Build per-user referral URLs with attribution parameters. Hash the user ID before exposing if it's sensitive.
https://example.com/signup?ref=user_abc123&utm_source=referral