Data Security and PII

Have you ever wondered what happens with the data you submit online and if it’s being handled correctly? How do you know if a website is safe? As we continue to advance in a more technological world, data security becomes a topic of greater importance. Below are some questions and concerns that anyone might have when it comes to collecting or submitting personal information online.

What is PII?

PII stands for Personally Identifiable Information. This is data that can identify a specific person — such as a name, email address, phone number, address, or social security number.


FieldExample PII
NameJohn Smith
Address11 My Street, Boston, MA 11111
Date of birth03/07/1980
Phone number800-555-0100
Credit card or bank info4111111111111111
Social security number000-00-0000
Username (or any login credentials)jsmith01

What is not PII?

There is still information that can be collected about the session that is not considered PII. This includes any information related to the device being used, as well as general information about the user.


FieldExample Non-PII
Zip code11111
Device typeMobile
Mobile DeviceiPhone 7

Although some pieces of information may not be considered PII independently, they could be considered PII if presented together or combined with other information. For example, if you combine city, state, zip code, age, and gender, you could potentially identify a specific individual.

Can reporting tools collect personal information?

Fifty-four percent of all websites use Google Analytics, according to a market report released just this month by Web Technology Surveys. Although there is a clause in its Terms of Service that prohibits the collection and storage of PII, it is possible that PII can be unintentionally leaked into Google Analytics, also known as Universal Analytics.

“The Analytics terms of service, which all Analytics customers must adhere to, prohibits sending personally identifiable information (PII) to Analytics (such as names, social security numbers, email addresses, or any similar data), or data that permanently identifies a particular device (such as a mobile phone’s unique device identifier if such an identifier cannot be reset).” -Universal Analytics usage guidelines

“Your data is secure with Universal Analytics. Universal Analytics adds features to Analytics, but our privacy commitments haven’t changed. Safeguards like IP masking, the Analytics browser opt-out add-on, data confidentiality, and security work with analytics.js, the Universal Analytics JavaScript library.”
  -Security and privacy in Universal Analytics

Any Google Analytics account containing PII can be terminated, and all data will be destroyed.

How might PII be leaked into Google Analytics, and what can you do to prevent it?

Google is set up to collect page names, unless you explicitly tell it not to, or implement a virtual page name to send to Google Analytics in place of the URL. Any time query parameters are put in the URL, Google can collect it, since pageviews are sent to Google Analytics. Therefore, it is important to strip the query parameters from the URL to avoid this.

If you use Google Analytics event tags on your site, be sure to not pull in PII into any part of the event tag. If you have an event tag for each changed field on the site to analyze a form field drop-off, don’t pull in actual values from the form, unless it is non-identifiable, such as state, zip code, or gender.

If you want to pull in data from a form field, this is ok:

Event category: contact form
Event action: state
Event label: Maryland
*Why is this acceptable?* A state is not identifiable information.

DO NOT pull in the data from the field like this:

Event category: contact form
Event action: name
Event label: John Smith
*Why is this not ok?* A name is identifiable and goes against Google Analytics’ Terms of Service. To avoid this, you can still tag the field to trigger on field change, but fire an event like this:
Event category: contact form
Event action: name
Event label: entered

What are GET and POST methods?

When submitting a form, either the GET or POST method can be used to handle the data.


The GET method is used to retrieve data from the server. Data is displayed in the URL, and the parameters remain in the browser history. The URL will look something like this when using the GET method:

GET request:

GET /contact_form.php?name=John+Smith& HTTP/1.1


The POST method sends data to the server in the message body of the request. Data is not displayed in the URL, and it is not stored in browser history. JavaScript cannot read POST parameters, since JS is client side and the POST parameters are on the server.

POST request:

POST /contact_form.php HTTP/1.1

How can I regularly monitor Google Analytics to make sure I’m not collecting PII?

You can set up custom alerts in Google Analytics to detect PII — to an extent. It is fairly easy to detect an email address because you would set up an alert to look for any page names or events that contain the “@” symbol. If you know that you pull in values for an event category, action, or label, you might have to manually look in the reports to see if you are collecting names, addresses, etc.

I’m not a tech person...How do I know if a website is safe?

Most importantly, when submitting any personal information online, make sure that the URL begins with “https”. If it just shows “http”, then you should not submit any personal information. The “s” in https stands for “secure,” and it means the connection is encrypted.

Also check the URL to make sure it is actually the website you intended to reach. There are sites whose owners purchase web domains that are very similar to popular websites to intentionally deceive users. These sites can either steal your information or cause your computer to download a virus or other malicious content. It is not uncommon to mistype a website, but this can lead to a dangerous result, so be cautious and double-check the web address you typed before hitting ‘Enter.’

What should I do if I find one of my online accounts has been compromised?

The first step is always to change your password. If your compromised account had the same password as another account of your, change the other passwords. Never have the same password for two accounts. If you don’t already, use a password manager for all of your online accounts. Password managers will generate a strong, randomized password for each account you have and store it securely so you don’t have to remember it. Some popular password managers are 1Password, LastPass, RoboForm, and Dashlane.

Whether you’re a website administrator or just a visitor, keep in mind what kind of information you want to enter online and how it can be transmitted and collected. Data security should always be a top priority.

Ashley Turnbull
or drop us a note and say hello!