De-identification is the process of altering a dataset so that the records in it can no longer be tied to the people they describe. The point of doing it is legal rather than technical. Data that identifies a person is regulated; data that does not is largely unregulated. A retailer's purchase log, a publisher's exposure file or a measurement vendor's conversion table becomes far cheaper to store, share and sell the moment it stops counting as personal information.
That makes de-identification a boundary condition rather than a feature. Three separate regimes draw the boundary in three different places, using three different words for roughly the same idea, and an advertising dataset can sit on opposite sides of the line depending on which one applies.
How a dataset is stripped
Practitioners split the fields in a record into two groups. Direct identifiers name a person outright: a full name, an email address, a phone number, a social security number, a device advertising ID. Quasi-identifiers do not name anyone individually but narrow the field when combined: postcode, date of birth, sex, job title, the model of a handset.
Removing the first group is trivial and insufficient. The work is in the second. Four techniques do most of it. Suppression deletes a field outright. Generalisation coarsens it, replacing a birth date with a birth year or a postcode with a region. Perturbation adds statistical noise, of which differential privacy is the formal version, offering a mathematically bounded guarantee rather than a judgement call. Synthetic generation replaces the file with an artificial one that preserves the aggregate distributions and contains no real records at all.
US health law supplies the most prescriptive worked example. Under 45 CFR 164.514, the section of the HIPAA Privacy Rule that governs the practice and was last amended in April 2024, a covered entity has two routes. Safe harbour requires the removal of 18 enumerated categories, from names and email addresses through to biometric identifiers, full-face photographs and any other unique identifying code. The rule is specific about the edges. Geography must be cut back above postcode level, except that the first three digits of a ZIP code may stay if the area they cover holds more than 20,000 people, and must otherwise be zeroed out. Every date element finer than a year has to go, and any age above 89 collapses into a single category of 90 or older.
Safe harbour is a checklist, and passing it is not enough on its own. The rule adds a second condition: the entity must have no actual knowledge that what remains could identify someone. A rural clinic holding the only local case of a rare condition fails that test with all 18 categories stripped.
The alternative route, expert determination, hands the question to a person with recognised statistical expertise who documents that the risk of re-identification is very small. It preserves far more analytical value and costs far more to run. NIST codified the general methodology for federal agencies in Special Publication 800-188, published in final form on 14 September 2023, which pairs traditional de-identification with formal methods and cautions readers about the limits of the former.
Where the term came from
The concept predates the advertising industry's interest in it. Latanya Sweeney, then at Carnegie Mellon, published a working paper in 2000 reporting that 87% of the US population, 216 million people out of 248 million in the 1990 census, held a unique combination of five-digit ZIP code, sex and full date of birth. The finding shaped the HIPAA standard directly.
It has also been disputed. Philippe Golle, then at the Palo Alto Research Center, re-ran the analysis against 2000 census data and reported 63%, with 61% for 1990, and wrote that he could not explain the discrepancy for lack of detail about the earlier study's methodology. Both numbers remain in circulation. Neither materially changes the conclusion that three ordinary demographic fields identify most people.
Practice caught up in 2006, when AOL published a set of search logs with user names replaced by numbers and journalists identified individual users from the queries alone. Europe formalised its own test on 10 April 2014, when the Article 29 Working Party adopted Opinion 05/2014 and set out three criteria: singling out, linkability and inference. That framework governed European practice for twelve years.
Why the boundary carries money
Anonymised data falls outside the General Data Protection Regulation entirely. There is no lawful basis to establish, no retention clock, no access or deletion right. The same asymmetry runs through US state law, where the California Consumer Privacy Act excludes deidentified and aggregate consumer information from the definition of personal information altogether. For identity graphs, clean rooms and cross-context measurement systems, qualifying is worth the whole compliance overhead.
California attaches conditions rather than a technical standard. The statutory definition at Civil Code section 1798.140(m), rewritten by Proposition 24 in November 2020, requires that the information cannot reasonably be used to infer anything about a particular consumer, and adds three obligations on the business holding it: reasonable measures to stop the data being associated with a consumer or household, a public commitment not to attempt re-identification, and contractual terms binding every recipient to the same conditions. Testing the effectiveness of the process is the only permitted exception. The consequence is that de-identification in California is a governance posture as much as a data transformation, and one that travels down the supply chain by contract.
The regulator's answer has been that the label is not self-certifying. On 24 July 2024 the Federal Trade Commission restated that hashing does not produce anonymous data, noting that a hashed email remains a persistent unique identifier and that claiming otherwise can be deceptive. It followed on 13 November 2024 with a staff post warning that clean rooms are not privacy-preserving by default. In December 2025 the commission distributed $15.3 million to 103,152 Avast customers over browsing data the agency argued remained re-identifiable despite processing intended to obscure it.
The failure mode is expensive because it is retroactive. If a dataset treated as anonymous is later found to contain identifiable people, the controller is accountable for having processed personal data without a lawful basis for the entire period the mistake ran.
Where it breaks
Three problems recur.
The first is that re-identification risk rises over time as auxiliary datasets accumulate and techniques improve. A file that passed in 2019 has not necessarily passed since.
The second is inference. The European Data Protection Board's Guidelines 02/2026 on Anonymisation replaced the 2014 test with three criteria of their own: No Record Isolation, No Linkage and No Inference. That last criterion is the newly explicit one, and it captures cases where a party can draw a specific and meaningful conclusion about someone without isolating a record or matching it externally. Membership inference against a machine learning model, establishing only that a given person's data sat in the training set, can breach it. Given how much of targeted advertising rests on inferred rather than declared attributes, lookalike modelling and propensity scoring sit awkwardly against that criterion.
The third is that identifiability is now relative. In EDPS v Single Resolution Board (C-413/23 P), decided on 4 September 2025, the Court of Justice held that the question must be answered from the recipient's perspective. The same file can be personal data for the sender and anonymous for the party receiving it. That is convenient for data collaboration and hard to operationalise, since it makes the status of a dataset depend on who is holding it.
Terms it is confused with
Anonymisation is the endpoint, not the process. European practice reserves it for data that has irreversibly ceased to be personal. De-identification names the technique; anonymisation names the successful outcome.
Pseudonymisation replaces identifiers with tokens while the key that reverses the substitution is kept separately. EDPB Guidelines 01/2025, adopted on 16 January 2025, confirm that pseudonymised data remains personal data under Article 4(5) even when the additional information sits with a different entity. Hashed emails and UID-style tokens are pseudonymisation, not anonymisation.
Aggregate consumer information is a separate California category covering data about a group from which individual identities have been removed. The statute is explicit that it does not mean one or more individual records that have been deidentified.
Spelling itself diverges. HIPAA and NIST hyphenate de-identification; the California statute writes deidentified as one word, and the drafting difference tracks two genuinely different legal tests.
Recent developments
The EDPB adopted its anonymisation guidelines on 7 July 2026 and opened a consultation the following day that runs to 30 October 2026. They arrive mid-argument. The European Commission's Digital Omnibus package, presented on 19 November 2025, would write a relativity approach into Article 4 of the GDPR. The EDPB and the European Data Protection Supervisor objected in a joint opinion adopted on 10 February 2026, arguing the drafting goes further than codifying the court. Germany had asked for clarity a month before the package landed, stating that it remains unclear what anonymisation and pseudonymisation requirements the GDPR actually imposes.
In the United States the direction is different. The SECURE Data Act introduced by House Republicans in April 2026 would replace state privacy statutes with a single federal framework, carving measurement and reach reporting out of the definition of targeted advertising. Whether de-identified advertising data ends up governed by one standard or fifty is, as of September 2026, unresolved.
Timeline
- 2000: Latanya Sweeney publishes Simple Demographics Often Identify People Uniquely, reporting 87% uniqueness from ZIP code, sex and date of birth
- 2003: The HIPAA Privacy Rule takes effect, carrying the safe harbour and expert determination standards at 45 CFR 164.514
- 2006: AOL releases search logs with numeric user identifiers, and individual users are identified from query content
- 2006: Philippe Golle publishes a revision of the Sweeney figure at 63% using 2000 census data
- 10 April 2014: Article 29 Working Party adopts Opinion 05/2014, establishing singling out, linkability and inference as the anonymisation test
- 25 May 2018: The GDPR becomes applicable, placing anonymised data outside its scope
- November 2020: California voters approve Proposition 24, rewriting the statutory definition of deidentified information
- 14 September 2023: NIST publishes Special Publication 800-188 in final form
- 24 July 2024: The Federal Trade Commission restates that hashed data is not anonymous
- 13 November 2024: The commission warns that data clean rooms are not privacy-preserving by default
- 16 January 2025: The EDPB adopts Guidelines 01/2025 on pseudonymisation
- 4 September 2025: The Court of Justice rules in EDPS v Single Resolution Board that identifiability is assessed from the recipient's perspective
- 23 October 2025: Germany submits proposals seeking legislative clarity on anonymisation and pseudonymisation
- 19 November 2025: The European Commission presents the Digital Omnibus package
- 10 February 2026: The EDPB and EDPS adopt a joint opinion opposing the proposed personal data amendment
- 7 July 2026: The EDPB adopts Guidelines 02/2026 on Anonymisation
- 8 July 2026: Public consultation opens, running to 30 October 2026
Related PPC Land coverage
- EDPB replaces 2014 anonymity test with 3-part framework for ad data - The three criteria in Guidelines 02/2026 and what No Inference means for lookalike modelling.
- European data regulators release updated pseudonymisation guidelines for 2025 - Why pseudonymised data stays personal even when the reversal key sits elsewhere.
- Court clarifies personal data definition in pseudonymized transfers - The September 2025 judgment establishing the recipient perspective.
- European court ruling on pseudonymized data disclosure set for September 4 - The Advocate General's reasoning ahead of the ruling.
- European Commission proposes major GDPR changes for AI and data processing - The relativity approach proposed for Article 4(1).
- Europe's privacy watchdogs reject Commission's plan to narrow GDPR protections - The joint opinion against narrowing the personal data concept.
- Germany pushes for sweeping data protection simplification beyond EU proposal - The October 2025 submission on unclear anonymisation requirements.
- France's top court upholds Criteo's €40M GDPR fine - The contested reasoning on whether singling out equals identifying.
- FTC Warns: Hashed data not anonymous, companies risk deceptive practice claims - The July 2024 position and the enforcement actions behind it.
- FTC warns Data Clean Rooms not a privacy silver bullet despite growing industry use - Why the commission treats clean room disclosure as comparable to pixel disclosure.
- FTC sends $15.3 million in refunds to Avast antivirus customers - Browsing data the agency argued stayed re-identifiable after processing.
- Explaining clean room - The governed environment where de-identified and pseudonymised files are joined.
- New privacy tech could reshape digital marketing data use - The OECD taxonomy covering anonymisation, synthetic data and differential privacy.
- IAB Tech Lab sets September 4 deadline for comment on clean room data rules - Encryption and field mapping requirements for hashed conversion uploads.
- House Republicans unveil SECURE Data Act to replace US state privacy laws - The federal preemption proposal and its measurement carve-out.
- Healthline settles largest CCPA violation case for $1.55 million - Article titles shared with ad networks as an example of context defeating stripped identifiers.
- OpenAI's privacy policy now lets advertisers send purchase data - Aggregation and de-identification language inside a live advertising policy.
- Otter.ai faces class action lawsuit for unauthorized meeting recording - Re-identification risk in conversational data with distinctive speech patterns.
- EDPB 2025 annual report: €1.15bn in GDPR fines, new AI and DMA rules - The stakeholder work that preceded the anonymisation guidelines.
- Statistical credit-score inputs fall outside GDPR, Austrian court rules - A court separating individualised model output from abstract statistical inputs.
- French ad industry draws a line in the sand on EU cookie overhaul - Industry proposals to extend the Digital Omnibus implementing act to anonymisation.
Summary
Who. Data controllers and processors across advertising, retail media, health and government apply it. The Federal Trade Commission, the European Data Protection Board, national supervisory authorities and the Department of Health and Human Services police the claim.
What. A set of techniques, from suppression and generalisation through to differential privacy and synthetic data, applied to a dataset so that its records can no longer be attributed to identifiable people, and with them the legal obligations attached to personal data.
When. Codified in US health law from 2003, tested against European criteria set in 2014 and replaced by the EDPB's Guidelines 02/2026, adopted on 7 July 2026 and open for comment until 30 October 2026.
Where. At every point where a dataset changes hands: clean room ingestion, audience onboarding, measurement file transfer, model training and public data release.
Why. Successfully de-identified data sits outside the GDPR and outside the CCPA's definition of personal information, which removes the compliance cost of holding it. The commercial incentive to claim the status is exactly why regulators have spent two years testing the claim.
Discussion