Broader than it sounds
Article 4(1) of the GDPR defines personal data as information relating to an identified or identifiable natural person, and says expressly that an identifiable person is one who can be identified by reference to an identifier such as a name, an identification number, location data or an online identifier. Recital 30 names cookie identifiers.
The test that matters in practice is whether the information can single someone out, not whether you know their name. An advertising identifier that follows a browser across sites does exactly that.
Where other regimes draw the line
| Regime | How cookie identifiers are treated |
|---|---|
| GDPR / UK GDPR | Personal data where the person is identifiable |
| CCPA | Personal information; unique identifiers are enumerated |
| APPI | Personal information where the business can identify a person alone or by readily collating other information; otherwise it may be personally referable information subject to transfer rules |
| Australia | Personal information where the individual is reasonably identifiable |
Common questions
Is an IP address personal data?
In the EEA, generally yes: the Court of Justice has treated a dynamic IP address as personal data in the hands of someone with the legal means to identify the subscriber. It is one reason a request that leaves the browser is a processing event even when it sets no cookie.
Are pseudonymous consent records personal data?
Generally yes. Pseudonymisation reduces risk; it does not take the data outside the definition, because the person remains identifiable with additional information.
Sources and verification
Verified on . Product-behaviour statements were checked against the current implementation and tests. The links below are the verification basis recorded for this article. They support the stated facts, not a legal conclusion for every site or configuration; recheck changing vendor behaviour before relying on it in production.
- Regulation (EU) 2016/679 (GDPR)
Legislation
Checked
See what your own site is loading
A browser scan reports the requests and storage it observed during the sampled journey. Use configured workspace scans to compare the states and pages that matter to your implementation.