There is no concept of PII under GDPR. There is personal data (information about a natural living person) and identifiers (information that connects personal da

There is no concept of PII under GDPR. There is personal data (information about a natural living person) and identifiers (information that connects personal data with an identifiable natural living person). An IP address is usually an identifier - it's not completely unique, but it is potentially enough (especially when combined with other identifiers) to uniquely identify the subject of a piece of personal data. This tweet is overwhelmingly unlikely to be a breach of GDPR, because the controller (Julien Chaumond) has no ability to correlate an entire /8 range with a natural living person. Nobody is identifiable, there is no personal data, therefore the activity is not in scope. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/