Understanding PII in Google's contracts and policies

Many contracts, terms of service, and policies for Google's advertising and measurement products refer to "Personally Identifiable Information" (PII). This is a different categorization of data from what the EU General Data Protection Regulation (GDPR) refers to as "personal data".

Please note that data excluded from Google's interpretation of PII may still be considered personal data under the GDPR, or personal information under any of the several laws that establish various rights for applicable US-state residents, and may therefore be subject to these laws.

This article explains how Google will interpret the term PII in the event PII isn't defined in your existing contract or the applicable product's terms of service or policies. This is to minimize confusion among customers and distinguish PII from concepts of personal data or personal information under the GDPR, CPRA and other privacy legislation.

What Google considers PII

Google interprets PII as information that could be used on its own to directly identify, contact, or precisely locate an individual. This includes:

• email addresses
• mailing addresses
• phone numbers
• precise locations (such as GPS coordinates - but see the note below)
• full names or usernames

For example, if you're a publisher whose contract prohibits you from passing PII to Google, the URLs of pages on your website that display ads by Google must not include email addresses, because those URLs would be passed to Google in any ad request. Google has long interpreted its PII prohibition in this way.

Note: Certain products' help centers and policies set out the limited means by which certain forms of PII may be sent to Google. For avoidance of doubt, this article does not amend such provisions. So, for example, certain products allow approximate location data to be sent to Google, provided the requirements of the applicable policies are met.

Google interprets PII to exclude, for example:

• pseudonymous cookie IDs
• pseudonymous advertising IDs
• IP addresses
• other pseudonymous end user identifiers

For instance, if an IP address is sent with an ad request (which will be the case with almost any ad request as a consequence of internet protocols), that transmission will not breach any prohibition on sending PII to Google.

Note that data excluded from Google's interpretation of PII may still be considered personal data or personal information under the GDPR, and other privacy legislation.  This article doesn't affect any contract provisions or policies relating to personal data or personal information under those laws.