Personally Identifiable Information

Your phone logs location pings every few minutes, your browser stores cookies from every site you visit, and your search engine keeps a history of every query. None of these alone says much. But a company or app that collects all of them over time can stitch them into a single detailed profile: where you live, where you work, what you searched at 2am, which stores you walked past on a Tuesday. That profile is built automatically, in the background, as a byproduct of normal use. No one typed your name into it, yet it describes you more precisely than a name ever could.

This is why removing a name from a data set does not make it anonymous. Birth date, zip code, and gender sound harmless separately, but combined they narrow a large population down to a handful of people, often just one. Computer scientists call this re-identification: using outside information or overlapping data sets to figure out who a supposedly anonymous record belongs to. The fewer categories of data needed to isolate someone, the weaker the anonymity, no matter how official the data set looks after a name column is deleted.

This connects to the rest of Big Idea 5 because PII is the raw material behind both the benefits and harms of computing at scale. The same accumulated data that lets a map app predict your commute can also be sold, leaked, or subpoenaed. And once personal data is copied to another server, screenshot, or third party, deleting the original copy does not erase those copies. The data persists wherever it traveled, which is why privacy depends on controlling collection up front, not just deletion after the fact.