PII in Analytics Events

Detects PII being sent to analytics platforms like Google Analytics, Mixpanel, or Amplitude in event properties.

zakirkun Updated

File contents

PII in Analytics Events

Overview

Sending PII to analytics platforms violates GDPR (data minimization principle) and the Terms of Service of most analytics vendors (e.g., Google Analytics prohibits sending PII). Common violations:

  • Email addresses in user identification
  • Full names in event properties
  • Health conditions in custom dimensions

Remediation

  • Use anonymized or pseudonymized identifiers in analytics
  • Hash email addresses before sending (but this is still PII under GDPR)
  • Audit all analytics events for PII before going live

zakirkun/ice-tea/tree/main/skills/privacy/analytics-pii-leak commit bd41516e1a

Frequently asked questions

npx skillmds@latest add zakirkun/pii-in-analytics-events