GA4 outbound clicks can include WhatsApp numbers and prefilled text
On our WordPress test site, GA4's automatic outbound click included a WhatsApp number and prefilled message in link_url, even though our custom click_whatsapp event did not include those values. We intercepted the requests containing this fictitious data locally; we did not verify its receipt or storage by Google.
Turning off Outbound clicks removed this automatic event in our tests, at the cost of losing automatic outbound-click measurement. Google's documentation lists link_url among the parameters of outbound clicks and describes exceptions, including links to domains configured for cross-domain measurement. Enhanced measurement.
What we observed
Our WordPress lab used Contact Form 7, a tel: link and two WhatsApp link formats: wa.me/<number>?text=<message> and api.whatsapp.com/send?phone=<number>&text=<message>. Google Tag Manager also sent our custom click_whatsapp and click_phone events. The WhatsApp event used link_host for the destination domain instead of the full link URL.
We clicked the links using fictitious data and inspected the raw URLs and bodies of the GA4 requests, including batches and automatic events. The checks searched for 10 test values in 29 plain or encoded forms.
| GA4 Outbound clicks | What the local interception found |
|---|---|
| On | Two of 15 intercepted requests contained the fictitious WhatsApp number and message in the automatic click event's link_url. |
| Off | None of 13 intercepted requests contained the searched values. Our custom click_whatsapp and click_phone events remained; click_whatsapp retained the destination domain. |
| Restored to on | The two WhatsApp URLs appeared again in the intercepted requests. |
These three runs did not send measurement requests to Google. In a separate run with Outbound clicks off, we allowed real transmission and observed generate_lead, click_whatsapp and click_phone in GA4 Realtime, without the automatic click.
In this setup, the tel: link did not generate an automatic outbound click.
Why inspect the URL?
- Prefilled text may identify a person. If a button inserts a visitor's name, email or form content into its URL, inspect whether those values also appear in the measurement request. A generic product reference is not, by itself, proof of personal information.
- The destination number needs context. It may be a public business contact or a personal mobile number; our fictitious example does not establish which applies to another site.
- A request is not proof of storage. We did not verify these URL values in GA4 reports or explorations. The data-retention setting does not limit standard aggregated reports in the same way as explorations. Data retention.
Google Analytics policies prohibit sending personally identifiable information. Site owners need to check their implementation; a narrowly configured custom event does not control what every other tag sends. Google's guidance on PII.
Check your requests
- Use fictitious test values. Open Chrome DevTools → Network, enable Preserve log and filter by
collect. - Click the WhatsApp link once.
- Inspect the request URL and payload, including batched event bodies, for
en=clickandep.link_url. In our test, that parameter containedwa.meorapi.whatsapp.com. - Allow time for delayed requests. If necessary, navigate within the test site while preserving the log. Finding no request is inconclusive; it does not establish that your setup excludes these values.
Options and trade-offs
Turn off Outbound clicks for the affected web stream. In GA4, open Admin → Data streams → the stream → Enhanced measurement settings. In our test, disabling this option removed the automatic event carrying the two WhatsApp URLs. It is not a general guarantee against personal data in other events or fields. We restored the original setting after the experiment.
This change stops automatic outbound-click measurement for the stream, not just WhatsApp clicks. Agree that change with the person responsible for measurement before applying it. If needed, retain a custom event that sends only the fields required for the task and inspect the resulting requests.
Consider URL query-parameter redaction. Google documents redaction for query parameters in URL fields including link_url. Configuring text and phone may address those query parameters. It does not remove the number in the path of wa.me/<number>. We have not tested this option. This is an inference from Google's documented scope; use its preview and inspect the resulting requests before relying on it. Data redaction.
Avoid inserting personal information into the link itself. Check whether your prefilled text includes names, emails or form content, and whether that information is necessary.
Limits of this demonstration
This was one fictitious WordPress setup in Chrome. We did not test every WhatsApp plugin, server-side tagging, other enhanced-measurement settings, or the storage, report visibility and retention of the full WhatsApp URLs. Other scripts can behave differently.
We found this while testing a Contact Form 7, phone and WhatsApp tracking setup. We offer installation within a defined scope, with test evidence and rollback steps. Contact us before ordering so we can check your setup.
Montherion Labs. Analysis and writing assisted by Claude and Codex. Google Analytics is a trademark of Google LLC. Tracklint is not affiliated with, endorsed or sponsored by Google.