The problem is stretching the definition of PII beyond it‘s breaking point to include shortened (!) IP addresses, anonymous identifiers and fingerprintable http headers. Now this forbids the transmission, not the storage, of such data. What‘s even the point anymore?
In the US, what is generally regulated is "posession" of data, with narrow definitions of what PII is and no restrictions on anything that isn't. In GDPR, what is regulated instead is the possible justifications for processing of that data.
For example, (IANAL caveat aside, speak to an actual privacy lawyer) it is fine for me to store full, unredacted IP addresses in my access logs for diagnostic purposes.
However I, for example:
- have to be able to provide information on what is stored and under what justification
- have to provide information on who that data is transmitted to
- have to be able to show an authority it is really necessary for me to store this data unredacted
- must put in place adequate measures to protect it
- am liable for exposure of that data
and may not:
- store the data longer than necessary
- use that data for other reasons, such as marketing
- transmit that data to a third party unless it is contractually bound to the same restrictions as me
When something is personal information, the only thing that means is that it is illegal to not have a justification for processing or storing it.
So for your example, processing headers is fine, fingerprinting headers is probably not. Recording shortened ip addresses is fine, unnecessarily sending them to the US is probably not. Anonymous identifiers are fine, tracking people with them is probably not, etc.
In my privacy policies, I try to follow what I think is the spirit of the law and hope/pray for the best. I list point for point what data I use, why and to what third party tools I send it. That's like 2 sentences per point. I have never checked with a lawyer and don't copy and paste any legalese like everyone else seems to do. After reading through the court decision here, I'm almost certain that what I do, and how much I explain it, is not legally acceptable, but I feel fine about it.