What is Personal data?
Personal data under the GDPR is any information relating to an identified or identifiable natural person. It explicitly includes online identifiers such as IP addresses, cookie identifiers and device fingerprints. Data that cannot be linked back to a person by anyone, including you, falls outside the definition — and outside most of the obligations that follow from it.
Explanatory, not legal advice.
Broader than “name and email”
The test is identifiability, not sensitivity. Data is personal if a person can be singled out from it, directly or by combining it with other information reasonably likely to be available.
That sweeps in things people rarely think of as personal: IP addresses (confirmed by the CJEU in Breyer), cookie identifiers, advertising IDs, and device fingerprints. It is why analytics is a privacy question at all.
Pseudonymous is not anonymous
This distinction decides real obligations.
Pseudonymised data has identifiers replaced with a key — but a key that can be reversed, or joined with something else, still points at a person. It remains personal data and the GDPR still applies in full.
Anonymous data cannot be linked back to a person by anyone, including the organisation holding it, with any means reasonably likely to be used. It falls outside the regulation.
Most “anonymised” analytics is pseudonymised. A stable visitor identifier, even a meaningless-looking hash, is a pseudonym: it singles someone out across visits, which is exactly what identifiability means.
Where the line falls in practice
A hash of an IP address is generally still personal data if it is stable — the same input always produces the same output, so the identifier persists and the original can often be recovered by brute force over the small IP space.
Rotating the salt on a schedule changes this materially. Once the salt is discarded, yesterday’s identifiers cannot be reproduced or linked to today’s, so nobody can single out a person across the boundary. sonex rotates daily and never stores the address itself — only the coarse geography derived from it and a hash that expires with the salt.