How they work, in two lines
You declare the names the form accepts — `campaign`, `channel`, `customer_id` — then send different links: `?campaign=xmas`, `?channel=newsletter`. The value travels with the respondent and becomes a column in the table and the CSV, next to the answers.
They're declared one by one deliberately. A form that accepted any parameter from the URL would let anyone with the link write columns onto your responses, and that has happened to bigger products than this one.
The three uses worth the trouble
Attribution: one link per channel, and afterwards you know which one brought responses instead of assuming. The most common case and the most useful, because the answer usually surprises you.
Personalisation: if you send the link by email, you can put the name in it — `?name=Anna` — and recall it inside the first question. «Hi Anna, two minutes» has a different response rate from «Hi».
Linking to a record you already have: sending `?customer_id=4711` means not asking again who the person is, and being able to join the response to your back office without asking for an email.
What not to do
Never put data in there that you don't want the person to see: the value lives in the URL, so it's visible in the address bar, in history and in any shared screen. «Hidden» means «not asked», not «secret».
And don't use them as authentication. A `?customer_id=4711` can be changed to `4712` by anyone, which only matters if you build something on top that should have been protected. For that you need required login, or the form password.
The fallback when you don't control the link
If the form is embedded in different pages and you can't change the address, attribution happens upstream: a script that reads the host page and appends the parameter to the iframe. If even that isn't possible, a single-choice question — «how did you get here?» — is less precise but honest.
One link per channel, the names declared in the form, and responses arrive already split — no cookies, no extra question.