Ultimately I don't think they can. How would they handle a link like `https://example.com/password_reset?prid=ZXhhbXBsZWNsaWNraWQ`?

I'm sure somebody will figure out a way to use multiple seemingly-legitimate parameters to get the same result. Why use ?click_id=aqNERjsdfyqe when you can use ?category=10612550&subcategory=5929127&page=4257344 and transfer the same data without arousing suspicion?