trackers

What Google Analytics 4 Sends From a Website, and Where Personal Data Slips In

Google Analytics 4 sends its data to an address ending in /g/collect, on google-analytics.com, analytics.google.com or a regional variant of them. One request can hold several events, one per line of the request body, with page details in the query string.

Google’s own rules say not to send personally identifiable information to Analytics. That’s a rule for the site owner, though, and the tag sends whatever the page gives it. PXTA checks what actually goes out.

A Google Analytics 4 request decoded by PXTA: the measurement ID, the Consent Mode state gcs=G100, the client ID, the page address with a search for flu symptoms, the page title and the event name, with the page address and title highlighted.

The Fields That Matter

  • tid is the measurement ID, the G- code of the property.
  • en is the event name, such as page_view, purchase or sign_up. In a request with several events, PXTA lists each one’s fields under body.0>, body.1> and so on.
  • dl is the page address and dt the page title. dr is the referring page.
  • cid is the client ID from the _ga cookie, and sid the session.
  • uid is a user ID the site sets itself, usually its own customer number.
  • ep. and up. fields carry event parameters and user properties the site adds.
  • gcs is the Google Consent Mode state, such as G100 or G111.

Where It Usually Goes Wrong

Search terms and emails in the address. A search page like /search?q=flu+symptoms sends the search to Google in dl. PXTA decodes the address and flags the term, as in the image above. The same goes for emails in confirmation links.

Custom parameters. Developers add ep. fields for reporting, and sometimes an email or a name ends up in one. PXTA runs its rules on every field, so these show up even with names it has never seen.

Consent Mode that says one thing while the request does another. With Consent Mode, the tag can keep sending requests after a visitor says no, marked G100 for denied. PXTA reports consent-mode-mismatch when a denied request still carries personal data, and consent-mode-granted when the state says granted before an answer or after a reject. The Consent Mode explainer has the details.

What PXTA Can’t See

GA4 also accepts events from a site’s server through the Measurement Protocol, and many sites run a server-side Tag Manager container that forwards data to Google. Neither passes through the browser in a form PXTA can attribute to Google.

The Cedar Valley Clinic report is a case where GA4 is set up properly and waits for consent, while other tags on the same site don’t.