I think it's probably OK to have an expectation for us (as clients) to exercise caution and responsibility when collecting URL information. Query parameters in page URLs (such as UTM parameters) are often useful bits of information for reporting, so if Glean stripped these out at the platform SDK level, I think clients would likely just end up implementing their own click events instead. In bedrock, everywhere we're likely to capture a click event we would already be firing a page_load event. So we're already very careful not to include any sensitive information in our page load events.
Bug 1867294 Comment 13 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I think it's probably OK to have an expectation for us (as clients) to exercise caution and responsibility when collecting URL information. Query parameters in page URLs (such as UTM parameters) are often useful bits of information for reporting, so if Glean stripped these out at the platform SDK level, I think clients would likely just end up implementing their own click events instead. In bedrock, everywhere we're likely to capture a click event we would already be firing a page_load event. So we're already very careful not to include any sensitive information in our page load event URLs.