PII leaking into spans and attributes
Developers instrument spans with request parameters, user IDs or payload fields without realising those values contain regulated personal data. Once in the backend, PII is hard to purge and may violate GDPR or HIPAA data-handling requirements.