The use of personally identifiable information (PII) is governed by a patchwork of national, regional, and sector-specific laws that vary significantly depending on where a business operates and who its customers are. No single global law covers PII, so organizations must navigate multiple overlapping frameworks simultaneously. The sections below break down which laws apply, how the major regulations differ, and exactly what qualifies as PII under current legal definitions.
Which major PII laws apply to businesses operating today?
Businesses operating in 2026 must comply with a range of PII laws depending on their geography, industry, and customer base. The most impactful frameworks include the EU’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and its amendment the CPRA, Brazil’s LGPD, Canada’s PIPEDA, and sector-specific US laws such as HIPAA for healthcare and FERPA for education.
The key challenge for most organizations is that these laws do not operate in isolation. A company based in the United States that sells to European customers must comply with GDPR. A healthcare provider in California must satisfy both HIPAA and CCPA requirements. The applicable laws are determined by where your customers are located, not just where your business is registered.
Major privacy laws by region
- European Union: GDPR applies to any organization processing the personal data of EU residents, regardless of where the organization is based. It sets strict requirements around consent, data subject rights, and cross-border data transfers.
- United States: There is no single federal PII law. Businesses must comply with a growing list of state laws, including CCPA/CPRA (California), CPA (Colorado), VCDPA (Virginia), and others, alongside sector-specific federal laws like HIPAA, GLBA, and COPPA.
- Brazil: The Lei Geral de Proteção de Dados (LGPD) mirrors many GDPR principles and applies to any organization processing the personal data of individuals located in Brazil.
- Canada: PIPEDA governs the collection, use, and disclosure of personal information by private-sector organizations, with provinces like Quebec introducing stricter rules through Law 25.
Beyond these headline frameworks, sector-specific laws add another layer of complexity. HIPAA governs protected health information (PHI) in the US healthcare sector. The Gramm-Leach-Bliley Act (GLBA) regulates financial institutions’ handling of consumer financial data. COPPA places strict controls on the collection of personal information from children under 13. Understanding which combination of laws applies to your specific business model is the essential starting point for any PII compliance program.
The trend toward stricter state-level legislation
In the United States, the absence of a comprehensive federal privacy law has accelerated state-level activity. As of 2026, more than a dozen states have enacted consumer privacy laws, with more legislation in progress. While these laws share common themes, such as the right to access, delete, and opt out of the sale of personal data, they differ in scope, thresholds, and enforcement mechanisms. Businesses operating nationally must treat their compliance obligations as a matrix rather than a single checklist.
How do GDPR and CCPA differ in their approach to PII?
GDPR and CCPA both protect personal information, but they take fundamentally different approaches. GDPR is an opt-in framework built on the principle that data processing requires a lawful basis, most commonly explicit consent. CCPA is primarily an opt-out framework, meaning businesses can collect and use personal information unless a consumer actively chooses to restrict it. This distinction shapes how organizations must design their data practices under each law.
Scope and applicability
GDPR applies to any organization, anywhere in the world, that processes the personal data of individuals located in the European Economic Area. There is no revenue or size threshold. CCPA, by contrast, applies to for-profit businesses that meet at least one of three thresholds: annual gross revenues above a defined level, processing the personal information of a large number of California consumers, or deriving a significant portion of revenue from selling personal information. Smaller businesses may fall outside CCPA’s scope entirely, while virtually any organization with EU customers must comply with GDPR.
Rights granted to individuals
Both laws grant individuals meaningful rights over their personal information, but the specifics differ. GDPR provides a broader set of rights, including the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing. It also grants rights related to automated decision-making. CCPA focuses on the right to know what personal information is collected, the right to delete, the right to opt out of the sale of personal information, and the right to non-discrimination for exercising these rights. The CPRA amendment added the right to correct inaccurate personal information and the right to limit the use of sensitive personal information, narrowing some of the gap between the two frameworks.
One practical implication of these differences is how businesses must structure their consent and preference management systems. Under GDPR, obtaining and recording valid consent before processing is often a legal requirement. Under CCPA, the obligation is typically to provide a clear mechanism for consumers to opt out after the fact. Organizations operating globally generally find it more efficient to adopt the stricter GDPR standard as a baseline, since a consent-first approach satisfies opt-out requirements by default.
What counts as personally identifiable information under current law?
Personally identifiable information (PII) is any data that can be used, alone or in combination with other information, to identify a specific individual. Under most current laws, PII includes obvious identifiers like names, email addresses, phone numbers, and government ID numbers, but also extends to less obvious data points such as IP addresses, device identifiers, location data, and behavioral profiles when these can reasonably be linked to a real person.
The definition of PII has expanded significantly as digital tracking capabilities have grown. What once qualified as anonymous data, such as a browsing history or a mobile advertising ID, is now treated as personal information under GDPR and CCPA because modern data processing techniques can re-identify individuals from these signals. This means businesses can no longer rely on the absence of a name or email address to conclude that data is outside the scope of privacy law.
Direct versus indirect identifiers
Privacy frameworks typically distinguish between direct identifiers, which identify someone on their own, and indirect identifiers, which identify someone when combined with other data. Direct identifiers include full names, social security numbers, passport numbers, biometric data, and precise geolocation. Indirect identifiers include date of birth, job title, zip code, and browsing behavior. When indirect identifiers are combined, even a small set can uniquely identify an individual, which is why regulators increasingly treat them as PII.
Sensitive PII and heightened protections
Most modern privacy laws carve out a category of sensitive personal information that attracts stricter handling requirements. Under GDPR, special category data includes racial or ethnic origin, political opinions, religious beliefs, health data, genetic and biometric data, and sexual orientation. The CPRA introduced a similar concept of sensitive personal information in the California framework, covering social security numbers, precise geolocation, health and financial information, and the contents of private communications. Businesses that process sensitive PII face additional obligations around consent, access controls, and data minimization that go beyond the baseline requirements for ordinary personal information.
Understanding what qualifies as PII under the laws that apply to your business is not a one-time exercise. As regulators issue new guidance and courts interpret existing statutes, the practical boundaries of PII continue to evolve. Staying current requires ongoing attention to regulatory developments, particularly in jurisdictions where your customers are located and where enforcement activity is highest.
How FullContact helps with personally identifiable information compliance
Managing personally identifiable information responsibly requires more than legal awareness. It requires the technical infrastructure to handle identity data accurately, consistently, and in a privacy-safe way at scale. That is exactly where we come in.
Our real-time Identity Resolution platform is built with privacy at its core. Rather than creating a simple customer database, we maintain a true identity graph that connects identifiers across devices and channels while keeping your first-party data separate and secure. This architecture supports PII compliance in several practical ways:
- Privacy-safe resolution: We resolve identities without exposing raw PII across systems, reducing the risk of unnecessary data sharing that regulators scrutinize.
- Consent-compatible enrichment: Our platform appends insights to customer records in a way that respects the consent and data minimization principles central to GDPR and CCPA.
- Accurate identity unification: By linking fragmented identifiers into a single, accurate customer profile, we help eliminate the duplicate and inconsistent records that create compliance blind spots.
- Real-time API responses: With responses in under 150 milliseconds, we support the kind of real-time data accuracy that regulators expect when individuals exercise rights like access or deletion.
If your organization is working through the complexity of PII laws and wants a partner who understands both the technical and regulatory dimensions of identity data, we would love to help. Feel free to contact us to explore how our platform can support your compliance and personalization goals at the same time.
