> any data with 33 bits of entropy is technically PII, Well yes, but actually no. I can run UUIDgen 33 times and put it on pastebin, via tor. That does not me

> any data with 33 bits of entropy is technically PII, Well yes, but actually no. I can run UUIDgen 33 times and put it on pastebin, via tor. That does not mean I have 128 peoples' worth of PII. In fact I have ~0 bits of PII. If I were to paste one of those numbers in this comment, now they are all linked to kortex, and however much entropy that username has (call it 32, this account is leaky). But you are still short 127 "PIIs". The rest of the entropy means nothing. Conversely, a US phone number is <24 bits, but 100% PII. It's not 33 bits of "entropy". It's 33 bits worth of a distribution which can be correlated to an identity. If it's not correlated, it's not PII.