Which of the following is NOT an example of PII?
Anything that cannot be tied back to a specific person is not PII. Aggregated, anonymized, or generic data — a company's public product description, or a random number not linked to anyone — is not PII. Names, SSNs, addresses, dates of birth, and biometrics are PII.
The answer
Personally Identifiable Information (PII) is any data that can identify a specific individual, either on its own or when combined with other information. So the item that is NOT PII is the one that cannot be traced back to a real, named person: aggregated, anonymized, or generic non-identifying data. Examples of non-PII include a company's public product catalog, statistical summaries like "62% of users prefer dark mode," or a random account number that is not linked to anyone's identity.
By contrast, all of the following ARE PII because each can single out a person: full name, Social Security number, home address, date of birth, driver's license number, passport number, email address, phone number, and biometric data such as fingerprints or facial scans.
The linked vs. linkable distinction
The key idea competitors skip is linkability. A single data point can flip from non-PII to PII depending on context. A ZIP code alone identifies roughly tens of thousands of people, so by itself it is not PII. But a ZIP code combined with a birth date and gender can uniquely identify a large share of the U.S. population — at that point the combination becomes PII. This is why privacy law distinguishes:
- Linked information — data already tied to a specific individual (a name next to an SSN).
- Linkable information — data that could be combined with other data to identify someone (a device ID that maps back to an account).
Truly anonymized data has been stripped and de-linked so it can never be reconnected to an individual, which is why it is not PII.
Sensitive vs. non-sensitive PII
PII also splits into two tiers. Non-sensitive PII is information often found in public records — your name, general address, or business phone. Sensitive PII is data that could cause real harm if exposed: SSN, financial account numbers, medical records, and biometric identifiers. Sensitive PII usually must be encrypted and is protected by stricter rules under laws like HIPAA, GLBA, and GDPR.
Why the common wrong choices trip people up
In the typical version of this question, test-takers wrongly pick an email address or a phone number as "not PII" because those feel less private than an SSN. That is a trap: an email address is PII because it points to one account holder. The correct "not PII" choice is always the one describing generic, company-level, aggregated, or anonymized data with no link to an individual.
The bigger picture
Protecting PII matters because leaked identifiers fuel identity theft, financial fraud, and phishing. Organizations reduce risk by collecting the minimum data needed, anonymizing where possible, encrypting sensitive fields, and limiting who can access identity records. Understanding what is and isn't PII is the first step in that data-minimization mindset.
| Full name | PII | Directly identifies a person |
| Social Security number | PII (sensitive) | Unique government identifier |
| Email address | PII | Points to one account holder |
| Date of birth + ZIP + gender | PII (linkable) | Combination uniquely identifies |
| Company's public product info | Not PII | Not tied to an individual |
| Aggregated/anonymized statistics | Not PII | De-linked from any person |
| Random unlinked number | Not PII | No connection to an identity |
Frequently asked
What counts as personally identifiable information?
PII is any data that can identify a specific individual alone or in combination with other data. This includes name, SSN, address, date of birth, email, phone number, driver's license number, and biometrics like fingerprints or facial scans.
What is the difference between PII and sensitive PII?
Non-sensitive PII is often publicly available, such as a name or general address, and poses limited risk if exposed. Sensitive PII — SSN, financial account numbers, medical and biometric data — can cause serious harm if leaked and usually must be encrypted and access-restricted.
Is an email address considered PII?
Yes. An email address is PII because it points to a specific account holder and can be used to contact or identify that individual, especially when it contains a real name or is combined with other data.
Why is protecting PII important?
Leaked PII enables identity theft, financial fraud, and phishing attacks. Protecting it preserves individual privacy, keeps organizations compliant with laws like GDPR and HIPAA, and prevents costly breaches and reputational damage.