<P> Personally identifiable information (PII), or sensitive personal information (SPI), as used in information security and privacy laws, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context . The abbreviation PII is widely accepted in the U.S. context, but the phrase it abbreviates has four common variants based on personal / personally, and identifiable / identifying . Not all are equivalent, and for legal purposes the effective definitions vary depending on the jurisdiction and the purposes for which the term is being used . (In other countries with privacy protection laws derived from the OECD privacy principles, the term used is more often "personal information", which may be somewhat broader: in Australia's Privacy Act 1988 (Cth) "personal information" also includes information from which the person's identity is "reasonably ascertainable", potentially covering some information not covered by PII .) In European data protection law, which centres primarily around the General Data Protection Regulation, there is no concept of PII . Instead, the term "personal data", which is significantly broader, determines the scope of the regulatory regime . </P> <P> NIST Special Publication 800 - 122 defines PII as "any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information ." So, for example, a user's IP address is not classed as PII on its own, but is classified as linked PII (see Section 3.3. 3 Under "Identifiability" for more detail). Also see federal judge ruling in the District of New Jersey dismissed on the pleadings a VPPA claim against Viacom on the grounds that device identifiers, cookie IDs, and IP addresses when linked to video titles are not personally identifiable information . </P>

Companies that use pii or spii of individuals are known as