Keep personal data out of events

How to do it

Give each user a random analytics ID that is separate from the account ID. A hash of an email address is still personal data under GDPR Recital 26, because anyone with the address can match it. Strip query strings and fragments from page addresses before sending. Allow only enumerated values or numbers in properties, and no open text fields. Logs follow the same idea in keep personal data out of logs.

Example

-- PostgreSQL: must return 0 rows
SELECT name, properties FROM events
WHERE received_at > now() - interval '1 day'
  AND properties::text ~ '@|[0-9]{8,}|\?';

export const cleanPath = href => new URL(href).pathname;

from urllib.parse import urlsplit

def clean_path(href: str) -> str:
    return urlsplit(href).path

How to check

A query over one day of events finds no @, no run of 8 or more digits and no ? in any property value. The schema test fails on any property of type free string not marked as an ID.