How does data privacy differ from data security?

Security is about blocking unauthorised access: encryption, access control, environment separation. Privacy is about the boundary of authorised access: what may be collected at all, for which purpose and for how long. A system can be entirely secure and still breach privacy, because it collected data it should not have.

What should web analytics never send in an event property?

National ID numbers, card numbers, passwords, session tokens and any string that identifies a person on its own must not appear in an event name, a property, or even the page URL query string, because the URL is recorded as context too. When behaviour has to be linked to an account, send an opaque identifier instead of identifying data and keep the mapping in your own system.

Data Privacy

Intermediate

Updated Jul 11, 2026 Shahin editorial 2 min read

PronunciationEN/ˈdeɪtə ˈpraɪvəsi/

Data privacy is the principle that personal data is collected and used only on a stated basis, only as much as needed, and only within limits the person is aware of.

Privacy rules differ between markets, but a few obligations recur in most of them: a stated basis for collection, use limited to the purpose announced, collecting no more than needed, a ceiling on how long data is kept, and a route for a person to access or delete their own data. Privacy is not security: security keeps unauthorised access out, privacy asks how far authorised access should extend in the first place. In web analytics the site owner usually determines the purpose of processing and owes the notice to visitors, while the analytics tool processes on the owner's instruction; that split is set out in the service agreement and is no substitute for legal advice.

FAQ

Sources:GDPR — Article 5, principles of processing