Personally Identifiable Information: Examples and Why PII Isn't the Same as Personal Data

PII is a term with no single definition in the U.S. Broadly, it refers to any information that can identify an individual either directly or indirectly. This guide will list the most common examples of personally identifiable information, show how they are different from personal data as defined in the EU GDPR, what obligations are in different jurisdictions, and what website owners can do to respect both.

You may already be working to protect PII and assume the same approach will carry over from the U.S. to the European market or vice versa. A common but mistaken assumption. PII is a U.S. term with its own definitions, and it does not map neatly onto personal data under the GDPR.

In reality, both personally identifiable information and its U.S. meaning are distinct from personal data as defined in General Data Protection Regulation (GDPR). The differences may seem nuanced, but they can affect which rules apply to your website and carry real penalties under European data protection law.

This article will give you an accurate PII picture and the categorized list of PII examples. Then, we will resolve why the same data point can have a different status under PII and personal data, and what you can do to support your compliance obligations under both.

What Is PII?

From the U.S. National Institute of Standards and Technology (NIST) glossary, personally identifiable information (PII) is information that can be used to distinguish or trace an individual’s identity. 

The U.S. General Services Administration (GSA), applying the Office of Management and Budget definition, notes that PII is not tied to any single category of information and requires a case-by-case assessment of the specific risk that an individual can be identified.

Even though there is no unified legal PII definition or protocol for its protection in U.S. state laws, businesses should apply the appropriate safeguards for PII based on its confidentiality impact level. PII breach is a severe compliance risk, along with loss of customer trust and other implications, so implementing reasonable security helps reduce exposure.

Personally Identifiable Information Examples

Examples of personally identifiable information include direct and indirect identifiers, or linked and linkable information with different confidentiality impact levels on exposing the individual’s identity. 

According to NIST, linked information is already logically associated with other information about the individual, while linkable information could be. 

The lists below sort PII by how directly it identifies a person. A second classification, by sensitivity, follows in the next section. The two are independent: a full name, for example, is a direct identifier but is usually treated as non-sensitive PII.

Direct Identifiers

Full name

Home address

Personal phone number

Social Security number (SSN)

Taxpayer identification number

Driver's license number

Passport or national ID number

Biometric data (fingerprints, retinal scans)

Financial account numbers

Medical record numbers

Indirect Identifiers

Date of birth

Place of birth

Age range

ZIP/postal code or broader geographic area

Workplace or school name

Job title

Education level

Religious affiliation

Political views

Race or ethnicity

Weight

Family members

Business telephone number

Email address (when it does not contain a name)

Direct Identifiers

Direct identifiers, or linked information, are logically associated with an individual, or unique and strong to point at them directly. They include:

• Full name
• Social Security number (SSN)
• Taxpayer identification 
• Financial account numbers
• Passport information
• Driver’s license number
• Biometric information
• Medical record numbers

Direct identifier definitions are closely related to the current technical capabilities for identifying consumers from PII data points. The more enhanced the technology in linking data to a consumer is, the broader the list of direct identifiers can become. 

Indirect Identifiers

Indirect identifiers, grouped as linkable information, are data that enable logical association with other information about the individual. Though a single indirect identifier is not strong enough to distinguish an individual, their combination can make the disclosure possible.

The examples of indirect identifiers include:

• Date of birth 
• Age range
• Workplace name
• Job title
• ZIP/postal code 
• General geographic area
• Religious beliefs
• Political views
• Race/ethnicity
• Weight
• Educational information
• Family members

The list of indirect identifiers can be shorter or longer in each particular case, depending on the context. For example, the combination of a ZIP code or a date of birth may not be enough to identify a person in a metropolitan area, but it can be enough to identify someone in a small rural area.

Non-Sensitive vs. Sensitive Personally Identifiable Information: What’s the Difference?

In the U.S., the distinction between non-sensitive and sensitive PII depends on the potential damage that the disclosure of a data unit can cause. 

Sensitive personally identifiable information is a high-risk subset where each individual PII data field or combination of several data fields can cause significant harm, while non-sensitive information doesn’t lead to such severe consequences.

These labels come from federal guidance and industry practice, not from a single U.S. statute. NIST guidance ties protection levels to context of use, so the same data element can warrant different levels in different settings. 

U.S. state privacy laws also define their own 'sensitive data' categories, which typically include, for example, racial or ethnic origin, religious beliefs, and health information.

Non-Sensitive PII (Low to Moderate Risk)

Full name

Email address

Business telephone number

ZIP/postal code or broader geographic area

Weight or other broad medical information

Workplace or school name

Public information from websites or social media

Sensitive PII (Moderate to High Risk)

Authentication data (passwords, secret words, biometric identifiers)

Banking information (bank accounts, credit or debit card numbers)

Government-issued ID numbers (SSN, driver's license, passport)

Medical records

Non-Sensitive Personally Identifiable Information

Non-sensitive PII unites direct and indirect identifiers that fit the personally identifiable information definition but don’t pose significant harm to an individual on their own. The examples generally include relatively broad PII that needs more data points to potential expose an individual:  

• Full name
• Email address
• Business telephone number 
• Public information available on the website or social media
• ZIP/postal code or broader geographical area information
• Weight or other broad medical information

The non-sensitive data is still PII that requires protection (especially when combined), yet due to its nature, the higher priority and more security controls are generally dedicated to sensitive PII. 

Sensitive Personally Identifiable Information

Sensitive PII is a potentially high-damage PII subset, as information from it can be especially harmful for an individual. For example, it is the data used as an authentication factor for password recovery or as protection for banking accounts.

The full list of sensitive personally identifiable information examples includes:

• Authentication data (passwords, secret words, biometric identifiers)
• Banking information (bank accounts, credit or debit card numbers)
• Government-issued ID numbers (SSN, driver’s license, passport)
• Medical records
• Educational records (test performance, school attendance, course-taking)

Confidential information about individuals requires the highest level of protection possible, and the non-sensitive PII is generally treated as a risk multiplier for sensitive PII. Many organizations classify sensitive PII as restricted and non-sensitive PII as confidential, though labels vary by organization. The exact measures to protect sensitive and non-sensitive PII depend on each particular business context.

What Is the Difference Between PII and Personal Data?

The key difference between U.S.-focused PII and personal data as defined in GDPR is the set of information each term includes. While U.S. frameworks concentrate on information that can identify a person, GDPR refers to a broader set of information that can relate to an identifiable person. 

Simply put, most PII is personal data under the GDPR, but a good deal of personal data is not treated as PII in the U.S.

What Is Personal Data?

Under Art. 4(1) GDPR, personal data is any information relating to an identified or identifiable person, or someone who can be identified directly or indirectly, including by an online identifier. 

Examples of personal data include:

• Basic identity information such as name, address, and ID numbers
• Web data such as location, IP address, cookie data, and RFID tags
• Health data
• Genetic and biometric data
• Racial or ethnic data
• Political beliefs
• Sexual orientation
• Trade union membership

Health, genetic, biometric, racial or ethnic, political, religious or philosophical, sexual orientation, and trade union data are special categories of data under Art. 9 GDPR, which carries stricter conditions for processing.

As for the key requirements to personal data collection, businesses should follow the GDPR principles of data minimization and storage limitation, per Art. 5 GDPR, and identify a lawful basis under Art. 6 GDPR for each processing purpose.

Obtaining opt-in consent as a freely given, specific, informed, and unambiguous user permission via a cookie consent banner is a common way to meet GDPR requirements. 

What Is Personal Information?

Under the California Consumer Privacy Act (CCPA) personal information refers to any information (including pictures and sounds) that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. 

Similar to the GDPR, the CCPA doesn’t rely on PII but introduces a broader category of personal information instead. 

Examples of PII under the CCPA include:

• Full name
• Date of birth
• Social Security number (SSN)
• Phone number
• Email address
• IP address and device identifiers
• Internet activity (e.g., browsing history, search history, data on interaction with a web page)
• Financial information (e.g., bank account numbers, credit card details)
• Biometric data (e.g., fingerprints, facial recognition data)
• Inferences drawn from other personal information to create a consumer profile

The CCPA applies to for-profit businesses that do business in California and meet at least one of three thresholds:

• Earn gross annual revenue exceeding USD 26,625,000 (periodically adjusted for inflation)
• Buy, sell, or share the personal information of more than 100,000 consumers or households annually
• Derive 50 percent or more of their annual revenue from selling consumers’ personal information

A covered business must honor consumer rights to know, delete, correct, and opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. 

Identifier by Identifier: U.S. PII vs. GDPR Personal Data

The table below shows how common identifiers are typically treated under U.S. PII guidance and under the GDPR. U.S. status depends on context and the applicable law.

Practical Implications of Personal Data vs. Personally Identifiable Information Examples Mismatch

Personal data under the GDPR has a broader scope than PII as traditionally defined in the U.S. It includes online identifiers and pseudonymized data that can be re-identified. As a result, some data points that may fall outside PII definitions count as personal data in the EU, and processing them requires a lawful basis. 

Separately, the ePrivacy Directive requires prior consent before non-essential cookies are stored or accessed, whether or not the data involved is personal.

Are Online Identifiers Examples of Personally Identifiable Information or Personal Data?

Based on the GDPR’s personal data definition and PII examples clarification in U.S. provisions, online identifiers such as cookies, IP addresses, device information, and browser fingerprints are generally personal data under the GDPR. Whether they count as PII in the U.S. depends on context and the applicable law.

Since what is considered personally identifiable information is context‑ and statute‑dependent in the U.S., the status of online identifiers as PII is not straightforward. If an IP address is properly anonymized, meaning it’s not simply masked, and doesn’t enable recognition or linkage to an individual, it is not PII. 

Still, the FTC has long taken the position that data is personally identifiable when it can be reasonably linked to a particular person, computer, or device. In a 2016 FTC Business Blog post, the then-director of its Bureau of Consumer Protection said persistent identifiers such as device identifiers, MAC addresses, static IP addresses, and cookies often meet that test.

Recital 30 GDPR names IP addresses and cookie identifiers specifically as examples of online identifiers under the personal data term. As device information and browser fingerprinting can be linked to a person, they are also frequently considered personal data. 

Under Art. 5(3) of the ePrivacy Directive, storing or accessing information on a visitor's device, such as setting a non-essential cookie, generally requires prior consent that meets the GDPR standard. Any resulting processing of personal data also needs a lawful basis under Art. 6 GDPR.

What The PII vs. Personal Data Distinction Means for Your Cookie Banner

Personal data and personally identifiable information examples, and legal differences between them, may sound too abstract in theory, but they have highly practical implications. 

The rules are simple: 

• You should introduce security measures to protect PII, from basic safeguards up to restricting access to sensitive PII.
• If an identifier counts as personal data under GDPR, your consent mechanism needs to cover it regardless of its U.S. PII status.

Within the U.S., whether an online identifier counts as personal information depends on the applicable law. The CCPA, for example, lists IP addresses and other online identifiers expressly, while federal PII guidance calls for a case-by-case risk assessment.

But in GDPR terms, online identifiers are part of personal data definition. So, if your website collects an EU visitor's advertising ID via a marketing cookie, you should protect it as personal data and ask for visitor consent through a consent banner designed to meet GDPR requirements.

Cookiebot™ CMP by Usercentrics supports multi-regulation privacy compliance. With geotargeting, Cookiebot™ CMP determines each visitor's location in real time from an anonymized IP address. 

For visitors in the EU or California (and its CIPA requirements), a banner configured for opt-in consent can hold non-essential cookies and trackers until the visitor makes a choice. For visitors in U.S. states, a region-specific banner can follow an opt-out model.

You don't have to track every legal definition yourself. Cookiebot™ helps  automate regional consent handling, so your banner reflects the rules that apply to each visitor.