Compliance checklist
Self-test to run before submitting a tracking domain to Google's certified click tracker list, and what each check proves.
Updated 2026-09-02
Run these checks from the Compliance page or with curl. All must pass on every tracking domain you submit.
Checks#
| # | Check | Request | Expected |
|---|---|---|---|
| 1 | Transparent redirect | /c/{slug}?url=<escaped>&force_transparent=true | 302, Location = url + wc_click_id |
| 2 | Double-encoded url | url={lpurl+2} equivalent | Same Location as check 1 |
| 3 | Triple-encoded url | url={lpurl+3} equivalent | Same Location as check 1 |
| 4 | Forced without url | /c/{slug}?force_transparent=true | 400 |
| 5 | Alias parameters | u= / redirect= / dest= | 302 to the alias value |
| 6 | No foreign params | Landing page contains ?a=1 | Location contains a=1 and wc_click_id only |
| 7 | Unsafe scheme | url=javascript:alert(1) | 400 |
| 8 | Hostname binding | Same slug on another host | 404 |
| 9 | No cookies / body | Any redirect | No Set-Cookie, empty body, Cache-Control: no-store |
| 10 | Single hop | Any redirect | Location is the landing page, not another tracker |
| 11 | Parallel tracking | Template fetched without a browser (no cookies, HEAD) | 302, click recorded with transparentParamPresent=true |
| 12 | Bot handling | Googlebot UA | 302 (never blocked), click flagged isBot |
D=https://go.yourbrand.com/c/brand-search
L=$(python3 -c 'import urllib.parse;print(urllib.parse.quote("https://yourbrand.com/?a=1",safe=""))')
curl -sI "$D?url=$L&force_transparent=true" | grep -i location
curl -s -o /dev/null -w "%{http_code}\n" "$D?force_transparent=true" # 400
curl -s -o /dev/null -w "%{http_code}\n" "$D?url=javascript:alert(1)&force_transparent=true" # 400Policy items to confirm before applying#
- The tracker is never used as a final URL.
- Only
wc_click_id(or your configured name) is appended;utm_*, affiliate and fbclid parameters are never added by the tracker. - Landing pages are your own or your client's; no cloaking, no geo-dependent destination switching on Google traffic (smart-link rules do not apply when a visible
url=is present). - Data retention and the privacy notice cover click-level data; see Privacy and the DPA.
Submitting#
Applications are open 1 September – 30 November each year via Google's certified click tracker form. Provide the tracking domain(s), a sample template and the self-test output. WhichClick keeps a compliance log per domain that you can export as evidence.