SiteAud!tLint Support

Critical Tracking & Analytics

Personal data or tokens in URL

Severity
Critical
Impact
High
Effort to fix
Medium
Issue code
track_pii_in_url

Why it matters

The URL carries an email address, token or similar value. Analytics tools record full page URLs, so it ends up in GA4 (against Google's terms) and leaks through referrers and server logs.

How to fix it

Send these values in the request body or session instead of the URL. Redact them in GA4 (Data redaction for email and query parameters) until the site is fixed.

What this means

A URL on the site contains personal data or a secret: an email address, or a parameter such as email, token, password, session or phone with a value. The evidence shows which, for example URL contains parameter 'email', or Links to /reset?token=... (parameter 'token') when a page links to such a URL.

Why it matters

Analytics tools record full page URLs. Personal data in a URL ends up in GA4 and other tools, which breaks Google's terms of service, and can lead to data deletion requests or account suspension. The same URL also leaks through browser history, server logs, shared links and the Referer header sent to third-party scripts and other sites. Tokens and session IDs in URLs can let someone else access an account.

Common causes

  • Forms using GET: a newsletter or contact form submitting ?email=... in the URL.
  • Password reset and login links with tokens, reached from internal links.
  • Email campaign links that add the subscriber's address as a parameter.
  • Search pages where visitors type an email or phone number.
  • Session IDs in URLs from older platforms.

How to fix it

  1. Change forms to submit with POST, so data goes in the request body, not the URL.
  2. Use one-time tokens that expire quickly for reset links, and do not link to them from crawlable pages.
  3. Remove personal data from campaign links; use an anonymous ID instead.
  4. Strip sensitive parameters before data reaches analytics, for example with GA4's data redaction settings for email addresses and query parameters.
  5. Delete data already collected, using GA4's Data deletion requests.

Verify the fix

Recrawl. See Consent checks for more on personal data and tracking.

How it affects your score

Tracking issues have their own Tracking score and never lower the SEO site health score. They still appear in the Action Plan, the issues CSV, Slack messages and Linear tickets. Blocks indexing, breaks pages or loses traffic. Fix these first.

Find the affected URLs

Open Crawl > Issues and pick Personal data or tokens in URL. Each affected URL is listed with its evidence, and Copy URLs or Export URLs hands the list to a developer. The issue also appears in the Action Plan, ranked by impact (high) and effort (medium), and in the issues CSV under the code track_pii_in_url. After fixing, run a new audit and use Compare to confirm the URLs moved to fixed.

Guides that cover this issue