What must never reach Adobe Analytics

PII Rules: What Must Never Reach Adobe

Golden rule: If it identifies a person, do not send it.

Definitely PII

Never send:

• Full name: "Alice Smith"
• Email address: "alice@example.com"
• Phone number: "+61 2 1234 5678"
• Social Security/Tax ID: "123-45-6789"
• Credit card numbers: "4532-1234-5678-9010"
• Payment methods: "Visa ending 9010"
• Medical info: "Diabetes diagnosis"
• Banking info: "Account ending 5678"
• IP address (in most cases)

Probably PII

Don't send without good reason:

• User ID (unless hashed)
• Postal/ZIP code (with house number)
• Date of birth
• Employer name + role (can identify someone)
• Customer ID (if sequential and guessable)

What's safe

Safe to send:

• Page name: "Product Page"
• Device type: "Mobile"
• Traffic source: "Organic Search"
• Generic eVar: "Premium Member"
• Event: "Form Submit"
• Timestamp (that's the point)

How PII sneaks in

Mistake 1: Logging user email in page name

// WRONG - email is visible
s.pageName = "user-profile-" + userEmail;

Mistake 2: Query parameters with PII

page.com/checkout?user=alice@example.com&order=12345
// WRONG - email in URL

Mistake 3: Custom data with full name

// WRONG - full name sent
adobeDataLayer.push({
  user: { name: "Alice Smith" }
});

Fix: Use hashed or generic identifiers

// RIGHT - hashed email
const hashedEmail = sha256(userEmail);
s.prop1 = hashedEmail;

// RIGHT - generic user ID
s.prop2 = "user_123";

// RIGHT - segment only
adobeDataLayer.push({
  user: { segment: "premium_member" }
});

Monitoring for PII

Monthly audit:

1. Export sample of data
2. Search for email patterns: "@"
3. Search for SSN patterns: "xxx-xx-xxxx"
4. If found, investigate source
5. Fix immediately

Use: Search in Workspace for "@" or common patterns

---

Next: Consent and the Web SDK