The GA4 PII checklist for Indian FinTech teams

Why a PII leak in analytics matters

Analytics data is copied widely. It flows into reports, exports, BigQuery tables, dashboards and the inboxes of everyone with access. Once a PAN or an account number lands there, it is very hard to say where it has travelled.

• It breaks Google Analytics terms, which can put your property at risk.
• It is personal data collected for a purpose your users never agreed to.
• It turns an ordinary marketing tool into something your security questionnaire has to explain.
• It erodes trust if a partner, auditor or journalist ever finds it.

Where PII hides in a FinTech property

Most leaks come from a handful of predictable places. Check each one in your own property:

• URLs and query strings, such as ?mobile=98xxxxxx or ?email= after a form step or an OTP redirect.
• Page titles that greet the user by name or show a loan or account number.
• Event parameters that copy form values, error messages or API responses into custom events.
• Site search, where users paste account numbers or IFSC codes into the search box.
• The user ID, when it is set to an email, phone number or PAN instead of an internal ID.
• Payment and KYC callbacks that return tokens, references or names in the URL.

The checklist

1. Scan what you already have.

Run explorations on page location, page title and every custom dimension. Search them for 10-digit mobile numbers, email addresses, 12-digit numbers and the PAN pattern of five letters, four digits and one letter.

2. Strip sensitive query parameters.

Remove them before the hit is sent, in your tag manager or, better, in a server-side container. Never rely on reports filtering them afterwards.

3. Use an opaque user ID.

Send an internal, random customer ID. A hashed phone number can often be reversed, so treat it as personal data too.

4. Clean page titles and errors.

Keep titles generic ("Loan summary") and send error codes, not error messages that echo what the user typed.

5. Exclude search terms you do not need.

If people search for account details, stop recording those parameters.

6. Set a sensible retention period.

GA4 lets standard properties keep event data for 2 or 14 months. Choose the shortest period that still answers your questions.

7. Respect consent.

Implement Consent Mode v2 so tags behave according to what each visitor allowed.

8. Limit who can see raw data.

Give most people Viewer access, keep editing rights to a few, and review the user list every quarter.

9. Know how to delete.

If PII does get in, use GA4 data deletion requests, then fix the source so it cannot happen again.

Make it a habit, not a one-off

Every new screen, A/B test or vendor script can reintroduce a leak. Add a PII check to your release checklist, run the scan in step one every month, and give one person clear ownership of analytics governance.

This article is practical guidance, not legal advice. For questions about your obligations under the DPDP Act, speak to your legal or compliance team.