Google Analytics is now automatically removing personal info from collected data. So far only for query term “email”.

I regularly audit and test accounts for PII and found this today: Google Analytics is automatically replacing email addresses it finds in your reports with the text “obfuscated” – in real time. At present it seems only to work when sent as a value in the query term ?email=. As you can see form the screenshot, my test for ?emailaddr= still shows in the report.

Lets hope this proactive filtering can get smarter over time. That said, I hope web dev/admins don’t get complacent and reply on this as band-aid fix.

No one should be sending personal information (PII) around the web in plain text as part of a URL, but amazingly it does happen. Even by big brands that should know a lot better… Apart form being a reputation killer, its illegal to do so in the EU.