Personally Identifiable Information (PII) data explained

With data protection rules getting stricter, protecting customer privacy is now a key focus for anyone working in digital marketing. While marketers handle different types of data at all times, one type of data is particularly sensitive. We’re talking about Personally Identifiable Information. 

In this post, we will cover the basics of PII, explain why it matters, how to handle it responsibly and safely, and show how server-side tracking can help with obtaining compliance while handling PII. 

What is PII?

Let’s start with the PII meaning so we’re on the same page along the way. 

The scope of personal data varies by legal jurisdiction based on the state, country and region. PII is further divided into two categories - sensitive and non-sensitive. 

Examples of Personally Identifiable Information

As you can see from the diagram below, PII data examples include personal details (e.g., full name, address), identification numbers (e.g., passport, SSN), contact information, health records, financial data, biometric records, criminal or employment history, and digital identifiers (e.g., IP address, login credentials).

As you can see from the examples of PII, there is a wide range of data points that can impact a person’s privacy and identify them directly or indirectly. And whether a piece of data is PII or not largely depends on the context. For instance, a username or phone number is considered PII only if it can be connected to a specific person.

Why is PII important?

PII information is important because it identifies individuals and can distinguish or trace an individual's identity, either on its own or when linked to other personal information. It is used for communication, verification, or transactions.

Businesses use PII to:

• Process transactions. In order to complete transactions, businesses need a user to provide their information like name, address and payment details. 
• Provide personalized customer service. This type of data helps tailor marketing, advertising and the offered goods and services so that they fit the customer perfectly. It helps to promote brand loyalty, because when a business knows their customer well, they can cater to their needs diligently.
• Serve customized ads. Meta event match quality is determined by the accuracy of PII. PII, such as email addresses, phone numbers, and other identifiers, helps Facebook link the event data you send to real user profiles. The more precise and complete the PII you provide, the better Facebook can match the events to the right users.
• Nurture relations with the customers. In order to communicate with its customers, a business needs to collect and store contact information of the customers. This way, a business can engage with its customers through email, phone, or other channels, building brand trust and loyalty. 
• Provide customer support. PII helps businesses assist customers better by knowing who they are and what they need.
• Maintain compliance. In some cases, businesses need to collect and store certain types of PII data for verification or tax reporting purposes. This data also falls under the notion of PII.
• Prevent fraud and ensure security. Collecting PII like login and verification details helps businesses protect user accounts and prevent fraud.

It all comes to this - PII data meaning is huge for businesses. It helps businesses connect with their customers, tailor their offering to fit the needs of the customers better and boost brand loyalty and customer trust.

Not all personal data qualifies as PII. For example, browsing preferences, like the types of products someone looks at online, aren't considered to be PII because they don’t directly identify a person. PII refers to data that can pinpoint a specific individual, such as information used to verify identity with a bank. Not all PII, in turn, is sensitive. PII is divided into sensitive and non-sensitive categories.

Sensitive PII

What PII data is considered sensitive? 

Examples:

• National identification numbers
• Passport numbers
• Taxpayer identification numbers
• Biometric data
• Financial account numbers
• Medical history
• Resident registration numbers
• Voter identification numbers

Sensitive PII is not publicly available and requires strong protection like encryption and controlled access under data privacy laws.

Non-sensitive PII

What PII data is considered non-sensitive? 

Examples of PII that is not sensitive (with explanations why it’s not sensitive):

• Full name. It is common in public directories or on social media.
• Email address. It is frequently shared in professional or personal settings.
• Phone numbers. It is publicly listed in many regions.
• Geographical data. Information like city, state, or ZIP code-level details are publicly available.
• Nationality. Such data is often shared in general contexts.
• Employment information. Data points like job roles, company names, or work experience are shared to the public quite often. 
• Public social media handles. Info like username or public posts not tied to sensitive accounts is often publicly available. 

To sum up, non-sensitive PII identifies a person but is low-risk if exposed, like a name or email. It’s often public but can be misused if combined with other data.

How is PII collected?

Ways in which PII is collected:

• Cookies and web tracking. Websites use cookies to track users’ browsing behavior, including the pages they visit and how often they return.
• E-commerce transactions. Online stores collect PII like names, addresses, payment information, and purchase history during transactions.
• User registrations. PII is collected when users sign up for accounts on websites, apps, or services. A business receives information like names, email addresses, phone numbers, and sometimes payment details.
• Customer support. Companies collect PII during customer support interactions, such as names, contact details, and issue logs.
• Loyalty programs. Retailers collect PII through loyalty programs where users provide personal details in exchange for rewards.
• Surveys and forms. PII is collected when users fill out forms for surveys, subscriptions, or loyalty programs.
• Social media. Social media platforms collect PII through user profiles, posts, interactions, and location tags.
• App permissions. Many apps collect PII by requesting access to contacts, photos, messages, and other data elements stored on users' devices.
• Facial recognition and biometrics. PII is collected through facial recognition and other biometric methods, such as fingerprints or voice recognition.
• Public records. Companies can access PII from public records.
• IoT devices. Devices like smart speakers and wearables collect PII, including voice data, health information, and usage patterns.
• Data brokers. Data brokers buy and sell PII from multiple sources, often without user consent. They gather information from public records, transactions, social media, and more.
• Wi-Fi and Bluetooth tracking. PII can be collected through tracking signals from users’ devices when they connect to Wi-Fi or Bluetooth networks in public places.
• Location tracking. Apps and websites track users' locations using GPS, IP addresses, and other methods.

These methods are commonly used to gather, store, and analyze personal data elements.

Why does PII need to be secured?

Every business must protect data, especially sensitive customer information. PII is valuable to your customers, and handling it properly is crucial to maintaining your company's reputation as a trustworthy place to do business. Protecting PII is crucial to keep individuals' privacy safe and prevent issues like identity theft, account takeovers, medical fraud, extortion, and other threats. If PII is compromised, it can cause financial losses, lower credit scores, emotional stress, and legal problems.

If we take a look at PII examples like a person’s full name, social security number, credit card information, or medical records, it becomes clear why safeguarding this information is so important. 

Examples of PII and reasons for securing it:

• Full names and addresses. If such information is exposed, a person can be scammed.
• Social security number. Exposure of such information can lead to identity theft. Scammers can open accounts or commit fraud in someone else’s name.
• Credit card or bank details. If such data is leaked, it can lead to unauthorized transactions and financial losses.
• Medical records. Exposure of medical records can lead to medical identity theft. For instance, someone can use a person’s information to access healthcare or benefits fraudulently.

Each piece of PII, when compromised, can have a direct and harmful impact on an individual’s life, underscoring the need for strict privacy measures.

Apart from all the reasons mentioned above, you must protect personal data under data privacy regulations like GDPR, HIPAA and many others. Failing to comply with these regulations can result in significant financial penalties, legal consequences, and irreversible loss of customer trust. 

Legal frameworks and compliance requirements

Let’s have a look at the main PII-centered regulations, their scope, requirements and non-compliance penalties. 

These laws require protecting personal data and following strict rules. An organization that fails to protect PII can face serious fines. Apart from the regulations mentioned above, other regional or industry-specific regulations could apply to your organization. Seek legal advice to ensure full compliance. 

PII and server-side tracking

Turning to server-side tagging for data collection and processing isn’t a guarantee that PII will be fully protected, but it does offer a more secure and controlled environment for handling sensitive data. Using server-side tracking in a GDPR-compliant way requires secure processing, PII minimization, anonymization, and obtaining user consent.

Unlike client-side tracking, which sends data directly from the user's browser to third-party platforms (like Google Analytics or Facebook), server-side tagging processes the data on a server first. This helps protect PII by giving businesses a possibility to filter or anonymize the data before sending it to external services.

How Stape can help

We created European Server GTM Hosting. Stape Europe, registered in Estonia, hosts server GTM containers on Scaleway, a 100% EU-based cloud provider. Using tools like Google Consent Mode ensures GDPR compliance by adjusting data collection based on user consent.

With Stape Europe, no data is transferred to the US, as our servers are fully EU-based. Currently, we don’t offer automated user data removal but are actively working on features to simplify the removal of PII.

Here are some more ways in which Stape can help you reach GDPR compliance and protect user PII:

1. Anonimyzer

Google analytics IP anonymization is often an issue for companies handling PII. Stape comes with a power-up for that. Anonimyzer is available for all Stape users. Its main goal is removing or anonymizing user data from Google Analytics 4. When GA requests go through the tagging server URL that includes /anonymize, we automatically remove or anonymize selected parameters. 

2. Consent banner

A consent banner is essential for obtaining users' permission to collect their data. It must clearly explain what data is being collected, why it’s being collected, and comply with regulations like GDPR.

3. GEO Headers

GEO headers provide user location data, useful for targeting and complying with local data protection laws. Ensure they’re properly configured. Server-side tracking can help address these needs, but consult your legal team to ensure full compliance.

Final thoughts

So, what is considered PII? It’s any information that can identify a person - like names, email addresses, phone numbers, or even browsing history and location data. This kind of information is collected in various ways, often without users realizing it. PII is divided into sensitive and non-sensitive. 

While some personal information examples are widely accessible for the general audience and harmless, others, like financial details, health records, or government-issued IDs, are considered sensitive and require stricter protection. Collecting and processing any PII, especially sensitive types, must comply with data protection regulations (like GDPR or CCPA) to ensure users' privacy and security.

Stape helps businesses handle PII securely with tools like the Anonimyzer for GA4 to anonymize data and EU-based server hosting to keep data compliant with GDPR. Features like Consent Banner and Geo Headers ensure transparent and responsible data management in a secure, controlled environment.

FAQs

What is non-PII?

Non-PII is data that cannot identify an individual, such as browser type, device type, or general location. Non-PII must still be handled carefully, as combining it with other data may allow indirect identification.

What are PII security best practices?

• Collect only the essential data needed for specific purposes.
• Use encryption to secure information during transmission and storage.
• Limit access to PII, ensuring only authorized personnel can handle it.
• Strengthen data security with firewalls, intrusion detection systems, and incident response plans.
• Provide regular training for employees on handling sensitive information responsibly.
• Have a clear incident response plan to address data breaches quickly.
• Respect individual rights by allowing access, correction, and deletion of personal data.
• Apply additional safeguards for biometric data like fingerprints and DNA.
• Protect location data to prevent tracking of individual movements.
• Regularly audit practices to maintain compliance and improve security measures.

These measures safeguard sensitive information and maintain trust.

Is PII and PHI the same?

PII identifies individuals, while PHI is health-related data linked to an individual and protected under laws like HIPAA.

What is PII under GDPR?

Under GDPR, PII is any data that can identify an individual, like names, emails, IP addresses, or location data.

What should businesses do after a data breach involving PII?

After a PII data breach, businesses must secure the breach, notify affected individuals, and report to authorities if required.

Extra tip

How can PII be removed using SST to ensure compliance?

PII can be removed with server-side tracking by anonymizing or filtering data before sending it to third parties. We have a tutorial on how to anonymize user data in GA4 with server GTM. It can help you with PII security.