What Is PII in Marketing? Why the Definition Is Too Narrow

PII in marketing is any data that can identify a specific person, on its own or combined with other data: a name, email address, phone number, postal address or government ID number. That's the definition most marketing teams carry around, and it's correct as far as it goes. The nuance almost everyone misses is that most privacy laws don't regulate "PII" at all. California's CCPA regulates "personal information," which reaches device IDs, IP addresses, cookie identifiers, browsing activity and inferences drawn about a person. A file that "contains no PII" under the old definition can still be regulated personal data. So the working question for a marketer isn't "is this PII?" It's "can this be linked back to someone?"

Where the term PII comes from

PII is a US government term. Federal guidance from OMB and NIST describes it as information that can distinguish or trace an individual's identity, alone or when combined with other information that is linked or linkable to that person. It was written for agencies handling records, and it maps neatly onto a contact list, which is the short definition the PII glossary entry keeps.

Marketing borrowed the term because it's useful shorthand. The trouble is that the laws marketers actually answer to draw the line in a different place, and usually a wider one.

Three definitions, three different lines

Look closely at the middle row. "Household" and "inferences" are both in it. A segment label attached to a person's record, such as "likely outdoor gear buyer," is an inference. Under the CCPA it can be personal information even though no one in a planning meeting would call it PII. If you've suspected that a "no PII" label on a file was doing more work than it should, you were right.

A caveat belongs here. This isn't legal advice, the rules differ by state, and they change often. Whether a specific field counts can depend on the state, what else you hold and how the data is used, which is a question for counsel. What the table shows is the gap between how marketing talks about PII and where the law tends to draw the line.

The four layers of personal data in a marketing stack

A practical way to sort the data in your stack is by how directly each field points at a person.

1. Direct identifiers. Name, email, phone, postal address, government ID numbers. These identify someone with no help, and they're what everyone already means by PII.
2. Linkable identifiers. Cookie IDs, mobile advertising IDs, IP addresses, customer IDs and hashed emails. None of them shows a name, but each exists so a system can recognize the same person again. That's exactly what makes them linkable.
3. Attributes and inferences. Interests, purchase behavior, household attributes, modeled segments and in-market scores. On their own they describe rather than identify. Attached to an identifier, they become part of a profile.
4. Sensitive personal information. A narrower set the CPRA treats separately, including Social Security and driver's license numbers, account log-ins, precise geolocation, health information and biometric data. Consumers can limit how it's used, and many data platforms restrict it further.

Most mistakes happen at layer 2. Teams treat a hashed email or a device ID as anonymous because it doesn't look like a person. It isn't anonymous. The FTC made the point in a 2024 post titled "No, hashing still doesn't make your data anonymous," and the guide to what a hashed email is explains why. Exact Match's own Privacy Policy lists hashed identifiers, device identifiers and inferences among the categories of personal information it handles.

Where PII shows up in everyday marketing

Each of these moments changes what you're holding, which is why they're worth knowing:

• List uploads to ad platforms. Customer lists usually go up as hashed emails and phone numbers so the platform can match them to its users. Hashing reduces how much readable data moves between systems. It doesn't turn the file into non-personal data.
• Enrichment. Appending demographic or interest attributes to a contact list adds layer 3 data to layer 1 records. The result is a richer profile, with more to protect.
• Website visitor identification. An anonymous session is mostly layer 2 data. Identifying the visitor attaches a name and contact details, which moves it to layer 1.
• Modeling. In-market scores and lookalike segments are inferences. The post on Bayesian behavioral modeling in marketing explains how those scores are built. For privacy purposes, the point is simpler: a score attached to a person is part of that person's profile.

The rule of thumb is blunt: if a field exists to reach, recognize or describe a specific person, treat it as personal information. It's the more cautious reading, and it's the one that holds up when a platform review, a consumer request or a regulator asks what you hold. The narrow definition feels convenient right up until someone outside the marketing team applies the broad one.

Questions to ask any data provider about PII

A consumer data vendor handles personal information by definition, so the useful questions are about how:

• Where does the data come from? Expect a clear answer about source types, not just "proprietary."
• How are consumer opt-outs handled, and how do they reach data you've already licensed?
• Which categories are off-limits? A provider should be able to name what it won't let you target.
• How is matching done? Deterministic matching against known identifiers behaves differently from probabilistic guessing, and it affects how many wrong people end up in your file.

The guide to choosing a B2C marketing data provider covers the rest of that evaluation, including refresh rate and pricing model.

How Exact Match handles PII

Exact Match is a consumer data platform, so personal information is the product, and it's better to say that plainly than to dress it up. Its consumer database covers 250M+ verified U.S. consumer profiles, assembled from licensed third-party and public-record sources and refreshed daily. Matching is deterministic: records are verified against identity anchors such as name, email, phone and address rather than statistical guessing. Email addresses and phone numbers can be sent in plaintext or hashed as MD5, SHA-1 or SHA-256. Names and postal addresses are sent in plaintext.

Site ID is the clearest example of the layer 2 to layer 1 step described above. It identifies 25-40% of verified human visitors, bots excluded, and sends their contact and demographic profiles automatically, as visitors are identified, to GoHighLevel or any webhook endpoint you connect. That makes it a source of personal information in your stack, and it belongs in your data map like any other.

On the consumer side, Exact Match is CCPA compliant and honors opt-outs within the time applicable law requires. The Acceptable Use Policy adds hard limits on top. Section 9.2 lists categories that may never be targeted, including people under 18, criminal history, and biometric or genetic data. Section 8.4 prohibits advertising, targeting or audience construction relating to housing, employment, credit or insurance unless Exact Match has authorized it in writing. Read the AUP before writing the campaign brief, not after the audience is built.