k-anonymity is a privacy model that hides each person inside a group of at least k people. A dataset meets it when every record shares its combination of indirectly identifying attributes with at least k-1 other records, so anyone linking the file to an outside source cannot narrow a match below k candidates. It exists because deleting names does not make data anonymous: birth dates, postcodes and browsing habits identify people in combination. Advertising borrows the logic to decide how many browsers must see an ad before it renders, how few users a clean room query may describe, and which search records a dominant engine may pass to rivals.

How the model works

The method starts by sorting columns. Direct identifiers such as names and email addresses are removed. Quasi-identifiers are harmless alone but identifying together, a concept the statistician Tore Dalenius described in 1986. Sensitive attributes, such as a diagnosis or a purchase, are what the release protects.

Rows sharing identical quasi-identifier values form an equivalence class, and a table is k-anonymous when its smallest class holds at least k rows. Two operations get it there. Generalisation coarsens values, turning a date of birth into a year or the ZIP code 02138 into 0213*. Suppression deletes rows or cells that still stand out. Latanya Sweeney's 2002 worked example sets k at 2 across eleven medical records.

Every coarsening step discards information, and Meyerson and Williams showed in 2004 that finding the optimal route to a given k is NP-hard. In practice, k is set by policy rather than proof. The IAB Tech Lab's PAIR protocol requires k-anonymity processing in clean rooms to stop crafted datasets isolating users by elimination; at k=5, each individual is indistinguishable from at least four others. Ads Data Hub drops result rows describing fewer than about 50 unique users, lowering the floor to 20 when noise injection is used and to 10 for queries touching only clicks and conversions, according to Google's developer documentation. AWS Clean Rooms lets data providers choose any minimum between 2 and 100,000 distinct identities per output row, according to Amazon Web Services.

From hospital files to browser auctions

The problem was demonstrated before it was named. Massachusetts' Group Insurance Commission released records on roughly 135,000 state employees and their families, believing them anonymous. Sweeney bought the Cambridge voter roll for $20 and linked the files on ZIP code, birth date and sex. Governor William Weld's records were in the release; according to her 2002 account, six Cambridge voters shared his birth date, three were men, and only he lived in his five-digit ZIP code. Her analysis of 1990 census data found that 87% of the US population, 216 million of 248 million people, was likely unique on those three fields alone.

Pierangela Samarati and Sweeney formalised the response in 1998, and Sweeney credits Samarati with the name. Sweeney's 2002 paper gave the formal definition along with three attacks that defeat a compliant release: matching on row order, linking complementary releases, and comparing releases over time.

Refinements followed. l-diversity, presented in 2006, required variety among sensitive values inside each class; t-closeness, in 2007, kept each class's distribution of sensitive values within a distance t of the whole table's. On April 10, 2014, Europe's Article 29 Working Party adopted Opinion 05/2014, grouping all three as generalisation techniques and cataloguing where each fails.

Advertising took up the idea when Google planned to remove third-party cookies from Chrome, starting with Federated Learning of Cohorts (FLoC), which placed browsers in interest cohorts of a minimum size. Its 2021 origin trial used k=2000 and produced 33,872 cohorts, about 2.3% blocked as sensitive, according to MIT researchers Alex Berke and Dan Calacci. Google reported at least 95% of the conversions per dollar of cookie-based advertising, then abandoned FLoC for the Topics API in early 2022.

Michael Kleber of Google published TURTLEDOVE in January 2020, moving remarketing auctions into the browser. Its successor FLEDGE, published on January 22, 2021, promised to render an ad only if its URL was being shown to enough people, giving 100 as an example. FLEDGE was renamed Protected Audience in August 2023.

Thresholds inside the ad stack

Before a creative could render, the combination of interest group owner URL, bidding script URL and creative URL had to be seen by k browsers over w days, refreshed every p hours. Google's ramp started in the fourth quarter of 2023 at k=10, w=30 and p=12 on pre-stable channels, was scheduled to reach up to 20% of Chrome Stable traffic in early 2024, and was to rise to k=50 with hourly updates only once third-party cookie deprecation began. Google later subjected view and click data to the check when interest group lifetimes reached 90 days.

Google operated the counting server. Browsers hashed each object and sent a Join request carrying an identifier capped at 16 bits, so no more than 65,536 values existed and users collided by design. Requests passed through a third-party Oblivious HTTP relay that saw IP addresses but not content, and each Join had to spend a Private State Token, issued at least initially to desktop users signed in with a Google Account. A Query endpoint returned one bit per object, with truncated Laplace noise added to count and threshold at a proposed epsilon of 3. If a preferred creative fell short, bidding reran with only passing ads, so a generic fallback could serve. Microsoft's Ad Selection API for Edge carried a comparable creative-level rule.

Elsewhere the idea appears as aggregation floors. Google Ads requires 100 active users within 30 days before a segment serves. Amazon Marketing Cloud returns only aggregated, anonymous outputs, whose thresholds typically require more than 100 unique users, according to agency Tinuiti. Apple's SKAdNetwork 4.0 assigns each install a crowd anonymity tier from 0 to 3, and a bonus tier described in June 2025 governs country codes in AdAttributionKit postbacks.

Why marketers encounter it

Thresholds decide what exists in a report. Small segments, narrow geographies and niche categories vanish from clean room output without an error message.

Anonymised data falls outside the General Data Protection Regulation (GDPR), so platforms have an incentive to present thresholds as proof of anonymisation. The IAB Tech Lab's ID-Less Solutions Guidance, released on July 17, 2025, lists k-anonymity beside differential privacy among techniques for targeting and measuring without user identifiers.

Where it fails

The model protects identity, not attributes. If all k members of a class share a diagnosis, placing someone in the class reveals it. Composition is worse. Berke and Calacci reported in November 2022 that each weekly FLoC cohort was k-anonymous but the sequence was not: more than 50% of devices in their sample carried a unique cohort sequence after three weeks, and more than 95% after four.

k also counts accounts rather than people. A public issue in the Protected Audience repository argued that an attacker controlling more than k accounts could strip protection from targeted users. Google's explainer conceded that signed-out users would not count towards thresholds, which could bias the system against interest groups popular with them. A 2024 academic evaluation described attacks in which code executed during Protected Audience auctions passed identifiers through covert channels despite the checks. Federal Trade Commission (FTC) staff wrote on November 13, 2024, that most clean room services are not privacy-preserving by default.

Not the same as

Differential privacy adds calibrated noise so an output barely changes whether or not one person's data is included. It describes the release mechanism rather than the table and degrades predictably under repeated queries; the IAB Tech Lab set out its advertising applications in May 2024.

Pseudonymisation and hashing swap identifiers for tokens but leave each record tied to one person, which is why the FTC restated in July 2024 that hashed data is not anonymous.

Aggregation thresholds set a minimum user count per result row without generalising underlying attributes, so overlapping queries can still isolate individuals unless difference checks or noise are added.

Crowd anonymity, Apple's term, releases progressively more detail as the crowd grows rather than suppressing everything below a single k.

Recent developments

Google retired Protected Audience, Topics and most other Privacy Sandbox APIs on October 17, 2025, citing low adoption. The repository holding the k-anonymity server design was archived on November 7, 2025.

The European Data Protection Board adopted Guidelines 02/2026 on Anonymisation on July 7, 2026, replacing the 2014 opinion with three criteria: No Record Isolation, No Linkage and No Inference. k-anonymity speaks mainly to the first. In the United States, the search remedies Google appealed in January 2026 list k-anonymity protocols among safeguards for data shared with rivals.

A regulatory specification built on the model was described in detail today. Article 6(11) of the Digital Markets Act requires Google to share anonymised search data with rivals. Damien Desfontaines, a privacy engineer paid by the European Commission to advise on the case, published an account of the method. Records containing a word or entity searched by fewer than 50 distinct users in a year are deleted, and each remaining record must share its region, device category and inferred language with at least 1,000 signed-in users, falling back to country level or deletion. He identifies that step as k-anonymity. The April 2026 preliminary measures had used smaller S2 map cells; according to Desfontaines, larger regions and a higher threshold followed Google's adversarial testing, which the company said re-identified users in under two hours, a claim he says ignored contractual safeguards. He puts 95% of users in groups of 25,000 or more; rivals could receive data in early 2027.

Timeline

  • 1986: Tore Dalenius describes the quasi-identifier problem in census records
  • 1997: Latanya Sweeney links Massachusetts Group Insurance Commission records to the Cambridge voter list, re-identifying Governor William Weld
  • 1998: Pierangela Samarati and Latanya Sweeney formalise k-anonymity, with generalisation and suppression as enforcement methods
  • 2002: Sweeney publishes the formal k-anonymity model and three attacks against it
  • 2004: Meyerson and Williams show optimal k-anonymisation is NP-hard
  • 2006: l-diversity is introduced to address homogeneity within equivalence classes
  • 2007: t-closeness is introduced to bound the distribution of sensitive values
  • April 10, 2014: The Article 29 Working Party adopts Opinion 05/2014 on Anonymisation Techniques
  • January 2020: Michael Kleber publishes the TURTLEDOVE proposal
  • January 22, 2021: The FLEDGE explainer introduces a browser-enforced audience threshold for rendered ads
  • 2021: The FLoC origin trial runs in Chrome 89 to 91 with k=2000 and 33,872 cohorts
  • Early 2022: Google replaces FLoC with the Topics API
  • October 2022: SKAdNetwork 4.0 introduces crowd anonymity tiers with iOS 16.1
  • November 2022: Berke and Calacci report that more than 95% of FLoC cohort sequences in their sample were unique after four weeks
  • August 2023: FLEDGE is renamed Protected Audience
  • Fourth quarter of 2023: Chrome begins k-anonymity checks at k=10 on pre-stable channels
  • First quarter of 2024: The checks extend to up to 20% of Chrome Stable traffic
  • September 2024: Google extends interest group lifetimes to 90 days and applies k-anonymity requirements to view and click data
  • November 13, 2024: FTC staff warn that data clean rooms are not privacy-preserving by default
  • June 2025: Apple describes a bonus crowd anonymity tier for country codes in AdAttributionKit
  • July 17, 2025: The IAB Tech Lab releases ID-Less Solutions Guidance version 1.0
  • October 17, 2025: Google retires Protected Audience, Topics and most other Privacy Sandbox technologies
  • November 7, 2025: The WICG repository containing the k-anonymity server design is archived
  • April 2026: The European Commission publishes preliminary measures for Google search data sharing using S2 cells
  • July 7, 2026: The European Data Protection Board adopts Guidelines 02/2026 on Anonymisation
  • July 16, 2026: The European Commission adopts binding decisions on Google search data sharing
  • September 10, 2026: Damien Desfontaines publishes an account of the 1,000-user threshold in the specified method

Summary

Who. Latanya Sweeney and Pierangela Samarati defined the model. Google built it into FLoC and Protected Audience, Microsoft into its Edge proposals, and Ads Data Hub, Amazon Marketing Cloud and AWS Clean Rooms apply it as aggregation floors. Apple uses a tiered variant in SKAdNetwork. Regulators including the European Data Protection Board and the European Commission assess or specify its use.

What. k-anonymity is a privacy property requiring every record, audience or creative to be indistinguishable within a group of at least k people on the attributes an observer could link. It is achieved by generalising and suppressing data, or by withholding output until a count reaches k.

When. Formalised in 1998 and published as a full model in 2002, it reached advertising through FLoC in 2020 and 2021 and Protected Audience enforcement from late 2023. Google retired those browser APIs on October 17, 2025, while the European search data method described today applies a 1,000-user threshold, with data potentially flowing from early 2027.

Where. In released datasets, browser-side ad auctions, clean room query outputs, audience list minimums, mobile attribution postbacks and regulated data sharing between search engines.

Why. Removing names does not stop re-identification when attributes combine. k-anonymity gives a testable floor against linking, but it does not protect sensitive attributes, fails under repeated releases and counts accounts rather than people, which is why regulators now treat it as one input to an anonymisation assessment rather than proof on its own.