Personally Identifiable Information (PII)

What is personally identifiable information?

Personally identifiable information, or PII, is the US way of saying "data that can identify a person." It is the term most people search for. Yet no single US law defines it for every situation.

Different laws use different words and lists. California's privacy law, the CCPA, uses "personal information." The EU's GDPR uses "personal data." State breach laws define their own, narrower lists. In practice, PII means whatever the contract or law in front of you says it means.

Common examples of PII include:

• Names, home or work addresses, email addresses and phone numbers.
• Government ID numbers, such as Social Security or passport numbers.
• Account logins and financial account numbers.
• Online identifiers, such as IP addresses and device IDs.

Some data identifies a person only when you combine it with other data. A job title alone may say little. A job title plus a company name can point to one person.

How PII relates to personal data

The legal terms are wider than many people expect when they hear "PII."

• GDPR personal data covers "any information relating to" an identifiable person, per Article 4(1).
• CCPA personal information covers data that can reasonably be linked to a consumer or household. The statute lists identifiers, browsing history, geolocation, employment details and inferences drawn to build a profile.
• Breach notice laws often use narrower lists. California's breach rules, for example, apply to "personal information, as defined" in Civil Code 1798.82, as the Attorney General explains. See state data breach notification laws.

So if you think of PII as only names and Social Security numbers, you may underestimate what your vendors hold.

What it looks like in a vendor's terms

A typical clause reads like this:

Customer will not submit to the Service any sensitive personally identifiable information, including government ID numbers, financial account numbers or health information, unless the Service is expressly designed for it. "Personal Data" includes personal data, personal information and personally identifiable information as defined by applicable law.

• "Will not submit": the vendor puts the duty on you to keep certain data out.
• "Unless the Service is expressly designed for it": some products are built for that data, and many are not.
• The last sentence: the vendor treats all three terms as one, so its promises cover whichever term a law uses.

Zoom's terms take the second approach. A section of its terms of service covering US state laws refers to "personal data, personal information, or personally identifiable information."

A real change we caught

Venpo flagged this change: Grok's standard API is now off limits for personal data. SpaceXAI's DPA, in a version effective September 22, 2026, says customers may send personal data only through its zero data retention API, and calls any other route a material breach of the contract. A rule like this moves the burden to you. If your product sends user names, emails or other PII through the standard API, you would be using it in a way the terms do not allow.

Why it matters to you

Your vendors likely hold PII: your users' emails, your customers' contacts, your staff records. If one of them has a breach, you may have notice duties to people and regulators. If one of them widens how it uses that data, you may need to update your own privacy policy and customer answers.

Contracts also use PII to split responsibility. If your team uploads data the vendor's terms say you must not send, the risk may fall on you. That can happen by accident, for example when a support agent pastes a customer's ID number into a ticket.

What to check

• How the vendor defines PII or personal data, and whether it includes online identifiers like IP addresses.
• Whether the terms forbid certain kinds of PII, such as health or financial data, and whether your team uploads them anyway.
• Whether the DPA covers all personal data you send, not only a narrow list.
• What the vendor promises on breach notice, and how fast.
• Whether the vendor may use PII for its own purposes, such as ads or AI training.

How Venpo helps

Venpo monitors your vendors' privacy policies, terms and DPAs and emails you when their wording on personal information changes. The Fine Print Scan shows, for each vendor, whether it trains AI on your data, how long it keeps it, and whether it sells it or uses it for ads.