Personally identifiable information (PII)

What is personally identifiable information (PII)?

Personally identifiable information (PII) is an American legal term for any data that could identify a specific individual.

PII may include the following:

  • Full name
  • Home address
  • Email address
  • Social security number
  • Device identifiers
  • Email addresses
  • Passport number
  • Driver’s license number
  • Credit card number
  • Date of birth
  • Telephone number
  • Owned properties, e.g., vehicle identification number (VIN)
  • Login details
  • Processor or device serial number
  • Media access control (MAC)
  • Internet Protocol (IP) address
  • Device IDs
  • Cookies

US government agencies and non-governmental organizations often reference PII. The US lacks an overriding law covering PII in all 50 states, so your understanding of PII may differ depending on the state or sector you operate in. A standard definition is provided by the National Institute of Standards and Technology (NIST):

PII is any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.

You may also like:


  • 4 ways to make your analytics HIPAA-compliant: Implementation guide

    Healthcare organizations have four main approaches to achieving HIPAA-compliant analytics. Each has different trade-offs in cost, technical complexity, and analytics capabilities. This guide compares all four implementation methods – from using Google Analytics with workarounds to deploying fully HIPAA-compliant analytics platforms – so you can choose the right approach for your organization’s needs and resources.

  • Is Google Analytics HIPAA-compliant?

    If you use Google Analytics or similar software, you’re likely already optimizing your website to serve your customers better. But what about Google Analytics and HIPAA compliance? In short – if you’re a HIPAA-covered entity, using GA4 puts you at serious risk of a HIPAA breach. Google states that Google Analytics doesn’t satisfy HIPAA requirements. And…