What Personal Information Under the US Privacy Laws Is Not

Personal information under the US privacy laws is data that identifies, relates to, or could reasonably be linked to you or your household, defined statute by statute rather than by a single federal code, and the definition grants you rights rather than protection. Scattered definitions invite a false comfort: the reader assumes a defined term is a defended one.

That gap is the whole story. A right to request deletion obligates someone else to respond to you; it obligates no one to keep the record off the open web in the first place.

What the Term Means in a US Statute and What It Does Not

Personal information is a defined term with a scope that changes by statute and by regulator, and the widest version of that scope is the one to plan against. Under the California Consumer Privacy Act, personal information includes any data that identifies, relates to, or could reasonably be linked to you or your household, directly or indirectly (privacy.ca.gov). That phrasing reaches inference, not just fact: a modeled income band or a guessed home value counts.

Other verticals define the same term to their own purposes. The COPPA Rule applies to the collection, use, and disclosure of personal information collected from children (ftc.gov), with a narrower list of covered identifiers and a narrower set of covered parties. The Federal Privacy Act of 1974 attempts to prohibit federal agencies from disclosing any information they keep about a person by using the person's name or some other personally identifying number or symbol (cga.ct.gov), which covers a different custodian entirely: the government, not the broker.

The distinction matters for anyone weighing statute against adjacent concepts. A compliance officer reads the definition to decide which notices to serve and which vendors to audit. A subject reads the same definition expecting something that will be withheld on their behalf. It will not be, and the reader who understands that difference files the right request in the right decade. The paper trail of a request and its real mechanics is covered in our breakdown of what actually works in a removal request.

Consider a surname that appears on a licensed-professional directory, a campaign contribution filing, and a county property record within one search page. Only some of that sits in a commercial broker's index and only some of it responds to a statutory request. No statute spans the set, so the reader has to.

Rights, Requests, and the Machinery Behind a Deletion

The moving parts are plain once you stop reading the definition and start watching the traffic. A covered business collects identifiers, inferences, and commercial behavior, repackages them, and sells access to parties who combine them again. Your statutory rights arrive later in that chain, and each right is a lever rather than a lock: access, correction, deletion, and opt-out of sale or sharing, each triggered only when you invoke it against a specific controller.

Here is the constraint nobody puts in the first paragraph: the request runs to one company at a time. A controller can say it has no matching record, can extend its response window, and can re-collect from a fresh source after a deletion is honored. Compliance is measured on process, so a business that answered your request on time is compliant even while an identical listing sits on a different site.

A 2016 paper on the datafication of personal information, Mai in The Information Society, frames the difficulty well: the value of the record emerges from aggregation, so each individual deletion removes one input while the derived profiles persist elsewhere. The legal category was written for a world of discrete files. The operational reality is a pipeline.

State data broker registries add a layer worth watching. The California data broker statute states explicitly that nothing in it supersedes or interferes with the California Consumer Privacy Act of 2018 (cppa.ca.gov), which means registration and the private right to request deletion run in parallel, not in sequence. You are not waiting on one to unlock the other.

For a broader view of the limits of the free removal tools, the short version is that free tools operate at the index, not at the source.

The Removal Sequence, Run in Order

Run the steps in this order and each one makes the next cheaper. Skip ahead and you spend effort removing pages that a source-level deletion would have retired for good.

1. Inventory what is actually exposed. Search your name in quotes, then with your city, your employer, and your family members' names. Record every result with a URL, the host, and the date you found it.
2. Classify each result by custodian. A data broker's profile page, a government recorder's public filing, and a news archive each follow a different removal path, and the statutory route only reaches some of them.
3. File source-level requests first. Contact the broker or publisher that creates the listing and use its deletion channel; a removal at the source often retires the index entry without a second request.
4. File search-level delisting only for what survives. Where the source will not remove, a delisting request against the search index hides the result without touching it, which is worth knowing before you count it as gone.
5. Build legitimate replacement content. Public profile pages and professional material that rank for your name push stale records down the page, and this is the only step that works without anyone's permission.
6. Re-check the same query set on a fixed cadence. Listings return with new timestamps, and a sweep measured once has no idea what came back.

What the free route deletes and what it quietly leaves in place is narrower than the button suggests, as our review of what free Google removal deletes and what it leaves sets out. At Area 52, the removal work combines data broker suppression, dark web monitoring, and content creation so the page has something better to show, all assigned to a dedicated Digital Guard per client.

Criteria That Separate a Real Removal Program From a Signed Form

Judge a provider the way you would judge an insurance policy: by what is excluded, not what is promised. These are the questions that produce a real answer.

Criterion	What a real program shows	What a form-filler shows
Broker scope	A named count of sources covered and a stated method for adding new ones	"Hundreds of sites" with no list and no update cadence
Re-listing cadence	A defined re-check interval and a report that shows it	A single confirmation email at signup
Source vs. index	Requests filed at the custodian, not just delisting at the search layer	Search removal only
Reputation side	Content creation or suppression that changes the page itself	Nothing addressing what ranks once the listing is gone
Security coverage	Dark web monitoring and vulnerability scans alongside removal	Removal alone
Accountability	A named contact or assigned guard per client	A ticket queue with no owner

Two criteria get skipped most often and matter most. Source-level filing costs more work than a delisting request and holds longer. And a program without a reputation component leaves an empty space on the results page that the next record fills.

Where Practitioners Get the Definition Wrong

The costliest error is treating the statutory definition as the boundary of the problem. It is the boundary of the legal obligation, which is a smaller circle. Records that fall outside every covered category, or that sit with a custodian given an exemption, remain public and searchable while the compliance file looks clean.

A second failure comes from reading one statute as the national rule. Definitions differ across states, and so do thresholds and covered entities; the PPI scope question is where readers most often inherit a definition from a blog that misquotes the statute.

Practitioners also file requests without evidence. A deletion request sent without the specific URL, the screenshot, and a timestamp gives the controller an easy basis to answer "no record found." Keep the evidence set and replay the same request against the next controller rather than starting from a blank page.

A related error is counting a delisting as a deletion. The indexed snippet disappears from search while the underlying record stays on the broker's server and often on a mirror. When the search engine refreshes or a new mirror appears, the record resurfaces, and the reader concludes the program failed when the record was never gone.

The last one is organizational. Rarely does anyone own the household's exposure. A board member's spouse's email, the home address on a school form, and a decade-old filing sit with no named owner, and each is reachable from the same search. Coverage is what the program is for, and a program with one named owner for an entire household is the only version that stays current.

The Signals That Say Start Now

You face a decision about whether this is a compliance task or a protection program, and the evidence around you settles which it needs to be. A compliance task fits when the reader's exposure is limited to an HR file, with no public footprint and no board-facing role; the statutory requests in the sequence above cover that case and no more.

Treat it as a protection program when the record set includes a home address next to a family name, a resignation letter, or a comment thread that ranks on page one for the reader's name. Each of those is a starting point for a stranger's reconstruction of your schedule, and each is a record that a compliance file can be spotless while it sits open.

The signals that force a start are specific: a listing that moved, a new broker profile with a timestamp from this month, a security check that names your mother's maiden name, or a query from a peer who found your phone number on an unfamiliar site. The COPPA Rule's actual-knowledge test for nine covered site categories is a reminder that operating rules follow knowledge, not intent, and a reader who has been told about the exposure now knows it.

If you are unsure which version of the problem you have, start with the inventory and a page-by-page classification before contacting anyone. Removing what will return in three months is wasted motion, and suppression without replacement leaves the page worse than before.

Frequently Asked Questions

What is personal information under privacy laws?

It is a statutory term for data that can be tied to a person or household, defined separately by each law rather than by a single federal code. The California Consumer Privacy Act states that personal information includes any data that identifies, relates to, or could reasonably be linked to you or your household, directly or indirectly. Vertical rules, such as the COPPA Rule for data collected from children, define the same term differently for the records they cover.

What are 5 examples of personal information?

A full name paired with an address; an email address and phone number; a Social Security number or other government identifier; a record of purchases tied to a loyalty account; and a household-level inference, such as an estimated income band, derived from other records. The location data from a phone and the IP address attached to a session fall inside the broader state definitions.

What falls under personal information?

Under the widest state definitions, direct identifiers, commercial activity, unique device and online identifiers, geolocation, professional or employment data, and inferences drawn from any of the above. The COPPA Rule's scope for children is narrower, and the Federal Privacy Act's restriction on federal agencies is narrower still. Whether an item falls under a definition depends on which law you are asking about, what the custodian collects, and who is asking.

What are the four types of personal information?

Four categories are recognized to describe exposure and handling: identifiers, the data used to contact or locate a person; sensitive categories, such as health, biometric, financial, and government identifiers; commercial or behavioral records; and inferred or derived profiles. Naming the type is useful because the type predicts both the sensitivity of the leak and whether a given removal channel reaches it.

Sources

1. privacy.ca.gov

   Under the California Consumer Privacy Act, personal information includes any data that identifies, relates to, or could reasonably be linked to you or your household, directly or indirectly.

Sources checked on October 23, 2026.