Ale CabreraAle Cabrera
SHIPPED · ZAPIER · INCIDENT RESPONSE
Detect and Remove PII from GA
Found and removed a GDPR/CCPA-exposing PII leak in Google Analytics, then built next-day leak detection so it can't happen silently again.
- ↓PII exposure window, from external report to next-day internal alert
- ↑compliance posture under GDPR/CCPA
- Day 3custom scrub script deployed and tested
Incident response
- Day 0Kickoff: GA consultants flag a PII leak, no owning team
- Day 1Discovery: leak sized, industry scrub practices researched
- Day 3Fix: custom scrub script deployed and tested
- LaterFeedback: GA 4.0 migration breaks the script, new leak surfaces
- NextShip v2: monitoring and alerting added, next-day leak detection
What happened, in order
- PII leak flagged externally
- Sized + researched
- Scrub script shipped
- GA 4.0 breaks it
- Caught next-day, fixed
The risk, and what happened
| Risk | How it was handled | Result |
|---|---|---|
| Compliance. Live PII exposure in Google Analytics data, a direct GDPR/CCPA compliance risk with potential for regulatory sanction and real user harm. | Validated the source of the leak and sized the affected data before acting. Researched industry best practice, then shipped a custom scrub script with monitoring and alerting. | GA data is clean of PII, and any recurrence surfaces as a next-day alert instead of an external report. |
My role. Owned the incident response end to end: validation, leadership communication, research, and the ongoing monitoring build. Partnered with an engineer and a Java developer on implementation.
What went wrong. The GA 4.0 migration created a new PII leak: the original script wasn't compatible with the new GA version. Caught fast because the monitoring already in place flagged it, and fixed from there.
Product leader with a data scientist past · Zapier, Clearbit, HubSpot
Product doc: ale-cabrera.com/portfolio/pii-detection-ga