This number doesn't necessarily have to remain 6 bits but note that if it got up to 32 bits it would be enough to contain a unique user ID (or even a unique ID for a specific click) which removes all privacy benefits.