Personal data
Personal data is any information relating to an identified or identifiable natural person, including online identifiers such as cookie IDs, advertising IDs and IP addresses that can single someone out.Article 4(1) of the GDPR defines personal data as any information relating to an identified or identifiable natural person, and lists identifiers: a name, an identification number, location data, an online identifier, or factors specific to a person's identity. Recital 30 names cookie identifiers, IP addresses and RFID tags as online identifiers that may leave traces which, combined with other information, identify people. The Court of Justice held in Breyer (C-582/14, 19 October 2016) that a dynamic IP address is personal data for a website operator that has lawful means to identify the person.
The consequence for cookies is that a unique identifier is personal data even without a name, because it singles out a browser and, through it, a person. That is why analytics and advertising cookies fall under the GDPR as well as the ePrivacy Directive, and why "we do not collect personal data" is rarely true of a site with tracking.
Other laws draw the line similarly. California's personal information includes information linked to a household and expressly names IP addresses, cookies, beacons, pixel tags and advertising identifiers. Brazil's LGPD, Türkiye's KVKK and Quebec's Law 25 use identifiability as the test; South Africa's POPIA lists online identifiers and even covers juristic persons; Australia asks whether the person is reasonably identifiable. The opposite of personal data is anonymized data, and pseudonymized data sits in between: still personal, but safer.