A site can combine many ordinary device and browser signals into a probabilistic identifier. The best defense is built-in normalization, not making your setup uniquely strange.
Many shared URLs contain campaign and click identifiers after the useful address. Strip known tracking parameters carefully, then verify the cleaned link still opens the same page.
