Security and your data

Do you detect personal data (PII) in my GA4? What do you do with it?

The audit detects the risk of personal data (PII) leaking into GA4 - e.g. emails in URLs - strictly as a signal: the report flags the problem, copies no data, and the fix stays on your side.

2 min read

Yes - detecting the risk of personal data leaking into GA4 is one of the checkpoints in the privacy category. And it's a checkpoint where it's especially important to understand how we operate: strictly as a signal.

What the PII problem in GA4 is about

Google Analytics' terms prohibit sending personally identifiable information (PII) into GA4: email addresses, names, phone numbers. Yet leaks happen all the time - usually unknowingly:

•an email in the URL - e.g. a form passing the address as a parameter (/thank-you?email=jan@company.com); GA4 records full URLs, so the address ends up in the reports,
•data in event parameters - custom events passing e.g. a customer's name,
•identifiers in paths - e.g. /account/jan.kowalski/orders.

The consequences are serious: a breach of Google's terms (up to and including property termination), a GDPR problem, and personal data scattered across reports accessible to every user of the property.

How our verification works

During the audit we analyze reporting data (page dimensions and event parameters, among others) for patterns typical of personal data - above all the email address pattern in URLs and parameters.

The key principle: we act strictly as a signal.

•If we detect a risk, the report marks the checkpoint as an error or a warning and describes the nature of the problem (e.g. "an email address pattern was detected in page URL parameters"),
•we do not copy or store the detected personal data - the report contains information about the problem, not the data it concerns,
•the fix (and the decision about it) stays on your side: the report suggests the direction (removing parameters from URLs, redacting data before it's sent to GA4), but we change nothing for you.

What to do when the audit flags a PII leak

1.Locate the source - most often a form or process passing data in the URL after submission; check the pages indicated in the report.
2.Stop the leak at the source - pass data via POST rather than URL parameters, or strip unnecessary parameters before the page_view is sent to GA4 (e.g. by redaction in GTM).
3.Consider deleting historical data - GA4 provides a data deletion request mechanism (Admin → Data deletion requests); previously collected personal data won't disappear on its own.
4.Verify the fix with a rescan.

Does this replace a legal audit

No - and we draw that line honestly. Our verification detects common, technical leak patterns. It is not legal advice nor a full GDPR compliance audit; if a serious leak is detected, it's worth consulting your obligations (e.g. notification duties) with a lawyer or DPO.

Related articles:

•What happens to my website's data during the live scan?
•What data do you read from my GA account and what for?

More in Security and your data

Didn't find your answer?

Write to us - we respond fast, implementation questions included.

Write to us