Yeah, that's exactly my problem, practically. It is hard not to send IP addresses to US affiliated companies. You are probably right that it is not as simple as

Yeah, that's exactly my problem, practically. It is hard not to send IP addresses to US affiliated companies. You are probably right that it is not as simple as what the definition of PII is. In my privacy policies, I try to follow what I think is the spirit of the law and hope/pray for the best. I list point for point what data I use, why and to what third party tools I send it. That's like 2 sentences per point. I have never checked with a lawyer and don't copy and paste any legalese like everyone else seems to do. After reading through the court decision here, I'm almost certain that what I do, and how much I explain it, is not legally acceptable, but I feel fine about it.