Hashing with sha256 when sending user_data to GA4, Google ads, etc
tl;dr: Should there be a sha256_ prefix to city, regon, postal code, country, and should I hash them or not?
---- details I am wondering wether google doesn't consider city, region and postal code a sensitive information or the docs are incomplete. Judging by the second example, I don't need to hash even street address. And yet I believe I should hash everything... [Using smarty in the examples]
gtag('set', 'user_data', { "sha256_email_address": "{hash('sha256', $order_info.email)}", "address": { "sha256_first_name": "{hash('sha256', $order_info.firstname)}", "sha256_last_name": "{hash('sha256', $lastname)}", "sha256_street": "{hash('sha256', $address)}", "sha256_city":"{hash('sha256', $city)}", "sha256_region":"{hash('sha256', $country)}", "sha256_postal_code": "{hash('sha256', $zipcode)}", "sha256_country": "{hash('sha256', $country)}" } }); **Resources: ** https://support.google.com/analytics/answer/14171598 https://developers.google.com/analytics/devguides/collection/ga4/uid-data
"sha256_city":"{hash('sha256', $city)}", vs "city":"{hash('sha256', $city)}", vs "city":"{$city}",
The documentation shows this clear example (in node.js):
user_data: { sha256_email_address: yourEmailSha256Variable, sha256_phone_number: yourPhoneSha256Variable, address: { sha256_first_name: yourFirstNameSha256Variable, sha256_last_name: yourLastNameSha256Variable, sha256_street: yourStreetAddressSha256Variable, city: yourCityVariable, region: yourRegionVariable, postal_code: yourPostalCodeVariable, country: yourCountryVariable } }The description of user_data.address[].city is
City for the address of the user. Normalized as such:
remove digits and symbol characters lowercase remove leading and trailing spacesSo the answer about your question is:
"city":"{$city}"https://developers.google.com/analytics/devguides/collection/ga4/uid-data?hl=en
Yes, as I have said in the post. What I seek here is wether someone has results/experience or opinions if the documentation might not be full. I'll send a feedback question, but doubt I'll get a response. Time will tell.
The documentation is often not complete, however with regard to the hash Google is very conservative, so where it says it is necessary, it is necessary, for the rest obviously not.