Furthermore, you probably know the IP of the user you're serving a page to, that combined with this data also makes it PII..
It's not about wether you can determine the person's name, mail address or whatever, it's wether this combination of data is or can be unique to a single person.
You can of course cookie match with them so it is possible to persinnaly identify someone if you were able to cookie them.
> In the end Google allowed publishers to use whatever method they want.
The phrase "personally identifying information" does not occur anywhere in the text of GDPR. The term used throughout is "personal data", which is defined differently.
>It's not about wether you can determine the person's name, mail address or whatever, it's wether this combination of data is or can be unique to a single person.
Uniqueness is irrelevant unless there is sufficient identifying data to associate that data with an identifiable natural person. Unless you have some means of ultimately figuring out "this data belongs to Joe Bloggs of 123 Any Street", then it isn't personal data.
Art. 4 (1):
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
https://gdpr-info.eu/art-4-gdpr/
Pseudonymous data falls within the scope of GDPR if other information could be used to associate that data with an identifiable natural person. Truly anonymous data is exempt - you might know a lot about person X, but that's only personal data if you can figure out that Person X is actually Joe Bloggs. It really isn't clear to me that Google are in breach in this instance; it's highly plausible that they are, Brave's allegations certainly warrant investigation, but the law is relatively complex and it's also somewhat plausible that Google are sailing very close to the wind while just barely remaining in compliance.
That's not exactly accurate.
I like the ICO's literature on this[1] because they put a little more colour on what it means to be "indirectly" identifiable, and they are pretty clear:
• You don’t have to know someone’s name for them to be directly identifiable, a combination of other identifiers may be sufficient to identify the individual.
• It is important to be aware that information you hold may indirectly identify an individual and therefore could constitute personal data.
• That additional information may be information you already hold, or it may be information that you need to obtain from another source.
That's the case here: An ISP such as Vodafone knows the IP addresses of their broadband users, and perhaps even some of their cookies -- they have this other piece of data that makes what Google is providing personal data. To my knowledge Google isn't attempting to even argue otherwise, instead they have taken the position that the person has consented (using various consent managers or click-to-accept dialog boxes), so therefore it's pseudonymous, which makes your next paragraph a little more important:
> Pseudonymous data falls within the scope of GDPR if other information could be used to associate that data with an identifiable natural person. Truly anonymous data is exempt...
This is incorrect. Again from the ICO:
• Pseudonymised data can help reduce privacy risks by making it more difficult to identify individuals, but it is still personal data.
• Information which has had identifiers removed or replaced in order to pseudonymise the data is still personal data for the purposes of GDPR.
Very clear: All it takes is for the data to relate to a person.
> It really isn't clear to me that Google are in breach in this instance
It's not clear to me either, or (to my knowledge) to the Irish DPC at this stage, but part of their responsibility is to figure it out. They have released very little information so far[2] so there's little point armchair-lawyering on what their position or defence would be.
[1]: https://ico.org.uk/for-organisations/guide-to-data-protectio...
[2]: https://www.dataprotection.ie/en/news-media/press-releases/d...