I completely understand that you append the URL with query strings - namely:
example.com --> example.com/?brand={brand}&model={model}
But who puts the value 'Samsung' in place of {brand}? And when?
There are multiple ways to do it, and libraries that provide this information. I.e. https://github.com/piwik/device-detector and WURFL. I don't know what
Some use user agent, i.e. https://hgoebl.github.io/mobile-detect.js/ Generally your browser reveal a ton of info, and I guess those libraries above patch that together, i.e. user agent+screen size+feature detection+ ??? Carrier can be detected from IP ranges.
This is pretty easy to do ... haha, you and the world would be shocked if they knew just how much information marketers can get about a person just by them clicking on an ad.