What is PII?

short answer

PII is any information that can identify a specific person, either on its own or when combined with other data. Direct identifiers like a name, email address, phone number, or Social Security number are obvious PII. But so are indirect identifiers — an IP address, a device ID, or a ZIP code plus a birth date — because they can be combined to single someone out. There is no single legal definition: US regulators, state laws, and the GDPR each draw the line slightly differently.

The definition depends on who is asking

There is no one definition of PII, which is the first thing that trips people up. Three different frameworks draw three different lines:

US federal agencies (NIST SP 800-122) describe PII as information that can distinguish or trace an individual’s identity, either directly or when linked with other information.
US state privacy laws — California, Virginia, Colorado and the rest — mostly use the term “personal information” and define it broadly as information that identifies, relates to, or could reasonably be linked with a particular consumer or household.
The GDPR uses “personal data” and is broader still: any information relating to an identified or identifiable natural person.

If you operate across jurisdictions, assume the broadest definition applies. Designing to the narrowest one is how organizations discover, during an incident, that the data they did not classify as PII was PII somewhere.

Direct and indirect identifiers

Direct identifiers point at one person on their own:

Full name
Email address
Phone number
Social Security or national ID number
Passport or driver’s license number
Account numbers

Indirect identifiers identify someone in combination:

IP address
Device or advertising ID
Cookie identifiers
Precise geolocation
ZIP code, birth date, and gender together

That last one deserves emphasis. Research has repeatedly shown that a small combination of non-obvious fields can uniquely identify a large share of a population. “We only collect ZIP code and date of birth” is not the safe statement it sounds like.

Why the boundary matters commercially

Classification determines obligation. Once data is PII:

Access and deletion requests apply to it (see what a DSAR is)
Breach notification duties may attach
Consent and disclosure requirements may apply to how you collected it
Retention limits and minimization expectations apply

The practical failure mode is not misunderstanding the definition. It is holding data you never inventoried, then being unable to answer a request about it because nobody knows where it lives.

What a reasonable practice looks like

Inventory it. You cannot protect or delete what you have not mapped.
Collect less. Every field you do not collect is one you never have to secure, disclose, or delete. See data minimization.
Separate identifiers from the rest. Encryption and access control are easier when identifying fields are isolated.
Know your basis. For each field, be able to say why you have it and what the person was told when you got it.

For consumers

You have more rights over PII than most people use. Depending on where you live, you can ask a company what it holds about you, ask for it to be deleted, and ask it to stop selling or sharing it. The mechanism is a data subject access request, and it is usually a form or an email — not a legal proceeding.