# Tracked page URLs include email addresses from campaign links, can I scrub them?

Asked by piotr_z on 2026-01-08. Tags: nextjs, privacy, tracking.

Marketing sends campaign links like `/promo?email=user@example.com`. Users land
on those URLs. The auto-tracked page events carry the full URL, email included.

I want that param stripped before anything leaves the browser. Not cleaned up
later in some export. At the source.

Is there a hook in the SDK for this? Rewriting every campaign link is not an
option, marketing owns those

## 1 answer

### Accepted answer from natec (2026-01-08)

Yes, this is exactly what the `urlSanitizer` plug option is for. It is a
callback that transforms URLs before events are sent, so the scrubbing happens
client-side, at the source, which is the right place for it:

```ts
urlSanitizer: url => {
    const sanitized = new URL(url);

    sanitized.searchParams.delete('email');

    return sanitized;
}
```

A bit of context on why this covers your case: the page events come from auto
tracking, the `track` option that is on by default. Every URL those events
carry passes through the sanitizer first, so once this is configured, the
email param never leaves the browser regardless of which campaign link the
user landed on.

One suggestion: rather than deleting a fixed list of params, consider an
allowlist of the params you actually use in audiences (utm ones, coupon codes,
and so on) and strip everything else. Marketing will eventually invent a new
param you did not anticipate.

#### Reply from piotr_z (2026-01-08)

Allowlist approach implemented. Verified in the network tab, the param is
gone from every event. Exactly what I needed.