Skip to content
ale@portfolio:~/portfolio$ cat README.md

portfolio

Every case study here answers one question: measurable outcome.

pii-detection-ga.mdZapier

Detect and Remove PII from GA

ShippedTeam: Data + Eng
TL;DR

Found and removed a GDPR/CCPA-exposing PII leak in Google Analytics, then built next-day leak detection so it can't happen silently again.

Outcome

  • ↓PII exposure window, from external report to next-day internal alert
  • ↑compliance posture under GDPR/CCPA
Saw It
  • GA consultants flagged a PII leak in Google Analytics data.
  • A real, externally-flagged compliance exposure under GDPR and CCPA, with no team formally owning GA implementation at the time.
↓
Figured It Out
  • As the technical owner of GA, took the fix directly rather than waiting for a team assignment.
  • Needed a solution that matched industry best practice, not an improvised patch, so researched before building.
  • Engaged a Java developer to customize the scrub script.
↓
Did It
  • Shipped a custom scrub script with monitoring and alerting.
  • The GA 4.0 migration created a new PII leak, exposing that the original script wasn't compatible with the new GA version. Caught fast specifically because the monitoring already in place flagged it, and fixed from there.

My Role

Owned the incident response end to end: validation, leadership communication, research, and the ongoing monitoring build. Partnered with an engineer and a Java developer on implementation.

Full breakdown

Problem & Risk

Compliance Risk

Live PII exposure in Google Analytics data, a direct GDPR/CCPA compliance risk with potential for regulatory sanction and real user harm if left unaddressed.

Customer Discovery & Validation

Evidence

Validated the source of the leak and sized the affected data before acting, rather than reacting to the consultant's report alone.

Context

GA consultants reached out about a PII leak. No team was responsible for the implementation, and I was the technical owner of GA.

Timeline

git log --oneline⏱ incident response
kickoff: GA consultants flag PII leak, no owning teamDay 0
discovery: leak sized, industry scrub practices researchedDay 1
fix: custom scrub script deployed and testedDay 3
feedback: GA 4.0 migration breaks script, new leak surfacesLater
ship v2: monitoring and alerting added, next-day leak detectionNext

What We Did

  • Validated the source and size of the leak, informed leadership
  • Researched industry best practices, engaged a Java developer to customize the scrub script
  • Tested the fix, implemented ongoing monitoring and alerting
~ rough sketch, not an actual screenshot ~

PII leak flagged externally

sized + researched

scrub script shipped

GA 4.0 breaks it

caught next-day, fixed

Who Benefits

GA data is clean of PII, and any recurrence surfaces as a next-day alert instead of an external report.

Next Steps

Would read Simo Ahava's GA blog before touching anything GA-related next time, to catch compatibility issues ahead of migrations.