Customer emails stored in GA4: personal data in your URLs
A form submitted by GET leaves the email in the URL, and GA4 stores it in page_location. That breaks its terms. How to remove it at the source and clean up.
- After signing up, the user lands on a confirmation page whose URL includes their email address.
- GA4 stores the full URL in page_location, so the email ends up in the reports. That breaks its terms.
- The cause: the form is submitted with the GET method, which adds every field to the URL.
- The fix: submit by POST, and turn on the web stream's data redaction as a safety net.
- Review page_location for emails. Redaction doesn't clean what was already collected: that needs a data deletion.
Google Analytics’ terms of service forbid sending information that personally identifies a user: email addresses, phone numbers, full names, ID numbers. Almost nobody does it on purpose. What usually happens is that the data reaches GA4 without anyone deciding it, inside something GA4 always collects: the page URL.
What happens when emails end up in GA4
After signing up or filling in a form, the user lands on a confirmation page such as shop.com/thank-you?email=ana%40example.com. GA4 stores the full URL in the page_location parameter, and the email with it. From then on, the address appears in reports, explorations and exports, within reach of anyone with access to the property.
Why personal data reaches page_location
The most frequent cause is a form submitted with the GET method, which appends all its fields to the destination URL. Other common causes:
- Redirects that pass user data as parameters (for example, after a sign-in).
- Links in transactional emails that include the recipient’s address.
- Site search boxes where users type their email or phone number.
- Custom tags or events that send form fields as parameters.
How to find PII in your GA4 data
- In a free-form exploration, use the Page location dimension and filter for
@and for%40(the at sign, URL-encoded). - Repeat the search with phone or ID number patterns typical of your market.
- Review the site’s forms: any
<form method="get">that collects personal data is suspect.
How to remove PII from your URLs and GA4
Act on three levels:
- At the source. Submit forms with
method="post"and don’t pass personal data in redirect or email URLs. It is the only complete fix. - In GA4, as a safety net. In the web stream, turn on data redaction: Admin → Data streams → web stream → Redact data. It removes email addresses and the query parameters you list before the data is stored.
- On what was already collected. Redaction only affects new data. To remove what is stored, create a data deletion request in Admin → Data deletion requests, limited to the affected period and parameters.
Google’s documentation: Best practices to avoid sending Personally Identifiable Information (PII).
How to check no personal data is collected
- Fill in the form again and check that the confirmation URL no longer contains personal data.
- In DebugView, look at the
page_locationof that hit. - Run the search for
@and%40again a few days later: no new results should appear.
The email in the example is made up. If you find personal data in your property, treat the clean-up as a privacy incident and report it to the right people in your organisation.