We blocked /folder/ in robots.txt and put nofollow on all links on the user side site.
Google indexed all the URls (about 100 ads from various advertisers) and was listing the /folder/track.php URls in the SERPS.
So, instead of the track.php file returning a 301 header once the information had been logged, it returned a page saying "you are being forwarded" with noindex/nofollow/noarchive meta tags on it, plus a 2 second meta refresh to the advertiser's link. We removed the robots.txt block so Google could see the noindex/nofollow tags.
Now, Google is still indexing the URls but with the information from the final landing pages! When did Google start following meta refreshes?! And how do I stop Google from indexing these tracking URls?
I know that <meta> refreshes were once taboo. Apparently, search engines would sometimes penalize a site for using them because they were used as "sneaky redirects". Then around 2003 or 2004, I was investigating the links for a site and found that the site's original home on a free server had installed a <meta> refresh to the new domain and that both Google and Yahoo! had counted the old links toward the new domain just like a 301 redirect. I soon tried it on a client's site on a IIs server that I couldn't control because they were restructuring (removing <frame>s), and it worked just fine.
Google acknowledged this practice a couple of years ago, but with the development of the rel="canonical" tag, they have been officially discouraging the use of <meta> refresh. But to my knowledge, they haven't changed their handling of them.