A Mini-Guide to Making Sense of Personal Information

Personal information can take many different forms. Because it covers such a wide range of data, understanding what counts as personal information is a great first step to better protecting your privacy.

First, watch or share this brief video on personal information. El video también está disponible en español.

Commonly known personal information

Most people are familiar with the types of personal information (PI) they provide to businesses. These types of PI include:

• Information you give to businesses about yourself. This can include your name, address, phone number, email, Social Security number, and more.
• Information connected to your accounts, such as your username and password.
• Information you provide when interacting with a business, whether online or in-person. This can include the items you buy, the services you use, or the programs you sign up for.

These are the types of information consumers usually think of when they hear “personal information”, and they are covered under the CCPA.

Lesser-known personal information

Some personal information is collected from and about you in the background in ways you may not be aware of. For example:

• Your precise geolocation can reveal the places you visit and your daily routines.
• Your browsing history, such as the pages you visit or the images you pause on, can track how you interact with webpages.
• Device identifiers, such as your IP address or mobile advertising ID, can help businesses recognize and connect your activity across apps and sites.
• Information from data brokers – businesses you don’t have a direct relationship with – that compile and sell details about you from many different sources.
• Inferences businesses make about you and your household can help predict, for example, whether you’re shopping for a big purchase, changing jobs, or getting married.

These are still types of personal information, and they can play a major role in how businesses build profiles, deliver services, and treat you as a consumer. California privacy laws like the CCPA and the Delete Act give you protections over this information.

What isn’t considered personal information under the CCPA

At the same time, not everything about you or your activity is considered personal information under the CCPA. For example, personal information may not include:

• Publicly available government records, such as public property or court records.
• Data that is deidentified so it can’t be linked back to you.
• Social media posts that you choose to make available to the general public.

There are also certain categories of information that are protected under other laws. For example, banking and financial data covered by the Gramm-Leach-Bliley Act (GLBA), or medical records covered by the Health Insurance Portability and Accountability Act (HIPAA) are legally considered “personal information,” but may be exempt from coverage under the CCPA because of these existing protections. Understanding what falls outside the definition of personal information can help you better exercise your CCPA rights.

The bottom line

Understanding what counts as personal information can help you exercise your privacy rights and take back control of your data. We’re working to make that easier through tools like DROP, California’s Delete Request and Opt-out Platform, which lets you send deletion requests to 650+ registered data brokers at once. You can also view our step-by-step privacy tips to help protect your information. Stay tuned for California’s first Delete Week in October, along with more helpful resources in the coming months to make your privacy rights even easier to understand and use.