Overview
This check inspects the actual variable payloads sent by analytics and advertising tags for identifiers CCPA treats as regulated PI or SPI (email addresses, phone numbers, government IDs, health or financial account numbers, and similar patterns) that should not be present in outbound tag traffic, whether by design or as a side effect of a misbound data layer.
Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific CCPA/CPRA compliance obligations.
Why it is important
CCPA treats any outbound transmission of these identifiers as regulated activity, and a tag carrying PI/SPI in its payload, even unintentionally, through a data-layer variable that was bound to the wrong field, creates real exposure regardless of whether the vendor is a fully authorized service provider, since the transmission itself, not just the vendor relationship, is what's regulated.
Implementation
Run a Tag Variables audit across your tag inventory, prioritizing tags labeled "CCPA Sale/Share" first.
Check the pre-built ObservePoint report for Tag Variables where you need to filter with regex rules for email / phone / SSN / payment card patterns or add more regex patterns for PII you determine are required.
For each flagged tag, trace the value to its data-layer field, and consider
scan_audit_pii's canary-based approach for definitive proof on a specific high-risk flow like checkout.
Remediation
For remediation, follow the next steps:
For each tag flagged with a PI/SPI-matching variable, trace the value back to the data-layer field or DOM element it's bound to. A misbound data-layer variable (for example, a variable intended to capture a product category accidentally capturing a user's email from an adjacent form field) is the most common root cause and is usually a data-layer configuration fix rather than a tag-manager fix.
Where the PI transmission is intentional (a legitimate use case such as a customer-service integration), confirm the receiving vendor is appropriately classified and contracted under the Third-Party Vendors & Service Providers policy rather than remediating it as an error.
Re-run the Tag Variables scan after each data-layer or tag correction to confirm the pattern no longer appears in the payload.
Conclusion
Because a single misbound data-layer variable can silently leak PI across every tag that reads from it, treat any PI-pattern finding as a signal to review the underlying data layer, not just the individual tag it happened to surface on.