In this guide
- PII is a US term for information that identifies a person. In the EU the wider term is personal data.
- Analytics tools such as GA4 forbid sending PII. Ad platforms accept hashed e-mail and phone for matching, with consent.
- Review URLs, form fields and event parameters regularly. Leaks are usually accidental.
"Is this PII?" comes up in every tracking project. The honest answer depends on the law, the tool and the context. This page gives a working definition, examples and rules of thumb for tracking, and a review you can run. It is general information, not legal advice. See also data loss and leakage prevention, GDPR and server-side tracking and customer data management.
PII and personal data
In the US, PII usually means information that can identify a person: name, e-mail, phone, address, government ID. In the EU, GDPR uses "personal data", which is broader: any information relating to an identifiable person, including online identifiers such as IP addresses and cookie IDs. For tracking, think in the wider EU sense and the stricter vendor rules.
3 things to remember
Scroll and the points stack up.
PII is a US term for information that identifies a person. In the EU the wider term is personal data.
Analytics tools such as GA4 forbid sending PII. Ad platforms accept hashed e-mail and phone for matching, with consent.
Review URLs, form fields and event parameters regularly. Leaks are usually accidental.
Examples
| Type | Examples | Treat as |
|---|---|---|
| Direct identifiers | Name, e-mail, phone, postal address, account number | Personal data |
| Indirect identifiers | Date of birth with postcode, rare job title with employer | Personal data in combination |
| Online identifiers | IP address, cookie IDs, device IDs, user IDs | Personal data (EU) |
| Hashed values | SHA-256 of an e-mail | Still personal data |
| Sensitive data | Health, religion, political views, sexual orientation, children's data | Special rules; avoid in tracking |
The vendor rules
- Google Analytics terms forbid sending PII to GA, including e-mail addresses and names in URLs or parameters. Use pseudonymous IDs.
- Ad platforms (Meta, Google Ads, TikTok) ask for hashed e-mail and phone to match conversions. They treat the data under their terms and your lawful basis.
- Sensitive categories are restricted by every platform. Do not send them.
Runs on your domain, anywhere
Your tracking runs on your own domain, so a visit from any country is handled the same way.
Where PII hides
/thank-you?email=... is sent to every tool as the page URL.What to do with ad platforms
Send hashed e-mail and phone only to platforms that ask for them, only with a lawful basis (usually consent for advertising), and only what each needs. A server container lets you control this: Allow or Exclude transformations strip fields per vendor. Open Tracked's Anonymizer (every plan) can zero or remove the IP, and the Enricher's consent switches tie stored data to consent. See transformations.
A review you can run
- Crawl the site and search the URLs for e-mail patterns and names.
- Watch the Network tab on forms and checkout.
- Search GA4 page URLs and event parameters for "@".
- List every parameter your tags send, and mark any that could identify a person.
- Remove or hash what is not needed, and record the reason.
Ask Ari instead of digging through reports
Ari reads your tracking and ad data and answers in plain words.
Frequently asked questions
What is PII?
Information that can identify a person. In the EU the broader term is personal data, which includes online identifiers.
Is a hashed e-mail PII?
It is still personal data. Treat it as such.
Can I send e-mail addresses to Google Analytics?
No. Google's terms forbid sending PII to Analytics. Use pseudonymous IDs.
Can I send hashed e-mail to Meta?
Yes, for matching, with a lawful basis and normally consent for advertising.
How do I find PII leaks?
Crawl URLs, watch forms and search analytics data for e-mail patterns.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Guides · 4 min read
