gdpr privacy ccpa
Are push tokens considered PII under the GDPR or the CCPA?
<p>I'm building a server for an app and I'm trying to get my privacy protections right.</p>
<p>The app allows users to opt in to push notifications.  If the user opts in, then I save a push notification token to later send notifications to that user on my server.</p>
<p>Are such push notification tokens considered to be personally identifiable information under the GDPR or the CCPA?</p>
<p>It seems to be it could be yes because the token can be used to push messages to a user (like a phone number or email address), or no because it only identifies a device and not a human being.</p>

<p>Yes, but it doesn't matter. This answer discusses <a href="/questions/tagged/gdpr" class="post-tag" title="show questions tagged &#39;gdpr&#39;" aria-label="show questions tagged &#39;gdpr&#39;" rel="tag" aria-labelledby="gdpr-container">gdpr</a> implications.</p>
<p>Personal data is any information that relates to an identifiable person. The GDPR has an extremely broad concept of identifiability, also covering indirect identification using additional information and with the help of third parties. Even just being able to single out one data subject, i.e. being able to distinguish different users from another, counts as identification.</p>
<p>If you already have a concept of user accounts, any information that is linked with the user accounts and somehow relates to those users would also be personal data. Since you have distinct push tokens per user, it seems like this criterion would be met. Additionally, those unique tokens might be directly identifying by themselves.</p>
<p>The GDPR does not allow for semantic games like “it only identifies the device, not the user”. The key here is that the definition of identifiability does not hinge on your intentions, but on objective capabilities: if you or someone else who can come into possession of this data were to attempt to identify the user (such as singling out users from another), would they be <em>reasonably likely</em> able to do that? Since most devices are single-user, being able to identify a device would imply that you're reasonably likely to also identify users.</p>
<p>Just because something is personal data doesn't mean you're forbidden from using that data. It means that you'd have to comply with GDPR rules, if you're otherwise within scope of that regulation (e.g. if you're EU/UK-based, or are targeting your services to people who are in UK/EU). For example, basic GDPR compliance steps include having a clear legal basis for your processing of personal data (such as necessity for performing a contract to which the data subject is party, or necessity for a legitimate interest, or consent), providing a privacy notice, and taking appropriate technical and organizational measures (TOMs) to ensure the compliance and security of processing. For example, TOMs regarding these push tokens could involve encryption, access controls, and a plan for installing security patches in order to prevent data breaches.</p>
<p>Using push tokens is already a good measure in this context, since they are effectively pseudonymous and prevent linking additional information via that token (two sites/apps pushing notifications to the same person will have entirely different tokens). However, the push notification provider (e.g. Google, Apple, Mozilla) can resolve the pseudonymous tokens and link them to a person, indicating that these tokens are ultimately identifying (even if you can't perform that linking yourself).</p>
<p>Note that if GDPR applies, then other EU/UK rules might apply as well. For example, sending electronic messages (such as emails) is subject to anti-spam rules (EU: ePrivacy, UK: PECR). These rules apply regardless of whether personal data is involved. Since the rules are not technology-specific, it is likely that regulators would consider user-visible push notifications to be equivalent to more well understood technologies like email and SMS.</p>

<blockquote>
<p>it only identifies a device and not a human being</p>
</blockquote>
<p>It identifies a device that is associated with an identifiable person.  As <a href="https://law.stackexchange.com/a/61091/333">an IP address is personal data under the GDPR</a>, it's hard to see how a push token would not be.</p>
