PI is the common abbreviation for personal information, the term California's consumer privacy statute uses where European law says personal data. The definitions differ in ways that matter, and California's is broader than most people expect in three specific directions: it reaches households, it reaches inferences, and it reaches identifiers that never name anybody.
The definition, in short
Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The statute then lists examples: identifiers, commercial information, biometric information, internet activity including browsing and search history, geolocation, audio and visual information, employment and education information, and inferences drawn to create a profile. Publicly available information from government records and properly deidentified or aggregate data are outside it.
Edge one: households
Nowhere else works this way. Information about a household is personal information even where no individual is identified, which sweeps in smart device data, some IP-level analytics and anything tied to a delivery address rather than a person. It also complicates requests, because a household-level request may involve data about several people, and the regulations set conditions on responding to one.
Edge two: inferences, edge three: identifiers
Inferences drawn from any of the listed information to create a profile reflecting preferences, characteristics, behavior or aptitudes are themselves personal information, so a propensity score you calculated is in scope exactly as the inputs are. And identifiers count: cookie ids, device identifiers, IP addresses and advertising identifiers are named, which means a site that has never asked for a name still holds personal information about its visitors.
Why the breadth matters in practice
It decides the answers to the questions that cost money. Whether you are over the volume threshold, which counts consumers and households. What has to be disclosed in the notice. What has to be searched when a request arrives, which includes the analytics and advertising systems most businesses forget. And whether passing an identifier to an advertising platform is a sale or a share, which it usually is.
Questions people ask about pi information
Is an IP address personal information?
In California it is a named identifier. In Europe it is personal data where the holder can link it to a person by means reasonably likely to be used. Treat it as in scope in both.
Is business contact information covered?
California's earlier exemptions for business-to-business contacts have expired, so a work email address is personal information like any other.
What is deidentified data?
Data that cannot reasonably be used to infer information about, or be linked to, a particular consumer, with the business committing publicly to keep it that way and taking measures to prevent reidentification. The commitment is part of the definition, not an optional extra.