Personally identifiable information (PII)

What is personally identifiable information (PII)?

Personally identifiable information (PII) is an American legal term for any data that could identify a specific individual.

PII may include the following:

  • Full name
  • Home address
  • Email address
  • Social security number
  • Device identifiers
  • Email addresses
  • Passport number
  • Driver’s license number
  • Credit card number
  • Date of birth
  • Telephone number
  • Owned properties, e.g., vehicle identification number (VIN)
  • Login details
  • Processor or device serial number
  • Media access control (MAC)
  • Internet Protocol (IP) address
  • Device IDs
  • Cookies

US government agencies and non-governmental organizations often reference PII. The US lacks an overriding law covering PII in all 50 states, so your understanding of PII may differ depending on the state or sector you operate in. A standard definition is provided by the National Institute of Standards and Technology (NIST):

PII is any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.

You may also like:


  • PHI and PII

    HIPAA violations and fines: What healthcare organizations need to know

    Quick summary HIPAA violations happen when a covered entity or business associate fails to meet the HIPAA Privacy, Security or Breach Notification Rule. Civil penalties range from a few hundred dollars to more than $2 million per violation, set across four tiers based on how much the organization knew.  What this guide covers: HIPAA violation…

  • The EDPB’s new data anonymization guidelines: what they mean for your analytics data

    Removing names, cookies and IP addresses is no longer enough to anonymize data. Here’s what the 2026 EDPB framework actually requires for anonymous data collection, what’s still unresolved, and how to configure your analytics to stay compliant while keeping the full view of traffic marketers rely on.