Personally Identifiable Information (PII) is basically any data that can identify an individual user. So PII would include things like name, address, emails, and phone numbers—these are all data points that are protected because they are traced back directly to individual people. Non-PII data, like cookies, IP addresses and location, are used to see broad trends in data, but do not necessarily map back to a specific person.
In addition to federal regulations on personal information in some sectors, at least 24 states have also restricted the type of Personally Identifiable Information that can be used for digital marketing. But this is good: it means that our online privacy is better protected, and the super-creepy, hyper-personalized ads are left in the past. These restrictions aren't new, but after a few...ahem...bad actors emerged in 2016, PII has been more heavily restricted. The entire digital ad industry as a whole has been proactive in losing PII and cookie targeting, which is why the industry has largely transitioned to modeled identity graphs in the past few years—these well-developed alternatives actually increase the likelihood of reaching your target audience more effectively with great reach and frequency.
So what does this mean for your ads? It basically means that we can put PII into the system—but once ads begin to be served to users, we can't get PII back out of the system. For example, we may know the exact names, addresses, email addresses, and phone numbers of the 10,000 people we upload into the system for a first-party data match. That is PII we are putting into the system. But once the data has matched, we can't know specifically who on that list actually achieved a match and who didn't—we may know that we had a 75% match rate, which means that we know about 7,500 people on that list were matched, and ads will be delivered to those 7,500 people—but there is no way to find out who is now going to see ads and who won't. In short, once PII is uploaded, the ads will be served on a 1-1 basis even though we can't see exactly who they are going to. This is why we always advocate for layering in additional third-party and contextual look-alike audiences to help bridge the gap between matched audiences and your actual target audience.
The restrictions on PII hold true with third-party targets and retargeting ads—we can know generally where ad viewers are and what they look like as a whole audience, but we can't export a list that says "Chris Traeger saw the ad 4 times, Leslie Knope saw the ad 2 times, and Ron Swanson didn't match with any data to receive ads" (go figure). As granular as digital advertising may seem at times, the process is truly about large trends and contextual audiences, not specific ad viewers.