1

I want to set up User ID in GA using GTM, by getting a UID via the cookie. The problem is that we store only the account email address in the cookie, and we don't store any unique UID. We can't send this email address to GA since sending personally identifiable information (PII) is not allowed.

A UID is stored on the back-end, but it would take development effort to retrieve it and store it in the cookie. That's a no bueno because I really need this implemented as soon as possible without involving developers.

Can I somehow encrypt the email address from the cookie to a unique code in GTM using Custom Javascript so that it's NOT personally identifiable, and cannot be easily decrypted to find the email address? I can send this unique encrypted code to GA.

1

Can I somehow encrypt the email address from the cookie to a unique code in GTM using Custom Javascript so that it's NOT personally identifiable

Absolutely you can. Unless it cannot be used by Google (or any third-party to match it to a person) - you could and should. One option would be to hash it using SHA-256 (irreversible) and save the value to GA

  • Thanks. I don't know if this answer was valid in 2015, but it certainly is correct now. From this page: "You can send Google Analytics an encrypted identifier or custom dimension that is based on PII, as long as you use the proper encryption level. Google has a minimum hashing requirement of SHA256 and strongly recommends the use of a salt, with a minimum of 8 characters. Notwithstanding any of the foregoing, you may not send Google Analytics encrypted Protected Health Information (as defined under HIPAA), even if it is hashed or salted." – Vikram Jun 19 '17 at 2:22
1

It appears that would violate the GA terms of service. According to this Analytics help page:

The Google Analytics terms of service, which all Google Analytics customers must adhere to, prohibits sending personally identifiable information (PII) to Google Analytics (such as names, social security numbers, email addresses, or any similar data), or data that permanently identifies a particular device (such as a mobile phone’s unique device identifier if such an identifier cannot be reset), even in hashed form. Your Google Analytics account could be terminated and your data destroyed if you use any of this information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.