PII in Analytics Events
Overview
Sending PII to analytics platforms violates GDPR (data minimization principle) and the Terms of Service of most analytics vendors (e.g., Google Analytics prohibits sending PII). Common violations:
- Email addresses in user identification
- Full names in event properties
- Health conditions in custom dimensions
Remediation
- Use anonymized or pseudonymized identifiers in analytics
- Hash email addresses before sending (but this is still PII under GDPR)
- Audit all analytics events for PII before going live