TL;DR: what is PII
- Personally Identifiable Information (PII) is any data that can identify a specific person, directly (name, email, SSN, credit card) or indirectly (IP address, device fingerprint, browsing history combined).
- PII has become a compliance surface across GDPR (EU), CCPA/CPRA (California), PIPEDA (Canada), and PCI DSS (cardholder data specifically). Different frameworks classify PII slightly differently, but the intersection is what your controls need to cover.
- In the browser, PII most commonly leaks through third-party scripts that read form fields, cookies, or local storage. Server-side PII controls miss this class of attack entirely.
Personally Identifiable Information (PII) is any data that can be used to identify a person, either on its own or in conjunction with another piece of data. This includes obvious identifiers such as full names, Social Security numbers, driver’s licenses, birth dates, ZIP codes, or phone numbers. While all PII is sensitive, pieces of information like health data or biometrics can pose a serious risk of being used in a fraud or identity theft attack if exposed.
See it in your own site
PII protection starts with knowing where PII touches the browser. cside monitors every third-party script that reads form fields on your site and flags unauthorized PII exfiltration in real time. Free tier available.
Why protecting PII is important
Most organizations today collect and handle vast amounts of PII. From your user profile on Instagram, to your health records at your doctor’s office - both require protection, and failing to protect this information can have serious consequences for a business.
Legality and compliance issues
Data privacy laws around the world mandate the protection of personal information. In the EU, the General Data Protection Regulation (GDPR) defines personal data as “any information relating to an identified or identifiable natural person” and imposes strict compliance requirements on all organizations, backed by hefty penalties. For example, Amazon was fined $888 million in 2021 for data privacy violations under GDPR after failing to secure its users’ data.
In the U.S., regulation is less thorough. States like California enacted the Consumer Privacy Act (CCPA), which grants consumers rights over their personal information and puts the obligation onto businesses to secure that data.
An example underground market selling a 277GB database of customer information.
Security risks and identity theft
PII is a prime target for cybercriminals, which is why companies need to take care when dealing with your personal data. Hackers who steal PII may be able to entirely impersonate individuals, take over financial accounts, or commit tax fraud. Stolen data is also widely sold on the dark web and underground markets, where it fetches a high price for whoever can provide the most data.
Customer trust & reputation
The most immediate impact to a company of a PII breach is a loss of customer trust, which can often be amplified by coverage in the media of the breach. Reputational damage comes with lost business, stock prices falling, and even bankruptcy depending on the severity of the breach. Privacy is now a competitive differentiator for digital businesses, and companies that can’t protect it may struggle to retain customers.
