PIIs and payment details are radioactive if explicitly collected as such, or just "anonymized" query parameters if not.