28 CFR §202.234

1. (a)Full or truncated government identification or account number (such as a Social Security number, driver's license or State identification number, passport number, or Alien Registration Number);
2. (b)Full financial account numbers or personal identification numbers associated with a financial institution or financial-services company;
3. (c)Device-based or hardware-based identifier (such as International Mobile Equipment Identity (“IMEI”), Media Access Control (“MAC”) address, or Subscriber Identity Module (“SIM”) card number);
4. (d)Demographic or contact data (such as first and last name, birth date, birthplace, ZIP code, residential street or postal address, phone number, email address, or similar public account identifiers);
5. (e)Advertising identifier (such as Google Advertising ID, Apple ID for Advertisers, or other mobile advertising ID (“MAID”));
6. (f)Account-authentication data (such as account username, account password, or an answer to security questions);
7. (g)Network-based identifier (such as Internet Protocol (“IP”) address or cookie data); or
8. (h)Call-detail data (such as Customer Proprietary Network Information (“CPNI”)).