What this means for your store
PII in URLs is the most common ecommerce analytics leak. User-provided data redaction blocks personally identifiable information from event parameters, URLs, and referrers at the Google tag level. Typical leaks: email on thank-you redirects, phone in enhanced conversions, user_name in dataLayer pushes. Redaction stops many accidental sends from reaching reports - it does not replace fixing misconfigured tags.
Scenario on a real storefront
BoxCycle, a subscription snack brand, passes ?email= on the post-checkout survey redirect. Enable redaction and scrub the frontend pattern:
# GA4 Admin
Admin → Data streams → [Web stream] → Redact user-provided data
→ Enable "Email addresses"
→ Enable "Phone numbers" (US and international formats)
# Before - PII in URL (never do this)
https://shop.example.com/[email protected]&order=8821
# After - opaque ID only
https://shop.example.com/survey?order_id=8821&token=a8f3...
# gtag - pass hashed user_data for enhanced conversions, not plain text
gtag('set', 'user_data', {
email: await sha256(normalizeEmail(email)), // hashed, not raw
});
# Audit: GA4 DebugView + Realtime - search param names for @ or +44What to do next
- Scan thank-you and account pages for query params containing email, phone, or name.
- Maintain a tag governance sheet listing allowed event parameters per tag.
- Treat redaction as a safety net - not a substitute for privacy policy disclosure or lawful basis docs.
Bottom line
Enable user-provided data redaction on every production web stream. Remove PII from URLs and dataLayer. Hash enhanced-conversion fields. Audit DebugView after checkout changes.