Personal data is any information relating to an identified or identifiable natural person. Under GDPR Article 4(1), a person is identifiable through names, ID numbers, location data, online identifiers, or physical, psychological, genetic, or social factors. For website operators, personal data includes far more than names and emails — IP addresses, cookie identifiers, device fingerprints, and behavioral profiles all qualify when they can be linked to an individual, even indirectly. This is why cookie consent is required: cookie identifiers constitute personal data from the moment they are set on a user's device. Only fully anonymized data falls outside GDPR's scope.