Comments on: How to Deal With Personally Identifiable Information (PII) in Google Analytics

By: Paul Koks

Paul Koks — Mon, 16 Dec 2019 08:28:19 +0000

In reply to Isaac.

Hi Isaac,

It might be possible (as you can delete the data from the servers), but still I always recommend to try to prevent PII to reach the servers in the first place.

Definitely good option to try!

Best,
Paul

By: Isaac

Isaac — Sat, 14 Dec 2019 00:25:13 +0000

Hi Paul,

Is it possible to remove the PII with the Data Deletion Protocol?

By: Paul Koks

Paul Koks — Mon, 18 Sep 2017 09:18:18 +0000

In reply to Naveed.

Hi Naveed,
Thanks for your comment.
Question 1: do the query string parameters contain any PII information?
Question 2: if you use best practices and obey the privacy rules, you should be fine.
Best,
Paul

By: Naveed

Naveed — Sat, 16 Sep 2017 07:15:03 +0000

Hi,
I did on search for Query String Parameters in my GA account and it returned me 68 records. Just wondering what should we do in this case.
Apart from it I am capturing Client ID and UserID as per the best practices. Is that of any harm to PII.

By: Paul Koks

Paul Koks — Mon, 13 Feb 2017 14:58:38 +0000

In reply to Ben Young.

Hi Ben,

Thanks for your comment.

1) If you would be very strict, that is not allowed. Please review: https://support.google.com/analytics/answer/6366371?hl=en.
However, setting this up might be a daunting task.
2) If Google would judge it as PII, you should refrain from dynamically passing it via your URL. Maybe you can store it in your form program/environment instead?

In general, be as careful as possible with PII because it can get you into real trouble!

Best,
Paul

By: Ben Young

Ben Young — Mon, 13 Feb 2017 00:26:08 +0000

Hey Paul,

Great article. I’ve got 2 questions, if someone types in an address in your search bar and it’s recorded in your search terms, is this a breach?

2. What about a form that generates a dynamic URL parameter containing the property address that was submitted?

Thanks!

By: Haresh Pansuriya

Haresh Pansuriya — Wed, 04 Jan 2017 09:23:24 +0000

Great one..

By: Paul Koks

Paul Koks — Wed, 04 Jan 2017 07:51:18 +0000

In reply to Juan.

Hi Juan,
Thank you for your comment. Your account is always at risk if there is PII information stored in the past. Unfortunately you cannot completely remove it yourself once the damage has been done.
Please see the last paragraph in this article and decide whether you take an additional step (informing Google) or not. This is hard for me to advice on as it touches the legal side. Of course you can choose to not backup your data (move your current property and start a new one), but the risk is always on your side if there is PII data in your account.
Best,
Paul

By: Juan

Juan — Tue, 03 Jan 2017 19:38:04 +0000

Thank you for the information, Paul. The past Dec 27th I found an PII issue and I warned my programmer about it. He fixed it using the option 2 (excluding URL parameter in view setting). However, I wonder if we could have some problem because the parameter was registing between Dec 23th and Dec 27th when the change was setted

By: Paul Koks

Paul Koks — Tue, 03 Jan 2017 13:49:10 +0000

In reply to Gerry White.

Thank you for your comment Gerry.
Yes, the very best thing to do is to make sure that no PII data is sent to Google Analytics in the first place. However, filtering it out of the views is definitely smart to do as well (if for whatever reason you can’t prevent it being sent).
And also true that Google is (manually) destroying PII information. But I am not 100% sure that will work in all cases since I have seen plenty of accounts that still contain this data. I hope that PII issues won’t occur anymore in the future. As long as it is not 100% done and confirmed, I still recommend companies to work on it by themselves.
Your solution – not pass any PII information via GTM filters – might work as well. But I have to admit I am not so familiar with that setup.