The third party can still see which users decode the exact same string, thus derive relationship networks. (If i regularily share links to my friends they all resolve it at the third party to te "canonical" form, that third party then knows that all those are my friends)

Assuming you can even decode it. Could just be an encrypted string.

It doesn't even need to be that. If I were facebook, that string would just be an index in some internal Facebook key-value store.