Can't the tracking information just be stuck in the actual URL itself? Even in the domain name? So instead of amazon.de/product?affilate=hamhamed it would be something like hamhamed.amazon.de/product?
And if that won't work, just encode the entire url as amazon.de/2ec1a277-0c96-40d3-8fe1-e418fd82986d
Since Apple has access to everyone's emails, they could see that the same email has a unique link in every email and show the user some kind of warning like "This link has a unique tracking ID, do you want to proceed?"
Puts the information and power back in the users hands.
And if that won't work, just encode the entire url as amazon.de/2ec1a277-0c96-40d3-8fe1-e418fd82986d