Personal Data
Any information that relates to an identifiable person, why it is broader than names and emails, and the engineering habits that privacy law now expects.
Personal data is any information relating to a person who can be identified, directly or indirectly. US practice often says personally identifiable information, or PII, and historically meant a short list: name, Social Security number, email, phone. European law uses a far broader definition that includes IP addresses, device identifiers, location history, and cookie IDs, anything that can single out one person, alone or combined with other data.
Identification is easier than it looks. Latanya Sweeney showed in 2000 that about 87 percent of Americans can be uniquely identified by ZIP code, birth date, and sex alone. In 2006 AOL released "anonymized" search logs and reporters identified a user from their queries within days. Researchers matched Netflix Prize ratings, released the same year, to public movie reviews and showed that users could be re-identified. Removing names is not anonymization; differential privacy exists because of attacks like these, and Entity Resolution is the same matching technique used deliberately.
The European Union's General Data Protection Regulation, applied since May 2018, set the global template, with fines up to 4 percent of a company's worldwide annual revenue. Its principles include a lawful basis for every use, purpose limitation, and data minimization: collect only what is needed and keep it only as long as needed. It grants rights to access, correct, export, and erase one's data. The right to erasure echoes a 2014 EU court ruling against Google, which required search results about a person to be removed in some cases, popularly the "right to be forgotten." California's Consumer Privacy Act of 2018 followed a similar pattern.
For engineers, the law turns into concrete habits:
- Collect less. Data never stored cannot leak, be subpoenaed, or need deletion.
- Know where it flows. Answering an access or erasure request requires knowing every table, log, cache, and export holding a person's data, a job for Data Lineage.
- Keep it out of logs. Emails, tokens, and addresses end up in request logs, error reports, and analytics unless scrubbed at the source.
- Pseudonymize carefully. Replacing an email with its hash is pseudonymization, not anonymization, since anyone can hash a list of known emails and match them, a misuse of a Hash Function.
- Delete for real. A Soft Delete flag does not satisfy erasure, and deleted data lingers in replicas and in Backup and Restore archives. Crypto-shredding, encrypting each person's data with its own key and destroying the key, erases data everywhere at once.
- Limit access. Production personal data should be visible to as few people and services as possible, following Least Privilege, and replaced by synthetic Seed Data in development.
Tracking identifiers such as an HTTP Cookie count as personal data in Europe, which is why consent banners exist.
See also3
Wake Word
A short phrase such as a voice assistant's name that a device listens for continuously using a tiny on-device model, waking the full speech system only when it hears it, which is how always-listening devices balance responsiveness, power and privacy.
Agents & Language Models6 connections
Autocomplete
Suggesting completions while someone types, which needs prefix-friendly indexes, ranking by likely intent, and careful handling of latency, typos, and accessibility.
Data & Content14 connections
Referrer Policy
The rules for when a browser tells a site which page a visitor came from, a header misspelled in the 1990s that leaked private addresses for decades until browsers began trimming it by default.
Web Platform12 connections
Linked from11
- Audit LogData & Content
An append-only record of who did what, to what, and when, kept to answer questions of accountability long after the fact, and built so that even its administrators can't quietly rewrite it.
- AutocompleteData & Content
Suggesting completions while someone types, which needs prefix-friendly indexes, ranking by likely intent, and careful handling of latency, typos, and accessibility.
- Internet of ThingsNetworks & Distribution
Everyday objects with network connections, from thermostats and light bulbs to industrial sensors, notorious for weak security, dependence on vendor clouds, and devices that outlive the companies supporting them.
- JPEGGraphics & Rendering
The dominant photo format since 1992, which shrinks images about tenfold by converting 8×8 blocks into frequency patterns and rounding away the fine detail the eye barely notices.
- LoggingTesting & Verification
Recording timestamped events from a running program so people can reconstruct what happened, and how structured logs, levels, and aggregation make them useful at scale.
- Object StorageData & Content
Storage that keeps whole files as objects addressed by key in a flat namespace over HTTP, cheap and nearly limitless, which became the foundation for backups, media, and data lakes.
- Phone NumberData & Content
The international numbering scheme for telephones, E.164, and the many ways phone numbers break software that treats them as simple integers or as stable proofs of identity.
- Referrer PolicyWeb Platform
The rules for when a browser tells a site which page a visitor came from, a header misspelled in the 1990s that leaked private addresses for decades until browsers began trimming it by default.
- Staging EnvironmentTesting & Verification
A copy of production where changes are deployed and checked before they reach real users, and why the differences between staging and production keep letting bugs through.
- Wake WordAgents & Language Models
A short phrase such as a voice assistant's name that a device listens for continuously using a tiny on-device model, waking the full speech system only when it hears it, which is how always-listening devices balance responsiveness, power and privacy.
- Web AnalyticsWeb Platform
Measuring how people use a website, from parsing server logs to JavaScript page tags and Google's free Analytics, with metrics like pageviews and bounce rate that are distorted by bots, blockers, and consent rules and easy to optimize in the wrong direction.