You've sent potentially violating personal data to Meta: what to do

In this article, we will explain what to do if you receive a warning from Meta about sending potentially violating personal data. Learn how to fix the issue and stay in line with the privacy regulations. 

With all the data regulations piling up and getting stricter, users are more alert than ever about the breach of personal data. In response to the data privacy regulations, Meta has introduced some updates that make including personal parameters in the URL unacceptable. 

This happens when Meta detects any URL parameters that potentially contain information that personally identifies individuals. For instance, such information as contact information (phone number, email address), full name, user ID, address, birth date, payment details, login credentials, health-related information, etc. 

Meta does not accept events if there are unencrypted PII in the URL parameters. Therefore, you must either encrypt this data before sending it or remove it from the URL entirely. When running Facebook Lead Ads, make sure you're not passing sensitive personal information through URL parameters to stay compliant and avoid this issue.

First, you need to turn off your software or plugin feature that passes the user’s personal data as URL Query Parameter to the thank you page (this occurs post sign-up, subscription, and purchase).

You could use different plugins, and the interfaces could be different, but there should always be an option to de-select this interface. 

If Facebook is detecting personal data (PII) in your URL, there’s another way to fix it - especially for server-side tracking.

For web events, Facebook automatically picks up the page URL, so you can’t change it. But for server-side events, you can replace the URL before sending it to Facebook. This stops Facebook from receiving personal data in the URL.

Here’s what to do:

If a page URL has personal data, make sure Facebook’s web tracking doesn’t run on that page.You can do this by adding an exception trigger in Google Tag Manager.

How to do it:

Step 1: Create an Exception Trigger

1. 1.
   Go to Google Tag Manager → Open your Web Container.
2. 2.
   Navigate to Triggers → Click New.
3. 3.
   Choose Trigger Type: "Page View" (or any you need)
4. 4.
   Set Conditions: page URL contains email= or phone= (adjust based on your URL structure)
5. 5.
   Name the trigger: "PII Exception Trigger"
6. 6.
   Click Save.

Step 2: Apply Exception to Facebook Pixel Tags

1. 1.
   Go to Tags → Open your Facebook Pixel Tag (Page View, Purchase, Lead, etc.).
2. 2.
   Scroll to Triggering.
3. 3.
   Click Add Exception.
4. 4.
   Select "PII Exception Trigger".
5. 5.
   Click Save.

Step 3: Publish and test

1. 1.
   Click Preview in GTM.
2. 2.
   Visit a page with PII in the URL.
3. 3.
   Open Facebook Pixel Helper. The Pixel should NOT fire on pages with personal data.

Now, Facebook’s web tracking will not run on pages where the URL contains sensitive user data.

Before sending data to Facebook, remove personal info from the URL.

You can do this using custom JavaScript to clean the URL before Facebook sees it.

This way, you still track events but without sending any private data to Facebook.

How to do it:

1. Go to Google Tag Manager.

2. Go to to Variables → Click New.

3. Choose Variable Type: "Custom JavaScript".

4. Create JavaScript code to clean the URL, example below.

• Explanation: This script removes any query parameters (such as ?email=xyz@domain.com) from the URL before it's sent to Facebook.

5. Name the variable: Clean Page URL

6. Click Save.

1. 1.
   Send the cleaned URL as a parameter to the server container (in GA4/Data tag data depending on what you are using).
2. 2.
   Go to Tags on your sGTM → Open your Facebook Server-Side Tag.
3. 3.
   Find the Page URL field in your tag configuration.
4. 4.
   Replace the current URL variable (e.g., {{Event Data - clean_page_location}}) with the newly created "Clean Page URL" variable.
5. 5.
   Click Save.

1. 1.
   Click Preview in Google Tag Manager.
2. 2.
   Visit a page that contains personal data in the URL.
3. 3.
   Check Facebook’s server-side event logs to confirm that the URL sent to Facebook no longer contains personal data.

Before Cleaning (URL with PII):

https://example.com/thank-you?email=john.doe@email.com&phone=1234567890

After Cleaning (URL without PII):

https://example.com/thank-you

By using this method, you can continue tracking Facebook events server-side without sending any personal information to Facebook.

It’s alarming to receive a potentially violating personal data alert from Meta. Luckily, there are ways to fix it. Have you ever encountered such a problem? Let us know in the comments how you handled it and what topic you would like us to cover next on our blog.