Device data is everything a site or app learns about the machine rather than about the person: the identifier, the model, the operating system, the screen, the language, the network and the behavior. It is collected by default by almost every analytics and advertising tool, it is rarely described in a small company's privacy notice, and it is personal information far more often than people assume.
The three kinds
Identifiers: cookie ids, advertising identifiers, vendor identifiers, push tokens and, where fingerprinting is used, a hash derived from characteristics. Characteristics: model, operating system version, browser, screen size, language, timezone, network. Behavior: pages and screens seen, taps, sessions, crashes, and increasingly precise or approximate location. The first is designed to be persistent, the second is mostly harmless alone and identifying in combination, and the third is the one that builds a profile.
When it becomes personal information
As soon as it can reasonably be linked to a person or a household. California names unique personal identifiers, cookies, beacons, device identifiers and IP addresses expressly, so a business collecting them holds personal information whether or not it holds a name. In Europe the test is whether the person is identifiable by means reasonably likely to be used, which online identifiers routinely satisfy because they persist across sessions and are joined to account data somewhere in the chain.
The fingerprinting question
Combining enough device characteristics produces an identifier without storing anything on the device, which is why some tools present it as a privacy-friendly alternative to cookies. It is not treated as one. The output is a persistent identifier for a person's device, so it carries the same obligations and, because it cannot be cleared by the user, it is harder to justify and increasingly the subject of platform restrictions as well as regulatory attention.
What the notice has to say
Which identifiers you collect, what device characteristics, what behavior, and why each. Who receives them, which for analytics and advertising tools means naming the categories at minimum. How long they persist. And what the user can do: the cookie controls, the platform's own advertising identifier setting, and, where you sell or share, the opt-out. A notice that describes the form fields and omits all of this describes the smaller half of what the business collects.
Questions people ask about device data
Is device data personal if we never learn a name?
Usually yes. A persistent identifier tied to a device is personal information under California's definition and personal data in Europe whenever the person is identifiable, which is the ordinary case online.
Does an IP address count?
It is named as an identifier in California and treated as personal data in Europe where it can be linked to a person. Truncating it before storage materially reduces the exposure and is worth doing where the analytics still works.
What about crash reports?
They usually carry a device identifier and sometimes user content in the stack trace. They are processing like any other and belong in the notice and in the vendor list.