Tracked page URLs include email addresses from campaign links, can I scrub them?
Marketing sends campaign links like /promo?email=user@example.com. Users land on those URLs. The auto-tracked page events carry the full URL, email included.
I want that param stripped before anything leaves the browser. Not cleaned up later in some export. At the source.
Is there a hook in the SDK for this? Rewriting every campaign link is not an option, marketing owns those
1 answer
Yes, this is exactly what the urlSanitizer plug option is for. It is a callback that transforms URLs before events are sent, so the scrubbing happens client-side, at the source, which is the right place for it:
urlSanitizer: url => { const sanitized = new URL(url);
sanitized.searchParams.delete('email');
return sanitized;}A bit of context on why this covers your case: the page events come from auto tracking, the track option that is on by default. Every URL those events carry passes through the sanitizer first, so once this is configured, the email param never leaves the browser regardless of which campaign link the user landed on.
One suggestion: rather than deleting a fixed list of params, consider an allowlist of the params you actually use in audiences (utm ones, coupon codes, and so on) and strip everything else. Marketing will eventually invent a new param you did not anticipate.
Allowlist approach implemented. Verified in the network tab, the param is gone from every event. Exactly what I needed.