# What is PII (personally identifiable information)? > What actually counts as PII, how it differs from personal data under the GDPR, and why the distinction matters for the trackers running on your site. Author: OptinStack Team Published: 2026-06-27 Page: https://optinstack.com/blog/what-is-pii-personally-identifiable-information Markdown: https://optinstack.com/llms.md/blog/what-is-pii-personally-identifiable-information Personally identifiable information, or PII, is one of those terms that shows up in nearly every privacy conversation but rarely gets a precise definition\. If you are building a website, running analytics, or wiring up a consent banner, you have probably run into it\. This post unpacks what PII actually means, how it relates to personal data under laws like the GDPR, and why the distinction matters for the trackers running on your site\. ## What PII means PII is any information that can be used, on its own or combined with other data, to identify a specific person\. That covers obvious examples like a full name, home address, or government ID number, and it extends to less obvious identifiers like an email address, a phone number, or a device identifier\. The common thread is identifiability: could this data, in context, point back to one person? The U\.S\. National Institute of Standards and Technology frames it as any information that can distinguish or trace an individual, while the European GDPR uses the broader term personal data to mean any information relating to an identified or identifiable person\. In practice the two concepts overlap heavily, even if the legal wording differs\. ## Examples of PII It helps to split PII into two groups\. Directly identifying information can single someone out on its own, while indirectly identifying information only becomes identifying when combined with other data\. ### Directly identifying \(often treated as sensitive\) - Full name - Home address - Phone number - Email address - Date of birth - Passport or national ID number - Payment card or bank account number - Medical records - Biometric data such as fingerprints or facial geometry ### Indirectly identifying \(sometimes called linkable data\) - IP address - Device or cookie identifiers - Approximate location data - Partial address or postal code - Employer name - Age range The split matters because privacy laws tend to place stricter obligations on sensitive categories\. Under several frameworks, sensitive data requires stronger consent, tighter access controls, and sometimes an explicit legal basis before you can process it\. ## PII versus personal data People use PII and personal data interchangeably, but they are not quite the same\. PII leans toward information that identifies, locates, or contacts a person\. Personal data, especially as the GDPR defines it, is broader and covers anything that could single someone out, even indirectly\. This is why technical identifiers like IP addresses, cookie IDs, and device fingerprints count as personal data under the GDPR even where some U\.S\. frameworks would not call them PII\. If you operate under the GDPR, apply its definition rather than a narrower one, because the regulation is built around the full scope of personal data\. ## How PII connects to cookies and trackers A cookie file itself is not PII\. The question is whether the data a cookie collects can identify or profile someone\. In most advertising and analytics contexts, it can\. Cookie identifiers, IP addresses, and behavioral signals are regularly combined to build profiles of identifiable individuals, which puts that data inside the scope of personal data under the GDPR and personal information under the CCPA and CPRA\. This is the gap a consent banner is meant to close\. By collecting clear consent before non\-essential trackers load, and by enforcing that choice against third\-party scripts and iframes, you keep the data flowing through those trackers aligned with what each visitor actually agreed to\. It also gives you a record you can point to during an audit\. ## Common questions, briefly ### Is a name PII? Usually yes\. A name identifies someone in many contexts, and it becomes a strong identifier when paired with a phone number or payment number\. It is also commonly used to look up other PII, so it deserves careful handling\. ### Is an IP address PII? It depends on context and jurisdiction\. An IP address alone may not directly identify someone, but combined with other data it can track or single out an individual\. The GDPR treats IP addresses as personal data, and some U\.S\. laws treat them as personal information\. ### Is salary PII? Only when tied to an identifiable individual\. A list of salaries across a company is not PII on its own, but a salary inside a specific person's HR record is, because it is connected to that person and should be kept confidential\. ### Is a work email address PII? Often, yes\. A work email may identify a professional identity rather than a personal one, but when it contains a person's name and company it can be personally identifying\. Stricter regimes like the GDPR are more likely to classify it as PII\. ## What happens when PII is breached A breach can trigger mandatory notification duties, regulatory fines, and lasting reputational damage\. The GDPR requires notifying your supervisory authority within 72 hours when a breach risks individuals rights, and notifying affected people directly when the risk is high\. Many U\.S\. state laws set their own, often shorter, windows\. Penalties scale with the harm\. GDPR fines can reach the higher of EUR 20 million or four percent of global annual turnover, while U\.S\. laws stack per\-violation amounts that add up quickly\. Breaches involving sensitive data like health or financial records also raise the chance of identity theft and fraud for the people affected\. ## Practical takeaways - Treat anything that could identify a person, directly or indirectly, as in scope for your privacy controls\. - Default to the broader personal data definition under the GDPR rather than a narrow reading of PII\. - Assume cookie IDs, IP addresses, and device fingerprints are identifying in advertising and analytics contexts\. - Gate non\-essential trackers behind clear consent and enforce that choice so the data you collect matches what visitors agreed to\. - Keep records of consent so you can evidence compliance during an audit or after an incident\. Understanding PII is the foundation for everything else in consent and privacy work\. Once you know which data points identify people, the rest of the stack, notices, consent modes, enforcement, and records, follows from there\.