de-identification rule treats codes like it as identifiers, though: the Safe Harbor method removes “Any other unique identifying number, characteristic, or code” (45 CFR 164.514(b)(2)). HHS's tracking guidance names “any unique identifying code” among the details tracking can disclose, and says “IIHI collected on a regulated entity's website or mobile app generally is PHI” (HHS).
So the question is what travels with the click ID. A gclid sent with a neutral event such as event_4 tells Google that a click led to a conversion. The same gclid sent with a page title naming a condition, a form answer or a visit reason joins an identifier to health information. HHS's page also notes that a federal court vacated part of its bulletin on June 20, 2024: the part about connecting an IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers (HHS). Which rules apply to your pages depends on your setup, so talk to your counsel.
For the full identifier list, see the 18 HIPAA identifiers on a website. For UTMs, which sit next to click IDs in the same URL, see UTM parameters and PHI and the UTM builder.
Keeping click IDs through forms and bookings
A click ID only helps if it is still attached when the outcome happens. Three places lose it:
- Redirects. A redirect that drops URL parameters loses the GCLID before your page loads.
- Forms. If the form does not capture the click ID with the submission, the lead arrives without its ad.
- Schedulers on another site. When a visitor moves to a booking tool on another domain, the click ID and UTMs stay behind, so the booking can't be credited to the ad.
Curve Compliance handles the last two. Every lead from Curve Forms arrives in the Leads inbox with its answers, UTMs and ad click ID. For schedulers, “Curve Compliance hands the scheduler a bridge token, a short reference to the visit's ad attribution, and credits the booking to the original ad click when the booking comes back. Bookings made days later still match” (booked appointment attribution). If your bookings happen off your site, book a call and Curve's team will set it up.
Uploading offline conversions with click IDs
Google's offline import starts with the click ID: “To track offline conversions from clicks, you'll save these IDs along with whatever lead information you collect from the person who clicked your ad.” When the person converts, “you give that GCLID back to Google Ads along with a few details about the type of conversion it was and when it happened” (Google). The upload's click fields take a gclid, gbraid or wbraid, described as “Click identifiers captured from the landing page URL” (Google Ads API).
Google says offline conversion imports move to the Data Manager API and are blocked in the Google Ads API starting June 15, 2026 (Google). Whatever route you use, the upload should carry the click ID, the conversion name, the time and, if you bid on value, a stage-level value. It should not carry the reason for the visit. See conversion values for clinics, what a healthcare CRM does and offline conversion import for clinics.
How Curve Compliance helps
Curve Compliance keeps the ad click attached from the first page view to the outcome. It keeps ad attribution when a patient leaves to book in IntakeQ, Calendly, Acuity, Jane App, OptiMantra, Boulevard, Zocdoc, Mindbody, Vagaro, Square, Setmore and Booker, and bookings made days later still match. Every Curve Forms lead arrives with its UTMs and ad click ID. Curve receives outcomes from CRMs, booking systems and call tracking through incoming webhooks and from offline conversion uploads, then credits each to the original ad click.
Conversions go to Google Ads, Meta, TikTok, Microsoft Advertising and LinkedIn server-side. Each platform receives only a fixed list of fields, events can use neutral names, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve strips PHI before data reaches an ad platform. Event Logs show what Curve sent and what each platform accepted. Curve is SOC 2 Type II, signs a BAA on every plan and does the setup, typically live in about a week.
Sources, checked November 2, 2026: Google Ads Help, Google Click Identifier (GCLID); Google Ads Help, About auto-tagging; Google Ads Help, About offline conversion imports; Google Ads API, Manage offline conversions; Google Ads API, ClickConversion; Meta for Developers, ClickID and the fbp and fbc Parameters; 45 CFR 164.514; HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
What is GCLID?
GCLID, the Google Click Identifier, is a URL parameter Google Ads adds to each ad click when auto-tagging is on, so a later conversion can be tied to that click and its campaign (Google). On a healthcare site, keep it with neutral conversion events, never with health details.
What does GCLID do?
It identifies the campaign and other attributes of the click, and Google says it is “required for Google Ads website conversion tracking” (Google). It also lets you upload offline conversions, such as booked or attended visits, against the original click.
Can I see GCLID in Google Ads?
Yes. Google's auto-tagging help refers to a click view report in which clicks are listed by GCLID row (Google). You can also see it in your landing page URLs as ?gclid= followed by a code.
What is the difference between GBRAID and GCLID?
A GCLID is captured when someone clicks your ad and lands on your website. Google says a gbraid is present when a user clicks an ad on the web and is sent to your iOS app, and a wbraid when a user clicks an ad in an iOS app and lands on your web page (Google Ads API).
Are click IDs like gclid PHI?
It can be. HIPAA's Safe Harbor list includes “Any other unique identifying number, characteristic, or code” (45 CFR 164.514), and HHS lists “any unique identifying code” among the details tracking on a regulated entity's site can disclose (HHS). Whether a given click ID is PHI depends on where it was collected and what travels with it, so send click IDs only with neutral events.
How do I keep the click ID when a patient books on another site?
The scheduler needs a way to carry the visit's attribution and report the booking back. Curve Compliance hands the scheduler a bridge token and credits the booking to the original ad click when it comes back, even days later (how it works).
What is fbclid?
fbclid is Meta's click ID, which Meta describes as “a Meta-generated parameter that is passed with the URL of an advertiser's website when a user clicks an ad on Facebook and/or Instagram” (Meta). Meta says to read it server-side from the page URL and not to change its case.
Talk to Curve Compliance
Book a call. Want every booking credited to the ad click that started it? Curve Compliance keeps the click attached through forms and schedulers, sends neutral conversions server-side, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.