This is a really common misunderstanding of the differences between GDPR and US privacy laws. In the US, what is generally regulated is "posession" of data, wi

This is a really common misunderstanding of the differences between GDPR and US privacy laws. In the US, what is generally regulated is "posession" of data, with narrow definitions of what PII is and no restrictions on anything that isn't. In GDPR, what is regulated instead is the possible justifications for processing of that data. For example, (IANAL caveat aside, speak to an actual privacy lawyer) it is fine for me to store full, unredacted IP addresses in my access logs for diagnostic purposes. However I, for example: - have to be able to provide information on what is stored and under what justification - have to provide information on who that data is transmitted to - have to be able to show an authority it is really necessary for me to store this data unredacted - must put in place adequate measures to protect it - am liable for exposure of that data and may not: - store the data longer than necessary - use that data for other reasons, such as marketing - transmit that data to a third party unless it is contractually bound to the same restrictions as me When something is personal information, the only thing that means is that it is illegal to not have a justification for processing or storing it. So for your example, processing headers is fine, fingerprinting headers is probably not. Recording shortened ip addresses is fine, unnecessarily sending them to the US is probably not. Anonymous identifiers are fine, tracking people with them is probably not, etc.