De-identification is the process of altering a dataset so that the records in it can no longer be tied to the people they describe. The point of doing it is legal rather than technical. Data that identifies a person is regulated; data that does not is largely unregulated. A retailer's purchase log, a publisher's exposure file or a measurement vendor's conversion table becomes far cheaper to store, share and sell the moment it stops counting as personal information.

That makes de-identification a boundary condition rather than a feature. Three separate regimes draw the boundary in three different places, using three different words for roughly the same idea, and an advertising dataset can sit on opposite sides of the line depending on which one applies.

How a dataset is stripped

Practitioners split the fields in a record into two groups. Direct identifiers name a person outright: a full name, an email address, a phone number, a social security number, a device advertising ID. Quasi-identifiers do not name anyone individually but narrow the field when combined: postcode, date of birth, sex, job title, the model of a handset.

Removing the first group is trivial and insufficient. The work is in the second. Four techniques do most of it. Suppression deletes a field outright. Generalisation coarsens it, replacing a birth date with a birth year or a postcode with a region. Perturbation adds statistical noise, of which differential privacy is the formal version, offering a mathematically bounded guarantee rather than a judgement call. Synthetic generation replaces the file with an artificial one that preserves the aggregate distributions and contains no real records at all.

US health law supplies the most prescriptive worked example. Under 45 CFR 164.514, the section of the HIPAA Privacy Rule that governs the practice and was last amended in April 2024, a covered entity has two routes. Safe harbour requires the removal of 18 enumerated categories, from names and email addresses through to biometric identifiers, full-face photographs and any other unique identifying code. The rule is specific about the edges. Geography must be cut back above postcode level, except that the first three digits of a ZIP code may stay if the area they cover holds more than 20,000 people, and must otherwise be zeroed out. Every date element finer than a year has to go, and any age above 89 collapses into a single category of 90 or older.

Safe harbour is a checklist, and passing it is not enough on its own. The rule adds a second condition: the entity must have no actual knowledge that what remains could identify someone. A rural clinic holding the only local case of a rare condition fails that test with all 18 categories stripped.

The alternative route, expert determination, hands the question to a person with recognised statistical expertise who documents that the risk of re-identification is very small. It preserves far more analytical value and costs far more to run. NIST codified the general methodology for federal agencies in Special Publication 800-188, published in final form on 14 September 2023, which pairs traditional de-identification with formal methods and cautions readers about the limits of the former.

Where the term came from

The concept predates the advertising industry's interest in it. Latanya Sweeney, then at Carnegie Mellon, published a working paper in 2000 reporting that 87% of the US population, 216 million people out of 248 million in the 1990 census, held a unique combination of five-digit ZIP code, sex and full date of birth. The finding shaped the HIPAA standard directly.

It has also been disputed. Philippe Golle, then at the Palo Alto Research Center, re-ran the analysis against 2000 census data and reported 63%, with 61% for 1990, and wrote that he could not explain the discrepancy for lack of detail about the earlier study's methodology. Both numbers remain in circulation. Neither materially changes the conclusion that three ordinary demographic fields identify most people.

Practice caught up in 2006, when AOL published a set of search logs with user names replaced by numbers and journalists identified individual users from the queries alone. Europe formalised its own test on 10 April 2014, when the Article 29 Working Party adopted Opinion 05/2014 and set out three criteria: singling out, linkability and inference. That framework governed European practice for twelve years.

Why the boundary carries money

Anonymised data falls outside the General Data Protection Regulation entirely. There is no lawful basis to establish, no retention clock, no access or deletion right. The same asymmetry runs through US state law, where the California Consumer Privacy Act excludes deidentified and aggregate consumer information from the definition of personal information altogether. For identity graphs, clean rooms and cross-context measurement systems, qualifying is worth the whole compliance overhead.

California attaches conditions rather than a technical standard. The statutory definition at Civil Code section 1798.140(m), rewritten by Proposition 24 in November 2020, requires that the information cannot reasonably be used to infer anything about a particular consumer, and adds three obligations on the business holding it: reasonable measures to stop the data being associated with a consumer or household, a public commitment not to attempt re-identification, and contractual terms binding every recipient to the same conditions. Testing the effectiveness of the process is the only permitted exception. The consequence is that de-identification in California is a governance posture as much as a data transformation, and one that travels down the supply chain by contract.

The regulator's answer has been that the label is not self-certifying. On 24 July 2024 the Federal Trade Commission restated that hashing does not produce anonymous data, noting that a hashed email remains a persistent unique identifier and that claiming otherwise can be deceptive. It followed on 13 November 2024 with a staff post warning that clean rooms are not privacy-preserving by default. In December 2025 the commission distributed $15.3 million to 103,152 Avast customers over browsing data the agency argued remained re-identifiable despite processing intended to obscure it.

The failure mode is expensive because it is retroactive. If a dataset treated as anonymous is later found to contain identifiable people, the controller is accountable for having processed personal data without a lawful basis for the entire period the mistake ran.

Where it breaks

Three problems recur.

The first is that re-identification risk rises over time as auxiliary datasets accumulate and techniques improve. A file that passed in 2019 has not necessarily passed since.

The second is inference. The European Data Protection Board's Guidelines 02/2026 on Anonymisation replaced the 2014 test with three criteria of their own: No Record Isolation, No Linkage and No Inference. That last criterion is the newly explicit one, and it captures cases where a party can draw a specific and meaningful conclusion about someone without isolating a record or matching it externally. Membership inference against a machine learning model, establishing only that a given person's data sat in the training set, can breach it. Given how much of targeted advertising rests on inferred rather than declared attributes, lookalike modelling and propensity scoring sit awkwardly against that criterion.

The third is that identifiability is now relative. In EDPS v Single Resolution Board (C-413/23 P), decided on 4 September 2025, the Court of Justice held that the question must be answered from the recipient's perspective. The same file can be personal data for the sender and anonymous for the party receiving it. That is convenient for data collaboration and hard to operationalise, since it makes the status of a dataset depend on who is holding it.

Terms it is confused with

Anonymisation is the endpoint, not the process. European practice reserves it for data that has irreversibly ceased to be personal. De-identification names the technique; anonymisation names the successful outcome.

Pseudonymisation replaces identifiers with tokens while the key that reverses the substitution is kept separately. EDPB Guidelines 01/2025, adopted on 16 January 2025, confirm that pseudonymised data remains personal data under Article 4(5) even when the additional information sits with a different entity. Hashed emails and UID-style tokens are pseudonymisation, not anonymisation.

Aggregate consumer information is a separate California category covering data about a group from which individual identities have been removed. The statute is explicit that it does not mean one or more individual records that have been deidentified.

Spelling itself diverges. HIPAA and NIST hyphenate de-identification; the California statute writes deidentified as one word, and the drafting difference tracks two genuinely different legal tests.

Recent developments

The EDPB adopted its anonymisation guidelines on 7 July 2026 and opened a consultation the following day that runs to 30 October 2026. They arrive mid-argument. The European Commission's Digital Omnibus package, presented on 19 November 2025, would write a relativity approach into Article 4 of the GDPR. The EDPB and the European Data Protection Supervisor objected in a joint opinion adopted on 10 February 2026, arguing the drafting goes further than codifying the court. Germany had asked for clarity a month before the package landed, stating that it remains unclear what anonymisation and pseudonymisation requirements the GDPR actually imposes.

In the United States the direction is different. The SECURE Data Act introduced by House Republicans in April 2026 would replace state privacy statutes with a single federal framework, carving measurement and reach reporting out of the definition of targeted advertising. Whether de-identified advertising data ends up governed by one standard or fifty is, as of September 2026, unresolved.

Timeline

  • 2000: Latanya Sweeney publishes Simple Demographics Often Identify People Uniquely, reporting 87% uniqueness from ZIP code, sex and date of birth
  • 2003: The HIPAA Privacy Rule takes effect, carrying the safe harbour and expert determination standards at 45 CFR 164.514
  • 2006: AOL releases search logs with numeric user identifiers, and individual users are identified from query content
  • 2006: Philippe Golle publishes a revision of the Sweeney figure at 63% using 2000 census data
  • 10 April 2014: Article 29 Working Party adopts Opinion 05/2014, establishing singling out, linkability and inference as the anonymisation test
  • 25 May 2018: The GDPR becomes applicable, placing anonymised data outside its scope
  • November 2020: California voters approve Proposition 24, rewriting the statutory definition of deidentified information
  • 14 September 2023: NIST publishes Special Publication 800-188 in final form
  • 24 July 2024: The Federal Trade Commission restates that hashed data is not anonymous
  • 13 November 2024: The commission warns that data clean rooms are not privacy-preserving by default
  • 16 January 2025: The EDPB adopts Guidelines 01/2025 on pseudonymisation
  • 4 September 2025: The Court of Justice rules in EDPS v Single Resolution Board that identifiability is assessed from the recipient's perspective
  • 23 October 2025: Germany submits proposals seeking legislative clarity on anonymisation and pseudonymisation
  • 19 November 2025: The European Commission presents the Digital Omnibus package
  • 10 February 2026: The EDPB and EDPS adopt a joint opinion opposing the proposed personal data amendment
  • 7 July 2026: The EDPB adopts Guidelines 02/2026 on Anonymisation
  • 8 July 2026: Public consultation opens, running to 30 October 2026

Summary

Who. Data controllers and processors across advertising, retail media, health and government apply it. The Federal Trade Commission, the European Data Protection Board, national supervisory authorities and the Department of Health and Human Services police the claim.

What. A set of techniques, from suppression and generalisation through to differential privacy and synthetic data, applied to a dataset so that its records can no longer be attributed to identifiable people, and with them the legal obligations attached to personal data.

When. Codified in US health law from 2003, tested against European criteria set in 2014 and replaced by the EDPB's Guidelines 02/2026, adopted on 7 July 2026 and open for comment until 30 October 2026.

Where. At every point where a dataset changes hands: clean room ingestion, audience onboarding, measurement file transfer, model training and public data release.

Why. Successfully de-identified data sits outside the GDPR and outside the CCPA's definition of personal information, which removes the compliance cost of holding it. The commercial incentive to claim the status is exactly why regulators have spent two years testing the claim.