Marketers in 2026 need to be aware of a growing patchwork of privacy laws that govern how personally identifiable information (PII) can be collected, stored, and used. The most pressing regulations span both US state-level privacy acts and international frameworks like the GDPR, and they are becoming more specific about what qualifies as PII and how businesses must handle it. This article breaks down which rules are shifting most rapidly, what counts as PII today, and how these rules reshape the way you work with first-party data and identity resolution.
Which PII regulations are changing the most in 2026?
The regulations changing most significantly in 2026 are US state privacy laws, which continue to expand in scope and enforcement, alongside evolving interpretations of the EU’s General Data Protection Regulation. Several US states have enacted or strengthened comprehensive privacy legislation, and regulators on both sides of the Atlantic are sharpening their focus on data minimization, consent requirements, and cross-context behavioral advertising.
US state privacy laws gaining momentum
The wave of US state privacy legislation that began with California’s CCPA has not slowed. States including Texas, Florida, Oregon, Montana, and several others now have active comprehensive privacy laws, each with their own definitions of personal data and their own enforcement mechanisms. While these laws share a family resemblance, the differences in scope, exemptions, and opt-out requirements create real compliance complexity for marketers operating nationally.
Key areas where these laws are tightening in 2026 include:
- Stricter requirements around consent for sensitive data categories, such as precise geolocation, health information, and biometric identifiers
- Broader definitions of “sale” and “sharing” of personal data, capturing more types of data partnerships and ad tech integrations
- Expanded consumer rights to opt out of targeted advertising, not just data sales
- Increased penalties and, in some states, a private right of action for consumers
GDPR enforcement becoming more consistent
The GDPR has been in force since 2018, but enforcement has matured considerably. Data protection authorities across Europe are now issuing larger fines and taking a harder line on consent mechanisms, data transfers to third countries, and the use of tracking technologies. Marketers running campaigns that touch European audiences need to treat GDPR compliance as a living obligation rather than a one-time setup.
Beyond Europe, countries including Brazil (LGPD), Canada (PIPEDA and its proposed successor), and several Asia-Pacific nations are also updating or enforcing their own privacy frameworks. For any brand with a global customer base, personally identifiable information rules are becoming a genuinely international compliance challenge.
What counts as PII under current privacy laws?
Personally identifiable information is any data that can be used, alone or in combination with other data, to identify a specific individual. Under current privacy laws, PII includes obvious identifiers like names, email addresses, phone numbers, and government ID numbers, but it also extends to device identifiers, IP addresses, precise location data, behavioral profiles, and even inferred characteristics when those can be linked back to a real person.
Direct identifiers versus indirect identifiers
Privacy laws generally distinguish between two categories of personally identifiable information. Direct identifiers are data points that identify someone on their own, such as a full name, a Social Security number, or a verified email address. Indirect identifiers are data points that identify someone only when combined with other information, such as a device ID paired with a browsing history, or a ZIP code combined with a date of birth and job title.
The practical implication for marketers is that data you might have historically treated as anonymous or pseudonymous may qualify as PII under modern definitions. If your systems can re-identify an individual from that data, regulators in most jurisdictions will treat it as personal data, regardless of whether a name is attached.
Sensitive PII and its heightened protections
Most current privacy frameworks carve out a subcategory of sensitive personally identifiable information that carries stricter obligations. Depending on the jurisdiction, this typically includes:
- Health and medical information
- Biometric and genetic data
- Precise geolocation (often defined as within a certain radius of a home or frequently visited location)
- Financial account details and credit information
Sensitive PII usually requires explicit, opt-in consent before it can be collected or processed, and it cannot typically be used for targeted advertising without clear consumer authorization. Marketers building audience segments or enriching customer profiles need to know whether any of the data inputs fall into these sensitive categories.
How do PII rules affect first-party data and identity resolution?
PII regulations directly shape how marketers can collect, use, and connect first-party data. Because first-party data is gathered through direct interactions with your own customers, it generally carries stronger legal standing than third-party data, but it still must be collected with proper notice and consent, used only for disclosed purposes, and protected against unauthorized access or misuse. Identity resolution, which involves linking multiple identifiers to a single customer record, is particularly sensitive because it can transform individually innocuous data points into a rich personal profile.
The core tension for identity resolution is that its value comes from connecting data across touchpoints, but privacy law increasingly restricts exactly that kind of cross-context data linkage. A few principles help navigate this tension effectively.
Consent and transparency are foundational. Any identity resolution process that links authenticated data (such as an email address from a login) with behavioral or device data must be grounded in a clear, disclosed purpose that consumers have consented to. Vague or buried consent language is a growing enforcement target for regulators.
Data minimization matters more than ever. Privacy laws in most jurisdictions require that you collect only the personally identifiable information that is genuinely necessary for your stated purpose. For identity resolution, this means being deliberate about which identifiers you ingest and retain, rather than collecting everything available and deciding later what to use.
Pseudonymization and privacy-safe architectures reduce risk. Identity resolution platforms that operate on hashed or tokenized identifiers, rather than raw PII, reduce the risk of exposure and often fall under more favorable regulatory treatment. When the underlying personal data never leaves your environment and matching happens through privacy-preserving methods, you gain the benefits of resolution without the liability of sharing raw personally identifiable information with third parties.
First-party data strategies also need to account for data subject rights. Consumers in most jurisdictions now have the right to access, correct, and delete their personal data. If your identity graph links dozens of identifiers to a single individual, a deletion request must cascade across all of those linked records, not just the original record where the request was submitted.
How FullContact helps with PII compliance and identity resolution
We built our platform specifically to help marketers resolve identity in a way that respects privacy regulations rather than working around them. Our Identity Graph connects online and offline identifiers into a single customer view without requiring you to share your raw first-party data with us. Your data stays in your environment, and matching happens through privacy-safe methods that are designed to hold up under current and evolving PII regulations.
Practically, here is what that means for your team:
- Real-time API responses in under 150 milliseconds let you resolve identity at the moment of interaction, supporting consent-based personalization without latency
- Append 900+ personal and professional insights to customer records while keeping your underlying PII secure and compliant
- Link authenticated and anonymous identifiers into a unified customer profile that supports deletion and suppression requests across all connected records
If your marketing team is navigating the complexity of PII regulations in 2026 and wants to build an identity resolution strategy that is both effective and compliant, we would love to talk through your specific situation. Contact us, and one of our team members will help you find the right approach for your data and your customers.
