PII, Hashing and Google Analytics

TL;DR: Google strictly prohibits sending Personally Identifiable Information (PII) to Google Analytics, including data in hashed form. The safest approach is to remove PII at the source before it reaches GA4. This article explains the policy, why hashing alone is not enough, and provides a Google Tag Manager script to strip PII from URLs automatically.

Google has a strict policy prohibiting sending Personally Identifiable Information (PII) to Google Analytics.

This is necessary to provide GA reports around the world, yet comply with country regulations about storing personal information. Even if you send personal information accidentally, Google may be forced to delete all of your analytics data for the time range affected.

This policy has tightened significantly over the years. The current terms state:

You may not upload any data that allows Google to personally identify an individual (such as names and email addresses), even in hashed form.

That last clause matters. A number of sites use a hashed email as the unique identifier for logged-in users, or for those arriving from email campaigns. Under current Google Analytics Terms of Service, sending hashed PII is still a violation. If you are using this approach, you need to ensure any hashed identifier meets a minimum of SHA-256 hashing (not MD5) with a salt to improve security. Check your implementation meets the required standard.

The cleaner solution: remove PII before it ever reaches Google Analytics, rather than relying on hashing to make it acceptable.

Littledata's Shopify Google Analytics connector filters out PII data as standard, so you do not need to build or maintain this yourself.

Google's best practice for avoiding this issue is to remove the PII at the source, on the page, before it is sent to Google Analytics. But it can be difficult to hunt down every situation where you accidentally send personal data: a form which sends the user's email in the postback URL, or a marketing campaign that appends a postcode as a campaign tag.

The GTM variable below handles this removal for you, so you do not need to change every form or marketing campaign that is currently breaking the rules.

Steps to set up

1. Copy the script below into a new custom JavaScript variable in GTM

function() {

// Modify the object below to add additional regular expressions
var piiRegex = {
  // matches emails, postcodes and phone numbers where they start or end with a space
  // or a comma, ampersand, backslash or equals
  "email": /[\s&\/,=]([a-zA-Z0-9_.+-]+\@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+)($|[\s&;\/,])/,
  "postcode": /[\s&\/,=]([A-Z]{1,2}[0-9][0-9A-Z]?(\s|%20)[0-9][A-Z]{2})($|[\s&\/,])/,
  "phone number": /[\s&\/,=](0[0-9]{3,5}(\s|%20)?[0-9]{5,8}|[0-9]{3}-[0-9]{4}-[0-9]{4})($|[\s&\/,])/
};

// Ensure that Page URL Variable is updated to match the Variable in your
// GTM container to retrieve the full URL
var dl = {{Page URL}}

var dlRemoved = dl;
for (key in piiRegex) {
  dlRemoved = dlRemoved.replace(piiRegex[key], 'REMOVED');
}
return dlRemoved;
}

2. Check {{Page URL}} is set up in your GTM container

This is a built-in variable, but you will need to confirm it is enabled under the Variables tab in your GTM container.

3. Change the pageview tag to override the standard document location

Update your GA4 Configuration tag (or Universal Analytics pageview tag if still in use) to override the standard document location field, and use the variable with PII removed instead.

By default, Google Analytics takes the location to be whatever is in the URL bar (document.location in JavaScript). This step overrides that with the PII-safe variable, so any email addresses, postcodes or phone numbers that appear in query strings are replaced with REMOVED before the hit is sent.

4. Check the hits before they are sent

Use the GTM Preview mode and the Google Analytics Debugger Chrome extension to inspect hits before they are sent. Pay particular attention to the dl (document location) and dp (document path) parameters, and any custom dimensions that carry user-level data.

A note on hashing and GA4 policy

The original version of this article discussed hashing as a potential mitigation for PII in Google Analytics. The policy has since made this position untenable.

Google's developer documentation now explicitly prohibits sending data that could personally identify an individual "even in hashed form." This applies to GA4 as much as it did to Universal Analytics.

Here is what that means in practice:

• Hashed emails as User IDs: Sending a SHA-256 hashed email as a User ID is a policy violation. If you need to track logged-in users across sessions, use an internal, non-reversible pseudonymous identifier that has no relationship to any real-world personal data.
• MD5 hashing: Never use MD5 for any identifier sent to Google Analytics. It is considered cryptographically weak and does not satisfy even the minimum standard for pseudonymisation under GDPR.
• Salted SHA-256: If you are using salted SHA-256 hashes for CRM integration via the Measurement Protocol, check that your implementation meets Google's CRM integration guidelines. Even so, this is a grey area and the safest implementation avoids sending any derivative of real personal data.

The practical rule: if someone in your organisation could, even in theory, reverse-engineer the identifier back to a real person, it should not go to Google Analytics.

For Shopify stores, Littledata's connector handles this by design: identifiers sent to GA4 are pseudonymous session tokens, not derivatives of customer email addresses or personal data.

Under GDPR, sending personal data to GA without a lawful basis, without adequate contractual protections, or in violation of Google's own terms creates compounded liability. The ICO's guidance on lawful basis is a useful starting point for UK-based businesses.

Frequently asked questions

What is PII in the context of Google Analytics?

PII (Personally Identifiable Information) is any data that could identify an individual, including names, email addresses, postal addresses, phone numbers, and precise location data. Google Analytics prohibits collecting any of these, even in hashed form.

Can I send a hashed email address to Google Analytics?

No. Google's data collection policy explicitly prohibits sending data that could identify an individual 'even in hashed form.' Hashed emails must not be sent as User IDs, custom dimensions, or any other GA4 field.

What happens if I accidentally send PII to Google Analytics?

Google can delete all analytics data for the affected time period. Repeated violations may result in property suspension. Sending personal data to a third-party processor without a lawful basis may also constitute a GDPR breach.

How do I remove PII from URLs before they reach Google Analytics?

Use a custom JavaScript variable in Google Tag Manager that applies regular expressions to strip emails, postcodes, and phone numbers from the page URL before the GA4 pageview tag fires. Littledata's Shopify connector does this automatically.

Does GDPR affect what data I can send to Google Analytics?

Yes. Under GDPR, Google Analytics is a data processor. Sending personal data without a lawful basis or in violation of Google's own terms creates compounded regulatory liability. The ICO's guidance on analytics is a useful starting point for UK businesses.

Does Littledata filter PII automatically?

Yes. Littledata's Shopify connector strips PII from URLs and uses pseudonymous session tokens rather than any derivative of customer personal data, so you are compliant with GA4 policy by default.