pii.phone_number
A phone number, written with a "+" country code, appears in the free text.
What it looks at#
A regex for a leading + followed by a plausible run of digits (7-15 of them once
spaces, dots, dashes and parentheses are stripped — E.164’s own bounds on a full
international number). A bare digit run with no + is never matched: without a country
code there’s no way to tell a phone number from an order number, a reference code, or any
other digit string, and those are everywhere in real text.
Why it matters#
A phone number is personal data. Requiring the + prefix is a deliberate precision
trade-off — it misses locally-formatted numbers (e.g. a domestic 07... UK number with no
country code) in exchange for essentially never flagging something that isn’t a phone
number at all.
What to do#
Low severity, same reasoning as pii.email_address. Use redact: "mask" before storing
or forwarding text you don’t need the raw number in.