Personally Identifiable Information
Personally Identifiable Information (PII) is any data that can identify an individual — names, addresses, phone numbers, emails and other unique identifiers.
Privacy-First Security
Protect users without collecting PII
What is Personally Identifiable Information (PII)?
Personally identifiable information is data that identifies a person, directly or in combination with other data. A name or passport number does it directly; a postcode plus a date of birth plus a job title usually does it between them.
The term is American. European law uses personal data, defined more broadly in GDPR Article 4 as any information relating to an identifiable natural person. The difference is not academic: data that an American framework might treat as anonymous — an IP address, a device identifier, a cookie ID — is personal data in the EU, and that is precisely the category a bot detection system handles.
The categories, and what they imply
| Category | Examples | Obligation |
|---|---|---|
| Direct identifiers | Name, email, passport, national insurance number | Clearly personal data everywhere |
| Online identifiers | IP address, cookie ID, device fingerprint, advertising ID | Personal data under GDPR; often not under US frameworks |
| Behavioural | Pointer movement, typing cadence, interaction timing | Personal data, and capable of identifying a person over time |
| Special category | Health, biometrics for identification, ethnicity, political views | Needs an Article 9 condition, not just a lawful basis |
| Pseudonymised | Hashed email, salted device identifier | Still personal data. Pseudonymisation reduces risk, not scope |
The last row catches people out most often. Hashing an identifier does not take it outside the regulation if you or anyone else can still link it back to a person.
Why this is live for bot detection
Any system distinguishing humans from bots looks at the client, and nearly everything it can look at is an online identifier or a behavioural signal. So a CAPTCHA is a personal-data processing activity, which means it needs a lawful basis, a retention limit, and a defensible answer to where the data goes.
That is the question privacy reviews ask and the one several widely deployed CAPTCHAs answer badly: the provider is an advertising business, the risk score depends on recognising the user across sites, and the processing happens in the United States. See our analysis of hCaptcha's GDPR position and of what reCAPTCHA collects.
Handling it properly
- Collect the minimum that answers your question. "Is a person present" needs much less data than "who is this person", and the two should not be conflated.
- Set a retention period and enforce it automatically. Data kept indefinitely because nobody wrote a deletion job is the most common finding in any audit.
- Know where it is processed. Transfers out of the EU need a mechanism, and the available mechanisms have been through repeated legal challenge.
- Do not retain what you only needed live. A verdict about one session does not require keeping the signals that produced it.
Prosopo is built to that last point: signals inform a verdict for the session in front of us, EU processing is available, and we do not use third-party tracking cookies.