Three Definitions of PII That Do Not Line Up

What is PII?

Three separate texts define PII, and none of them covers the same identifiers. NIST Special Publication 800-122 writes the definition used across the US federal government, the GDPR never uses the term and instead defines "personal data" in Article 4(1), and California defines "personal information" in Civil Code section 1798.140(v). A field outside one definition sits squarely inside another, which is why the "do you collect PII?" checkbox on a vendor security questionnaire has no correct answer until someone says which text is meant.

What does NIST SP 800-122 define as PII?

NIST SP 800-122 defines PII in two parts, one about identification and one about linkage. The publication, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), was published in April 2010. Its executive summary states that PII is:

any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.

A footnote records where the wording came from: it is "the GAO expression of an amalgam of the definitions of PII from OMB Memorandums 07-16 and 06-19", taken from GAO Report 08-536 of May 2008. The canonical US technical definition of PII is an audit office paraphrase of two budget office memoranda, not a statute.

Section 2.2 lists examples: name, personal identification number, address information including email address, telephone numbers, personal characteristics including photographic image and biometric templates, and vehicle registration details. The entry that matters for a web team reads: "Asset information, such as Internet Protocol (IP) or Media Access Control (MAC) address or other host-specific persistent static identifier that consistently links to a particular person or small, well-defined group of people." Read the qualifier. A cookie ID, a device ID and a rotating dynamic IP are not named anywhere in section 2.2.

NIST then does something neither law does: it grades PII. Section 3 assigns every holding a PII confidentiality impact level of low, moderate or high, using six factors, which are identifiability, quantity of PII, data field sensitivity, context of use, obligations to protect confidentiality, and access to and location of PII. It also accepts that some PII needs no confidentiality protection at all, giving an organisation's public phone directory as the example. Neither the GDPR nor the CCPA has an equivalent grading scale.

The scope line matters as much as the definition. The recommendations are "intended primarily for U.S. Federal government agencies and those who conduct business on behalf of the agencies". A private company quoting NIST SP 800-122 at an auditor is borrowing a vocabulary, not citing an obligation.

What does GDPR Article 4(1) cover instead?

The GDPR covers any information relating to an identifiable natural person, and it never uses the abbreviation PII. Article 4(1) reads:

'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person

"Online identifier" is the clause that pulls web analytics in, and Recital 30 says what it means: "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags." No static qualifier, no persistence requirement.

Recital 26 sets the test for identifiability. Account must be taken of "all the means reasonably likely to be used, such as singling out, either by the controller or by another person", weighed against "the costs of and the amount of time required for identification". The same recital confirms that pseudonymised data stays personal data, which is the difference that separates pseudonymization from anonymization in practice.

The GDPR's sensitive tier is Article 9, which prohibits processing of data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, plus genetic data, biometric data used for unique identification, health data, and data concerning sex life or sexual orientation. That list is what GDPR sensitive personal data means, and it does not include a national ID number, a password or a precise location.

What does the CCPA count as personal information?

The CCPA defines personal information around a consumer or a household, which no other framework here does. Section 1798.140(v)(1), in the version in force since January 1, 2026 after amendment by AB 1170, defines it as "information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household".

The statute then enumerates twelve categories, lettered (A) through (L). Subparagraph (A) names "Internet Protocol address" flatly, alongside real name, alias, postal address, unique personal identifier, online identifier, email address, account name, social security number, driver's license number and passport number. Subparagraph (F) names "browsing history, search history, and information regarding a consumer's interaction with an internet website application, or advertisement". Subparagraph (K) names inferences "drawn from any of the information identified in this subdivision to create a profile about a consumer".

Separately, subdivision (aj) defines a unique personal identifier to include "cookies, beacons, pixel tags, mobile ad identifiers, or similar technology". The tracking stack is named by product category in the statute itself.

Two carve-outs pull data back out. Subdivision (v)(2) excludes publicly available information, defined to cover government records and information the consumer made available to the general public without restricting the audience. Subdivision (v)(3) excludes deidentified and aggregate consumer information. Subdivision (ae) then defines a separate sensitive tier covering social security number, account log-in credentials, precise geolocation, genetic data and neural data, where precise geolocation has a number attached: any data used to locate a consumer within "a circle with a radius of 1,850 feet".

The CCPA also only applies to a business that clears one of three thresholds in subdivision (d)(1): gross revenue above $25,000,000, buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving 50 percent or more of annual revenue from selling or sharing personal information. The GDPR has no revenue floor. A fuller side-by-side of the two regimes sits in the CCPA versus GDPR comparison.

Where do the three definitions disagree?

They disagree on the subject, on the identifiers, and on what falls back out. This table reads each identifier against the text that names it.

Three structural mismatches follow from that grid. The subject differs: NIST protects an individual, the GDPR protects a natural person, and only the CCPA protects a household as a unit, so shared-device and shared-address data is regulated in California and unregulated elsewhere. Publicly available information stays personal data under the GDPR and stops being personal information under the CCPA. And the sensitive tiers barely overlap: Article 9 covers political opinions, which the CCPA's list does not name, while the CCPA covers account credentials, precise geolocation and neural data, none of which appear in Article 9.

Is an IP address PII?

An IP address is personal data under the GDPR when the party holding it has a lawful route to identify the person behind it. The Court of Justice settled this in Case C-582/14, Patrick Breyer v Bundesrepublik Deutschland, decided October 19, 2016. The operative ruling holds that a dynamic IP address registered by an online media services provider

constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.

Paragraph 43 concludes that "it is not required that all the information enabling the identification of the data subject must be in the hands of one person". Paragraph 46 sets the limit, excluding identification that is "prohibited by law or practically impossible" because it would demand disproportionate time, cost and staff.

Under the CCPA no such analysis is needed, because IP address is listed by name. Under NIST SP 800-122 the example covers a persistent static identifier, so a rotating residential IP is outside the illustration even though the linked-or-linkable half of the definition may still catch it. The whole divergence sits in one field, unpacked further in whether an IP address is personal data.

Privacy first analytics reports traffic and conversions without cookies or personal data collection, which removes the identifier question from the reporting layer rather than answering it, and session replay masking is where the same question resurfaces at the DOM level.

Frequently asked questions

Does the GDPR use the term PII?

No. The GDPR uses "personal data" throughout and never uses the abbreviation PII. Article 4(1) is the definition, and Recitals 26 and 30 supply the identifiability test and the online identifier examples. Treating the two as synonyms understates GDPR scope, because personal data reaches inferences, pseudonymised records and online identifiers that the NIST example list does not name.

Is hashed data still PII?

Hashing is pseudonymisation, not anonymisation, whenever the hash can be matched with additional information. GDPR Recital 26 states that data which "could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person". The CCPA defines pseudonymisation at subdivision (aa) and excludes only deidentified and aggregate consumer information at (v)(3), so a reversible hash stays personal information.

Does the CCPA apply to every business?

No. Section 1798.140(d)(1) sets three thresholds and a business must meet at least one: gross revenue above $25,000,000 in the preceding calendar year, buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving 50 percent or more of annual revenue from selling or sharing personal information.

What is the difference between PII and sensitive personal information?

Sensitive personal information is a named subset that triggers extra obligations. The CCPA defines it at subdivision (ae): social security number, account log-in credentials, precise geolocation, racial or ethnic origin, genetic data and neural data. The GDPR's equivalent is Article 9, built around racial or ethnic origin, political opinions, religion, trade union membership, genetics, biometrics for identification, health and sex life.

Is aggregate analytics data PII?

Not under the CCPA, which excludes aggregate consumer information at subdivision (v)(3) and defines it at subdivision (b) as information "from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household". The GDPR reaches the same result through Recital 26, but only if no means reasonably likely to be used could single a person out again.

How precise does location have to be before the CCPA calls it sensitive?

Subdivision (w) defines precise geolocation as data used to locate a consumer within "a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet". City-level location derived from an IP address sits well outside that radius and is not precise geolocation under the statute.

Does NIST SP 800-122 apply to private companies?

NIST SP 800-122 is written primarily for U.S. federal agencies and the contractors that do business with them, not for private companies in general. A vendor that cites it in a security questionnaire is borrowing federal vocabulary rather than pointing to a law that binds them. Nothing in the publication creates an obligation the way GDPR Article 4(1) or CCPA 1798.140(v) does for the entities they cover.

Is browsing history PII?

The CCPA names browsing history and search history outright at subparagraph (v)(1)(F), so it counts as personal information without argument. The GDPR reaches the same result through the general definition in Article 4(1), since browsing activity relates to an identifiable person. NIST SP 800-122's section 2.2 examples never mention browsing history at all.

Does the GDPR grade PII by risk level like NIST does?

Grading by risk level is a NIST-specific feature that neither the GDPR nor the CCPA replicates. NIST SP 800-122 assigns every PII holding a confidentiality impact level of low, moderate or high, based on six factors including identifiability and data field sensitivity. The GDPR and CCPA set obligations by category of data instead, through tiers like Article 9 and CCPA subdivision (ae), rather than a scored scale.

Is household data covered as PII?

Only under the CCPA, which protects a household as well as a particular consumer and defines household at subdivision (q). NIST SP 800-122 and GDPR Article 4(1) both stop at the individual, so shared-device and shared-address data is regulated in California and unregulated under the other two frameworks. That difference is one of the three structural mismatches the definitions produce.