In our Android application user is allowed to buy subscription. From code we are retrieving his purchaseToken (using this API ) and saving purchaseToken on our server to validate his license.

According to documentation on above page "purchaseToken" is defined as "A token that uniquely identifies a purchase for a given item and user pair".

From my side as developer: we cannot get exact user who purchased this item based on purchaseToken. Google does not provide such possibility (no API for this). But in theory – if somebody has token + access to Google database – he can identify user exactly.

So the question is: For me as Android Developer, is "purchaseToken" identified as PII (Personally Identifiable Information) or not?

The question is important, because depending on if it is true or false I have to inform user or do not inform about that.

3 Answers 3


IANAL, But the information commissioners office (UK) describe personal data as: (bolding mine)

The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.

This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.


So I would say that in your case it is personal information.

In principle, regardless of if you can identify an individual, personal data is that which can be used to potentially identify an individual.

For an extreme example of why this is important: Lets say your app sells AIDs medication. Can a hacker who got in and stole your database, be able to use that with information they stole elsewhere to identify people with AIDs and blackmail them, in a way that they wouldn't if you had not stored this identifier?

Plus, if you want to err on the side of caution, there's no legal penalty for telling the user about non-personal information you store.


No, it is not personal data (GDPR does not define "PII") because you cannot identify the person it belongs to at reasonable time and costs. It is anonymous data in the context of you/your company/app.

The fact that Google (or any other party) privately knows the link between the token and the user is irrelevant (that said, for Google that token is personal data).

  • What's your source for this? My understanding is it is not relevant if 'you' cannot. For example, just because facebook does not know what I look like, does not mean a picture they have with me in it is not personally identifiable?
    – David
    Commented May 24, 2018 at 14:16
  • @David "you" should actually be read "you and anybody who hacks your database". Your face is identifiable because people around you know how you look like; the link between your picture and your personality is not a privately kept secret (even though Facebook may not know it just yet). Purchase token is different: only Google knows which person it belongs to, the public does not and cannot know it.
    – Greendrake
    Commented May 24, 2018 at 14:41
  • that's a very interesting point, but I don't think the regulation specifies it needs to be identifiable within the same systems? In which case it seems to be down to "the costs of and the amount of time required for identification" in which case, I agree with you: that would be excessive enough in this case for it to be non identifiable. One thought though: If google got hacked, and these identifiers got publicly released, would the data already in his system instantly become personal data?
    – David
    Commented May 24, 2018 at 15:16

I agree with David's answer, and I would just like to add that without need of an external database, the token you store to prove that a payment was done by a given user, who, in accordance with your processing, has the right to obtain a license for your software is a collection and processing of data allowing you to identify such a user individually.

The same reasoning applies here as with cookies. They allow to single-out a person (or even a group of persons using the same browser in the case of cookies), and that suffices to consider that the information collected and stored is personal information, and that you are using it for your own purposes of checking licensing rights (certainly passing through the API your own details about the purchase order).

The token would absolutely not be anonymous data. If it has to be legally classified, it would be pseudonymous information, which is not anonymous because it allows to single-out a person.

See Article 29 Working Party's opinion 0829/14/EN WP216 on the subject for more details about Anonymisation Techniques and distinctions with pseudonymisation.

When referring to "costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments" in Recital 26 the GDPR is simply covering the case where while an Anonymisation Technique may be considered safe at a certain point in time, as the technology evolves, this may not longer be the case.

It is interesting to note that, at the time WP29 wrote the above mentioned opinion, the draft versions of GDPR were being amended by the European Parliament, and WP29 expressly noted this amendment (at that time contained in a Recital 23), and that after referring to it (footnote 6 in 2.2.2) WP29 subsequently stated that "It should be noted that the identification risk may increase over time and depends also on the development of information and communication technology".

To answer the OP's question, tokenization is expressly referred to by WP29 as being a pseudonymisation technique (Section 4, page 21), and not an anonymisation technique.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .