Nobody on your team typed it
If _gl has started showing up on your own URLs, Google's tag put it there, at the moment a visitor clicked a link to another domain you set up for cross-domain measurement. Google's developer guide shows the shape as ?_gl=1~abcde5~, and its Analytics help shows ?_gl=1*abcde5*. The value carries the first-party measurement cookies from the site the visitor just left. The tag on the next domain stores them, so Google Analytics counts one user and one session instead of two of each.
Google says cross-domain measurement works for all its products, Google Analytics and Google Ads conversion measurement included. In GA4 it is switched on under Admin, in the web stream's Configure your domains setting. In Tag Manager, the Conversion Linker tag adds it to any link pointing at a domain listed in Auto Link Domains.
A saved copy has already expired
Google's guide says linker parameters expire after two minutes, which is why the tag adds _gl at the click instead of writing it into the page ahead of time. The value in last week's bookmark is long dead. Strip it before you share the link.
Where it goes missing
A redirect on the destination page can drop _gl before the tag reads it, which Google says "usually happens too quickly to observe by eye". The fix is to keep the parameter through the redirect. Google also says the process cannot work properly when navigation is triggered by JavaScript instead of a user's click, or when another script stops the click with stopPropagation(). Forms need decorate_forms set to true, which is off by default.
With url_position set to fragment, the value sits after a hash (#_gl=), so a clean-up script that only reads the query string will miss it.
What stripping it costs
Nothing changes for the visitor. The site owner pays: without _gl, each domain sets new cookies with new IDs, and Google Analytics counts one person as two users. Older analytics.js setups did the same job with a parameter called _ga. Google Ads' own click ID is a separate parameter, gclid.