Give your AI agents access to accurate, real-time customer profiles with FullContact MCP. No complex setups.

How do you protect personally identifiable information across devices?

By Brian Dayman
Published October 23, 2026
Updated October 8, 2026

To protect personally identifiable information across devices, businesses need to combine technical safeguards, privacy-by-design data practices, and compliance with applicable regulations. The core challenge is that each device a person uses generates its own stream of identifiers, and connecting those streams to serve relevant experiences creates real exposure risk if not handled carefully. The questions below unpack each dimension of that challenge, from what counts as PII in a multi-device environment to how to resolve identity without compromising privacy.

What types of data count as PII across devices?

Personally identifiable information across devices includes any data point that can be used, alone or in combination, to identify a real individual. This covers obvious identifiers like name, email address, and phone number, but also device-level signals such as IP addresses, device IDs, advertising identifiers, and browser fingerprints. When these signals are linked together, even individually non-sensitive data can become PII.

The scope of what qualifies as personally identifiable information is broader than most people expect in a multi-device context. A single data point may appear innocuous, but regulators and courts increasingly treat combinations of signals as PII when they can be traced back to a specific person. Common device-level identifiers that fall into this category include:

Mobile advertising IDs (such as IDFA on iOS and GAID on Android)
IP addresses and geolocation data derived from them
Browser cookies and localStorage identifiers
Hardware fingerprints assembled from screen resolution, fonts, and device settings

Beyond device signals, behavioral data collected across sessions, such as browsing patterns, purchase history, and app usage, can also constitute PII when it is associated with a persistent identifier. The key principle is that identifiability, not sensitivity, is what makes data personal. If a data point can contribute to recognizing an individual, it warrants the same protections as a name or email address.

How does cross-device tracking create PII exposure risks?

Cross-device tracking creates PII exposure risks by aggregating identifiers from multiple devices into a unified profile, which increases both the sensitivity of the data and the potential impact of any breach or misuse. The more identifiers that are linked to a single person, the richer the profile becomes, and the greater the harm if that data is exposed, sold, or processed without a lawful basis.

There are two primary methods of cross-device tracking, and each carries distinct risks. Deterministic tracking relies on authenticated identifiers, like a hashed email address or a login event, to match a person across devices. This is highly accurate but means the business is explicitly handling PII. Probabilistic tracking infers connections between devices using behavioral and contextual signals without requiring authentication. While no single data point is definitively personal, the inferred link can still constitute PII under many regulatory frameworks if it reliably identifies an individual.

The exposure risks compound when third parties are involved. Many tracking ecosystems involve data brokers, advertising networks, and analytics vendors who each receive a slice of the cross-device picture. Without strict data governance, sensitive profiles can be reconstructed from fragments shared across multiple vendors, each of whom may have weaker security or compliance controls than the original data collector. This is why the structure of the data supply chain matters as much as the technical safeguards applied at the point of collection.

What regulations govern PII protection across devices?

Several major regulations govern how businesses must handle personally identifiable information across devices, with requirements varying by geography and sector. The most influential frameworks include the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and its amendment the CPRA, Brazil’s LGPD, and Canada’s PIPEDA. Each imposes obligations around consent, data minimization, purpose limitation, and individual rights that directly affect cross-device data practices.

GDPR and its cross-device implications

Under GDPR, any processing of personal data, including device identifiers used to track individuals across platforms, requires a lawful basis. For most marketing use cases, that means obtaining freely given, specific, and informed consent before placing cookies or linking device-level identifiers. The regulation also grants individuals the right to access, correct, and delete their data, which means businesses must be able to locate and action all records associated with a person across every device profile they hold.

US state privacy laws and device tracking

In the United States, there is no single federal privacy law governing PII at the same scope as GDPR, but state-level legislation is expanding rapidly. The CCPA and CPRA give California residents the right to opt out of the sale or sharing of their personal information, including device-linked identifiers used for targeted advertising. As of 2026, more than a dozen US states have enacted or are implementing similar frameworks, making a patchwork of obligations that businesses operating nationally must navigate carefully. The common thread across all of them is that cross-device data linkage, particularly for advertising purposes, triggers disclosure and opt-out requirements.

How can businesses protect PII while still resolving identity?

Businesses can protect personally identifiable information while resolving identity by adopting privacy-preserving techniques that enable recognition without storing or exposing raw PII. The most effective approaches include hashing identifiers before transmission, minimizing the data shared with third parties, building on first-party consent, and using identity resolution infrastructure designed with privacy compliance as a foundational requirement rather than an afterthought.

Practical steps that balance identity resolution with PII protection include:

Hashing email addresses and phone numbers before using them as match keys, so raw PII never leaves the business’s environment
Implementing data minimization at the point of collection, capturing only the identifiers needed for a specific, defined purpose
Establishing clear consent flows that give users meaningful control over how their cross-device data is used
Auditing third-party data partners to confirm they operate under equivalent privacy standards

The structural principle underlying all of these practices is that identity resolution and privacy protection are not opposites. A well-designed identity resolution system resolves who a person is without requiring the business to hold or transmit sensitive raw identifiers in a way that creates unnecessary risk. Privacy-safe resolution works by matching against a trusted identity graph rather than by sharing PII directly, keeping sensitive data out of the data pipeline while still enabling personalization and recognition at scale.

What is the difference between anonymization and pseudonymization for PII?

Anonymization and pseudonymization are both techniques for reducing PII exposure, but they differ fundamentally in reversibility. Anonymization removes all identifying information so that re-identification is not possible, even with additional data. Pseudonymization replaces direct identifiers with artificial references, such as tokens or hashed values, but the original identity can still be recovered if the mapping key is available. Under GDPR, truly anonymized data falls outside the regulation’s scope, while pseudonymized data remains personal data and subject to all applicable requirements.

For cross-device identity resolution, pseudonymization is the more practical and widely used approach. Fully anonymizing a dataset while retaining enough structure to match individuals across devices is technically very difficult, because the matching process itself depends on persistent signals. Pseudonymization allows businesses to work with tokenized or hashed identifiers that are meaningless to an outside observer but still functional for resolution purposes within a controlled environment.

The important caveat is that pseudonymization is only as strong as the controls around the mapping key. If the token-to-identity mapping is stored insecurely or shared with third parties, the protection collapses. This is why pseudonymization is treated as a risk-reduction measure under privacy law rather than a complete exemption from PII obligations. Businesses that rely on it must still implement access controls, retention limits, and breach response procedures appropriate to the sensitivity of the underlying data.

Should businesses use first-party or third-party data to reduce PII risk?

Businesses should prioritize first-party data to reduce PII risk because it is collected directly from individuals with a clear consent relationship, giving the business full visibility into how the data was obtained and what it can lawfully be used for. Third-party data introduces uncertainty about provenance, consent quality, and compliance with applicable regulations, which creates legal and reputational exposure that first-party data avoids.

First-party data, collected through a business’s own properties and authenticated touchpoints, provides a stable foundation for identity resolution. When a customer logs in, makes a purchase, or subscribes to a newsletter, the business has a direct record of the consent and the context in which the data was shared. That clarity makes it much easier to honor data subject rights, respond to regulatory inquiries, and maintain compliant personalization practices over time.

Third-party data, sourced from external providers who have aggregated information across many contexts, carries a higher compliance burden. Businesses using third-party data for cross-device identity resolution need to satisfy themselves that the original consent covered the specific use case they intend, which is often difficult to verify in practice. As third-party cookies are phased out and regulatory scrutiny of data brokers increases, reliance on third-party data for PII-sensitive use cases is becoming both legally riskier and technically less reliable. The strategic direction across the industry in 2026 is clearly toward first-party and consented data as the primary inputs for identity resolution.

How FullContact helps protect PII while resolving identity

We built our identity resolution platform around the principle that recognizing a person and protecting their privacy are not competing goals. Our Identity Graph enables real-time resolution across devices and identifiers without requiring businesses to expose or share raw PII in the process. Specifically, we help businesses:

Match hashed, pseudonymized identifiers to unified customer profiles without transmitting sensitive data outside the business’s environment
Enrich first-party customer records with professional and personal insights drawn from our identity graph, reducing dependence on third-party data sources with uncertain provenance
Deliver API responses in under 150 milliseconds, enabling real-time personalization without storing PII unnecessarily at the point of interaction
Operate within a privacy-safe framework designed to support GDPR, CCPA, and other applicable regulatory requirements from the ground up

If you are working through the challenge of protecting personally identifiable information while still delivering the connected, personalized experiences your customers expect, we would love to help you find the right approach. Contact us to talk through your specific use case and how our platform can support your privacy and identity goals.