Personally identifiable information, usually shortened to PII, is any data that can single out a specific person, either by itself or when combined with other available information. The National Institute of Standards and Technology sorts it into two buckets: information that directly traces someone’s identity, like a name or Social Security number, and information that can be linked to a person when paired with other records, like medical history or employment data.1National Institute of Standards and Technology. NIST Special Publication 800-122 – Guide to Protecting the Confidentiality of Personally Identifiable Information Below are the main categories with concrete examples of each, along with the federal rules that treat them as protected.
Direct Identifiers
Direct identifiers point to exactly one person without needing anything else to connect the dots. The clearest examples are government-assigned numbers:
- Social Security number
- Taxpayer identification number
- Driver’s license number
- Passport number
Each is unique within a government database and exists specifically to track your legal identity. A full legal name also counts, though names alone are less reliable because multiple people can share one.
The federal Privacy Act of 1974 governs how agencies handle these identifiers. It prohibits disclosing records from a federal system without written consent, with twelve narrow exceptions.2The United States Department of Justice. Privacy Act of 1974 A federal employee who knowingly hands protected records to someone not authorized to receive them commits a misdemeanor punishable by a fine up to $5,000.3Office of the Law Revision Counsel. 5 U.S. Code 552a – Records Maintained on Individuals
The REAL ID Act shows how bundled these identifiers have become. Before issuing a compliant driver’s license or ID card, states must verify an applicant’s full legal name, date of birth, Social Security number, principal residence address, and lawful status.4GovInfo. Real ID Act of 2005 – Title II A single application concentrates most of what someone would need to steal an identity.
Quasi-Identifiers That Combine Into PII
Some data points look harmless alone but become powerful identifiers when stacked. A date of birth, a ZIP code, or a person’s gender doesn’t single anyone out by itself. Put all three together and landmark research by Latanya Sweeney showed they can uniquely identify between 63% and 87% of the U.S. population.
Other examples of quasi-identifiers include:
- Place of birth
- Race
- Religion
- Street name or neighborhood
- Job title, department, hire date, and salary in a small workplace
This is the “mosaic effect,” where individually innocuous data points reassemble into a clear portrait of one person. An internal report stripped of names but listing job title, department, hire date, and salary can narrow the field fast. In a small office, it might identify someone instantly.
Federal health privacy rules address the problem through HIPAA’s “safe harbor” method, which requires stripping 18 specific identifier types before a dataset can be considered de-identified. That list includes names, geographic data smaller than a state, all date elements except year, phone numbers, email addresses, Social Security numbers, medical record numbers, health plan IDs, account numbers, license numbers, vehicle identifiers, device serial numbers, URLs, IP addresses, biometric identifiers, full-face photographs, and any other unique identifying number.5eCFR. 45 CFR 164.514 – Other Requirements Relating to Uses and Disclosures of Protected Health Information The list doubles as a useful checklist of what counts as identifying in a health context.
Digital and Device Identifiers
Every device you use online leaves fingerprints. Examples include:
- Internet Protocol (IP) address
- Media Access Control (MAC) address baked into your hardware
- Browser cookies
- Mobile advertising identifiers
- Browsing history and search history
- Precise geolocation data
None of these contain your name, but all can be traced back to you through service provider records, account logins, or cross-referencing with other databases. Location data is especially revealing. A device that pings from your home address every night, your workplace every weekday, and your doctor’s office on Tuesday afternoons tells a detailed story about your life. Comprehensive state privacy laws now classify IP addresses, cookies, browsing history, search history, and geolocation as protected personal information when they can be linked to a specific consumer or household.
The newest category is AI-generated inferences. When a system processes your browsing habits, purchase history, and app usage to build a profile of your preferences, psychological tendencies, or behavioral patterns, that profile itself qualifies as personal information under several privacy frameworks. The data an algorithm derives about you can be just as identifying as the data you actively provided.
Financial and Tax Identifiers
Financial PII includes the identifiers most people think of first:
- Credit card numbers
- Bank account numbers
- Credit reports
- Employment history and salary details
- Tax return information
The Gramm-Leach-Bliley Act requires financial institutions to protect this nonpublic personal information with a security program covering administrative, technical, and physical safeguards.6Office of the Law Revision Counsel. 15 U.S. Code 6801 – Protection of Nonpublic Personal Information Before sharing your data with an unaffiliated third party, the institution must give you clear written notice and a chance to opt out.7Office of the Law Revision Counsel. 15 U.S. Code 6802 – Obligations With Respect to Disclosures of Personal Information The FTC’s Safeguards Rule extends similar duties to any company offering consumers financial products or services, including loans, investment advice, and insurance.8Federal Trade Commission. Gramm-Leach-Bliley Act
Tax return information gets its own layer of protection. A tax preparer who knowingly or recklessly discloses your return data for any unauthorized purpose faces up to $1,000 in criminal fines and a year in prison, plus a separate civil penalty of $250 per unauthorized disclosure, capped at $10,000 per calendar year.9Office of the Law Revision Counsel. 26 U.S. Code 7216 – Disclosure or Use of Information by Preparers of Returns
Health, Biometric, and Genetic Data
Biometric identifiers sit in a category of their own because you can’t change them. If your credit card number leaks, you get a new one. If your fingerprint template leaks, you’re stuck with the same fingers. Examples include:
- Fingerprints
- Retina scans
- Facial geometry
- Voiceprints
- DNA profiles
HIPAA protects health information that can identify a patient, covering medical record numbers, health plan beneficiary IDs, clinical notes, lab results, and the other identifiers listed in the 18-category safe harbor.
Genetic information is defined separately by the Genetic Information Nondiscrimination Act (GINA) and includes data about your genetic tests, the genetic tests of your family members, the manifestation of diseases or disorders in your family, and requests for or participation in genetic services or research.10U.S. Equal Employment Opportunity Commission. Genetic Information Nondiscrimination Act of 2008 Employers cannot make hiring, firing, or other job decisions based on this information, and they cannot request or purchase it except in narrow circumstances. Health insurers are similarly barred from using genetic data to set eligibility, coverage, or premiums. The spread of consumer DNA testing kits has made this category far more relevant than when GINA passed in 2008.
Student Records and Children’s Data
Student education records fall under the Family Educational Rights and Privacy Act (FERPA), which covers any records directly related to a student that a school maintains and generally prohibits release without written parental consent.11Office of the Law Revision Counsel. 20 U.S. Code 1232g – Family Educational and Privacy Rights Once a student turns 18 or enters a postsecondary institution, those rights transfer to the student.
FERPA distinguishes between two tiers of student PII. “Directory information” that schools may release without consent includes a student’s name, address, phone number, date and place of birth, major field of study, participation in activities and sports, dates of attendance, degrees received, and the last school attended.11Office of the Law Revision Counsel. 20 U.S. Code 1232g – Family Educational and Privacy Rights Schools must give parents and eligible students an annual chance to opt out. Grades, disciplinary records, and Social Security numbers are never directory information and always require consent, with narrow exceptions for emergencies, court orders, financial aid determinations, and transfers.
Children’s online data adds another layer through the Children’s Online Privacy Protection Act (COPPA). Websites and online services directed at children under 13 must obtain verifiable parental consent before collecting personal information. As of April 2026, updated COPPA rules require separate parental consent specifically for disclosing children’s personal information to third parties for targeted advertising.
When Data Stops Counting as PII
PII isn’t a permanent label. Strip enough identifying details and the result can be treated as de-identified, falling outside most privacy regulations. HIPAA’s safe harbor method sets the clearest benchmark: remove all 18 categories of identifiers, and the data is considered de-identified by default.5eCFR. 45 CFR 164.514 – Other Requirements Relating to Uses and Disclosures of Protected Health Information The alternative “expert determination” method lets a qualified statistician assess whether the remaining data creates a “very small” risk of re-identification, preserving more usable information but requiring formal documentation. Organizations must retain de-identification records for six years.
Neither method is foolproof. The research showing that a ZIP code, birthdate, and gender can uniquely identify most Americans was published over two decades ago, and the pool of public datasets available for cross-referencing has only grown since. Information that seemed safely anonymous a few years ago can become re-identifiable as computing power and available data increase. Anyone relying on de-identification should treat it as a risk-reduction strategy rather than a guarantee.