---
title: Prevent indexing of PII data
slug: cms-12/docs/filter-pii-data-from-being-indexed
docTags: 
createdAt: 2026-08-10T15:55:55.000Z
---

This topic describes an important part in [managing GDPR compliance](docId\:Ed6SdCbxpsP1DiVOwGrSd).

`IGDPRConventions` and `ITrackSanitizerPatternRepository` are used for adding the filtering.

## IGDPRConventions

`IGDPRConventions` has these methods.

- Set patterns to remove GDPR data from a search query.
  `public virtual void SetGDPRPatterns(List<GDPRPattern> gdprPatterns)`
- Get the GDPR patterns to be removed in a search query
  `public virtual IEnumerable<GDPRPattern> GetGDPRPatterns()`
- Delete the GDPR data in the search query that matches the patterns.
  `public string RemoveGDPRDataInQuery(string queryStringQuery)`

## ITrackSanitizerPatternRepository

The `ITrackSanitizerPatternRepository` has these methods.

### Add patterns to remove PII data from search query

- Add single pattern
  `public string Add(TrackSanitizerPattern pattern)`
- Add multiple patterns
  `public void Add(IEnumerable<TrackSanitizerPattern> patterns)`

### Update patterns to remove PII data from search query

- Update single pattern
  `public string Update(TrackSanitizerPattern pattern)`
- Update multiple patterns
  `public void Update(IEnumerable<TrackSanitizerPattern> patterns)`

### Get patterns to remove PII in search query

- Get a pattern by ID
  `public TrackSanitizerPattern Get(string patternId)`
- Get all patterns
  `public IEnumerable<TrackSanitizerPattern> GetAll()`

### Delete PII data in the search query that matched the patterns

- Delete a pattern by ID
  `public void Delete(string patternId)`
- Delete all patterns
  `public void DeleteAll()`

### Example filters

The patterns support plain text, wildcards, and regex. Here are some example filters.

- Full name – “John Smith,” “Steven,” and so on.
- Keyword contains email – `*@gmail.com`, `*@yahoo.com`, and so on.
- Regex string – `\w+([-+.]\w+)*@\w+([-.]\w+)*.\w+([-.]\w+)*` and so on.

```csharp
public class Sample {
  protected IClient _client;
  protected IStatisticsClient _statisticsClient;
  protected ITrackSanitizerPatternRepository _trackSaniziterRepository;
  public Sample(IClient client) {
    _client = client;
    _statisticsClient = client.Statistics();
    _trackSaniziterRepository = client.TrackSanitizer().TrackSaniziterRepository;
  }

  public void Test() {
    // Setting and add sanitizer patterns.
    _trackSaniziterRepository.Add(new List<TrackSanitizerPattern> {
      new TrackSanitizerPattern {
        PatternString = "admin",
          PatternType = TrackSanitizerFilterType.PlainText
      },
      new TrackSanitizerPattern {
        PatternString = "email",
          PatternType = TrackSanitizerFilterType.PlainText
      },
      new TrackSanitizerPattern {
        PatternString = "*@mail.com",
          PatternType = TrackSanitizerFilterType.Wildcard
      },
      new TrackSanitizerPattern {
        PatternString = "1#1",
          PatternType = TrackSanitizerFilterType.Wildcard
      },
      new TrackSanitizerPattern {
        PatternString = "c[a-e]ll",
          PatternType = TrackSanitizerFilterType.Wildcard
      },
      new TrackSanitizerPattern {
        PatternString = @ "\w+([-+.]\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*",
          PatternType = TrackSanitizerFilterType.Regex
      }
    });

    // Doing Tracking behavior
    var result = _client
      .UnifiedSearchFor(@ "admin@mail.com")
      .StatisticsTrack()
      .GetResult();

    // Try to get GDPR data by exact term matched sanitize pattern.
    var response = _statisticsClient.GetGDPR("admin@mail.com", x => {});
  }
};
```

The `_statisticsClient.GetGDPR()` API only support exact term search due to limitations of statistics indexes.

## Install and verify PII filtering

The steps below describe how to implement and verify the PII filtering.

- CMS Alloy sample site (for CMS 11 and Commerce 13) [installed from the Visual Studio Extension](docId\:EKO5aFKrSjsNR6Mgr7hQf). See also [Install Optimizely .NET5](docId\:VuiU-K4aAR6ISGicFg4lk) for CMS 12 and Commerce 14.
- Optimizely Search & Navigation [service URL and default index name](docId\:jO69ztYFtZG_yn5HU2d8o), for example `http://es-api-test01.episerver.com/>\<PRIVATE_KEY>`.
- Optimizely Search & Navigation [client-side resource base URL](docId\:EKO5aFKrSjsNR6Mgr7hQf), for example `https://dl.episerver.net/13.2.0`.
- Optimizely Search & Navigation 13.2.0

### Install PII filtering packages

1. In Visual Studio, set the default project to `Templates.Alloy`.
2. Install the following NuGet packages (use the “-pre” option to get the latest development package).
   - `Find.Cms`
   - `Find.Statistics`
3. Open the Alloy `web.config` file and update the following entries:
   - In the `<episerver.find>` tag
     - `serviceUrl`
     - `defaultIndex`
   - In the `<episerver.find.ui>` tag
     - `clientSideResourceBaseUrl`
   - In the `<appSettings>` tag
     - add an item with key `episerver:Find.TrackingSanitizerEnabled` and value true
4. Access Admin Mode and add a GDPR test page.
   a. Go to CMS > **Admin** > **Content Type** tab > **Page Types** > **\[Specialized]Start Page** > **Settings**.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/24HG8D8-4W-y_UTt0gWIM_75eeca3-68e7e6c-page-types-information.png)

b. Click **Available Page Types** and check  **pecialized] FFind GDPR API Demo Page** and click **Save**.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/8hJI8sntNJPjylKbj8emt_dbc5328-f72815a-page-types-settings.png)

3. Go to the CMS **Edit** > navigation panel > **Pages** tab > **Start** branch of the tree structure.
4. Create a GDPR Search page and publish it.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/sWmG7AEunikwpxTz7EgDs_e038bd3-c5fc995-create-gdpr-search-page.png)

5. Return to CMS > **Admin** view.
6. Under **Scheduled jobs**, click **Optimizely Find Content Indexing Job** and start that job manually.

### Verify PII filtering

In these steps, you perform a search, delete the GDPR-related data, and add a filtering pattern to prevent it from being indexed.

1. Open the GDPR Demo page created in the previous steps. Clear the GDPR pattern settings to verify that the tracking function runs well.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/wqO5H_NdjOBmf-F_EiTXg_29f0f54-bf460f0-demo-page1.png)

2. Go to the search page and execute a search with some keywords.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/V-G22kNjnf77-hhzvK8PP_7110d17-demo-page2.png)

3. Go to the GDPR Demo page and review the displayed data.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/XG5BWzaKuSKhTzL78KqhQ_f3c3e71-demo-page4.png)

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/Go9u6_1aJ2eu0-Tvgcf_O_9ba4ed1-demo-page5.png)

4. Delete the existing GDPR data and set patterns to prevent it.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/rxKTsFXashUxVMdFNySgg_3d7c463-demo-page6.png)

5. Search again and recheck for the GDPR data, which should now be filtered out.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/-WK61CccYqJuk_KJdvcqM_280a546-demo-page7.png)

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/O7S3X6kaX0n7KAHCEe0Bm_7dbd463-demo-page8.png)