Worked for a an analytics company, and this was a problem for us, because we didn't want to collect pii at all.

So as soon as there was an @\S+\. in a url we were anonymizing the full url. Customers were not happy though

But I can tell you that this was present on a lot of websites including Bank websites