What gbraid actually is
gbraid is a privacy-preserving parameter Google Ads appends to a landing page URL to measure conversions that happen inside an app, for ad clicks on iOS where Apple's App Tracking Transparency rules block a normal per-user identifier. It is not a blanket replacement for gclid everywhere gclid used to appear; it exists specifically for Search, Shopping, Display and Performance Max campaigns driving people toward app engagement rather than a website conversion, and Google auto-tags it onto eligible iOS clicks the same way it auto-tags gclid.
The privacy design shows up in what the value can do. Google's own documentation describes gbraid as measuring conversions in an aggregated, non-unique way, closer to a campaign identifier than a per-person one, rather than tying a value back to one specific individual or event the way gclid does.
gbraid versus wbraid: not interchangeable
Both appeared for the same reason, Apple's tracking restrictions took gclid away from a slice of iOS traffic, and both are easy to assume are the same thing wearing two names. They are not. gbraid is tied to app conversions: the ad interaction leads toward an app install or an action inside an app. wbraid is tied to website conversions on iOS traffic in the same restricted category, where the click still leads to a page you own and the conversion is measured with modelling rather than a direct match. See the wbraid page for that side. A URL carries one or the other depending on where the conversion is expected to happen, never both, and the distinction matters when reconciling Google Ads reporting against your own analytics: a gbraid-tagged click that never shows a matching website session isn't a tracking failure, it was never expected to convert on the web in the first place.
Is it safe to remove?
Nothing changes for you as a visitor: the page loads the same either way. For the advertiser, gbraid is one of a small number of signals Google has left itself for measuring iOS app campaigns under Apple's restrictions, so stripping it in a redirect or a shared link removes reporting Google can't easily reconstruct from anywhere else. Case matters too: Google's documentation is explicit that the value is case-sensitive and should never be reformatted to upper or lower case, which rules out any well-meaning "clean up this ugly URL" script that lowercases everything by default.