How to limit/choose what profile data is included in confirmation emails?
It looks possible by editing the Workflow Message Template for online receipts. (Thanks @RebeccaTregenna for hint) This is written in Smarty code.

There are two options:


Remove all customPre and customPost sections.
Add logic to identify the fields you don't want and filter those out.


Making these changes is difficult, it's code with logic, there's no validation either, so easy to make a mistake or delete the wrong bit. So save a copy of the original version before you make changes!

I went for (1) for the time being because we had so many extra fields that just listing them would have been time consuming. Also, as we can only filter on the field's label, were anyone to tweak that slightly the logic would fail and that would start getting output without us knowing. Also, I wasn't sure any of the fields were really needed in the receipt, so I took a conservative approach (as in erred on the safe side, as opposed to a Conservatives approach which is to err on the unsafe side and not take coronavirus seriously until it's too late)

Looking at the template code, it already includes code for selectively removing fields defined in a $trackingFields array, however I can't see that that is ever defined anywhere.