Pseudonymisation is the processing of personal data so that it can no longer be tied to a specific person without additional information, which has to be kept separately and protected by technical and organisational measures. That definition sits in Article 4(5) of the General Data Protection Regulation (GDPR). In practice, names, email addresses and customer numbers are replaced with substitute values, and the means of reversal is locked away from the people who work with the result. It exists because much of marketing, from frequency capping to audience matching, needs to recognise the same person twice without knowing who that person is.

One consequence is frequently misread: pseudonymised data remains personal data under European law. It lowers risk without switching the regulation off.

How the transformation works

The European Data Protection Board (EDPB), the body of national regulators that issues GDPR guidance, breaks the process into three actions in its Guidelines 01/2025. Data is transformed, the material that permits reversal is held apart from those who should not attribute it, and controls stop attribution happening anyway. That reversal material is called additional information; the secret parameters inside the transformation are pseudonymisation secrets.

Two families of transformation dominate, according to the EDPB text. The first is cryptographic: a keyed one-way function such as a hash-based message authentication code (HMAC), or encryption where authorised reversal must be easy. The board prefers one-way functions and wants secrets with enough entropy to resist brute force. The second is the lookup table, mapping each identifier to a randomly generated pseudonym. Tables avoid cryptanalytic risk but are themselves personal data, holding at least one row per person.

An unkeyed SHA-256 hash of a lowercased email address always produces the same 64-character hexadecimal string, so anyone holding a list of addresses can hash it and compare. The guidelines make that point with names as the example. A secret key held by one party defeats the dictionary attack for everyone else.

Scope varies too. Person pseudonyms stay consistent across everything a controller holds; relationship pseudonyms are scoped to one relationship, such as customer or employee; transaction pseudonyms change with every interaction. The board asks controllers to prefer the last where the purpose allows. Advertising identifiers sit at the person end, since frequency capping, attribution and retargeting depend on recognising one browser or device over weeks.

The 2025 text also introduced the pseudonymisation domain: the people, systems and recipients from whom attribution is to be withheld. Effectiveness is judged against what actors inside it could reasonably obtain, public social media posts included.

Where it sits in advertising data flows

Cookie identifiers and mobile advertising IDs are pseudonyms assigned by the systems that read them. Customer lists are normalised and hashed before upload: clean room operators treat SHA-256 hashing of emails and phone numbers, after stripping whitespace and lowercasing, as the baseline before any join. Identity providers then convert those hashes into tokens of their own. Unified ID 2.0 (UID2) is built from hashed and salted emails with rotating salts, while LiveRamp's RampID is a pseudonymised online representation derived from an offline identifier built from personally identifiable information.

Under the UID2 specification, a normalised email hashed with SHA-256 and Base64-encoded yields a 44-character string, while Google's Measurement Protocol expects hexadecimal at 64 characters, so two partners holding the same address can still fail to match.

Responsibility is split. Advertisers and agencies hash customer files before upload and choose the matching partner. Publishers pseudonymise login data before it enters bid requests through identity modules, and supply-side platforms carry the resulting values in OpenRTB fields such as user.id and user.eids. Downstream recipients see a pseudonym, not a name.

From German statute to GDPR definition

The idea predates European law. Germany's Federal Data Protection Act (BDSG) introduced "Pseudonymisieren" as a defined term in 2001, meaning the replacement of a name and other identifying features with a code so that identification is excluded or made substantially harder, according to a German legal commentary. The Telemedia Act (TMG), in force from 2007, applied it to advertising. Its Section 15(3) allowed providers to build usage profiles under pseudonyms for advertising and market research unless the user objected, and barred merging those profiles with data about the person behind the pseudonym.

That opt-out did not last. German supervisors said in an April 2019 guide that it had to be read against the ePrivacy Directive, and the courts required prior consent for advertising cookies regardless, according to law firm RESMEDIA. The provision disappeared when the Telecommunications and Telemedia Data Protection Act (TTDSG) took effect on December 1, 2021.

At EU level the term arrived with the GDPR, adopted on April 27, 2016 and applied from May 25, 2018. According to the EDPB, the regulation defined pseudonymisation for the first time in EU law. It names the technique as a safeguard in Article 6(4)(e) on compatible further processing, Article 25(1) on data protection by design, Article 32(1)(a) on security and Article 89(1) on research. Recital 26 settles status: pseudonymised data that could be attributed using additional information concerns an identifiable person.

The EU cybersecurity agency ENISA published Pseudonymisation techniques and best practices in November 2019, concluding that no single technique suits every scenario. California copied the GDPR wording into the California Consumer Privacy Act at Section 1798.140(aa) with little independent legal effect.

Why it matters for marketers

Pseudonymisation lets data travel. The EDPB says the risk reduction may support reliance on legitimate interests under Article 6(1)(f), help establish that further processing is compatible under Article 6(4), and act as a supplementary safeguard for transfers outside the European Economic Area. In France, a guide on prospecting treats enrichment as compliant only when run on pseudonymised data such as email hashes, under contract, with logging.

It does not exempt data from consent, transparency or data subject rights, and pseudonymisation reduces linkability without reducing volume. The Federal Trade Commission restated in July 2024 that hashing does not make data anonymous, because a hashed email still creates a unique signature that can follow someone over time. Hashed emails and UID-style tokens are pseudonymisation, not anonymisation.

Where it fails and who disputes it

The central dispute is whose perspective counts. The EDPB's guidelines state that pseudonymised data remains personal even when the additional information sits with a different entity. Industry objected during the consultation, which the EDPB's page lists as closing on March 14, 2025, although several published accounts gave February 28. Google's submission called it unfortunate that the text preceded the Advocate General's opinion in EDPS v Single Resolution Board, which the company said directly contradicted the board. The Federation of European Direct and Interactive Marketing (FEDMA) asked the board to hold the final version until the court ruled.

The Advocate General had argued that effective pseudonymisation can create genuine barriers for recipients. On September 4, 2025, the Court of Justice agreed that pseudonymised data is not personal data in all cases and for every person: comments passed to Deloitte were not personal for Deloitte, which lacked reasonable means of re-identification.

Advertising has struggled to use that reasoning. France's Conseil d'Etat rejected Criteo's argument that its identifiers were pseudonyms rather than personal data, pointing to the IP addresses, location data, device identifiers, partner IDs and browsing and purchase histories attached to them. Persistent person-level identifiers joined to rich behavioural records are close to the opposite of the transaction pseudonyms regulators prefer. The Court of Justice had already found in March 2024 that TC Strings, the consent signals encoded under IAB Europe's framework, constitute personal data.

A February 2024 Cracked Labs report commissioned by Open Rights Group described LiveRamp's system as population-scale identity surveillance; LiveRamp points to contractual and technical guardrails. Law firm Hunton Andrews Kurth wrote that the EDPB guidance offers no clear test of effective pseudonymisation, and questioned how any controller could guarantee data never leaves its domain.

Not the same as

Anonymisation removes identifiability altogether, taking data outside the GDPR. The EDPB's draft Guidelines 02/2026test it against No Record Isolation, No Linkage and No Inference. Deleting the key does not make pseudonymised data anonymous, and each record stays tied to one person where k-anonymity would generalise it into a crowd.

Hashing is a technique, not a legal status; an unkeyed hash of a guessable input offers little.

Encryption is reversible by anyone holding the key. It can serve as a pseudonymising transformation, but meets Article 4(5) only when the separation conditions are also met.

Unlinkability is a privacy engineering property describing whether two actions can be tied to the same person. Its reference terminology comes from Andreas Pfitzmann and Marit Hansen; rotating pseudonyms preserve it, persistent ones destroy it.

Recent developments

The Commission's Digital Omnibus, presented on November 19, 2025, would amend Article 4(1) so information is not personal for an entity that cannot identify the person with means reasonably likely to be used. The EDPB and the European Data Protection Supervisor (EDPS) rejected that amendment on February 10, 2026, arguing it went far beyond codifying case law. French trade body Alliance Digitale welcomed the pseudonymisation pillar. A leaked Council compromise text dated February 20, 2026 dropped the definition change, according to the International Association of Privacy Professionals. As of September 2026, the file remained in negotiation.

South Korea revised its rules on pseudonymous data for AI in March 2026. The EDPB adopted draft anonymisation guidelines on July 7, 2026, with consultation open to October 30, 2026; no final pseudonymisation text had appeared. And a study on anonymising language model prompts favoured reversible techniques that keep exactly the mapping table which, in the EDPB's reading, leaves data personal.

Timeline

  • 2001: Germany's Federal Data Protection Act defines "Pseudonymisieren" at Section 3(6a)
  • March 1, 2007: Germany's Telemedia Act takes effect, with Section 15(3) permitting pseudonymous usage profiles for advertising unless the user objects
  • August 10, 2010: Andreas Pfitzmann and Marit Hansen release version 0.34 of their anonymity and pseudonymity terminology
  • April 27, 2016: The GDPR is adopted, defining pseudonymisation at Article 4(5)
  • May 25, 2018: The GDPR applies across the EU
  • April 5, 2019: German supervisory authorities publish orientation guidance on the Telemedia Act and cookies
  • November 2019: ENISA publishes Pseudonymisation techniques and best practices
  • December 1, 2021: The TTDSG takes effect, ending Section 15(3) of the Telemedia Act
  • April 26, 2023: The General Court annuls an EDPS decision against the Single Resolution Board over pseudonymised data sent to Deloitte
  • June 2023: France's CNIL fines Criteo 40 million euros
  • March 7, 2024: The Court of Justice rules that TC Strings constitute personal data
  • July 24, 2024: The Federal Trade Commission restates that hashed data is not anonymous
  • January 16, 2025: The EDPB adopts Guidelines 01/2025 on pseudonymisation for consultation
  • February 6, 2025: The Advocate General delivers an opinion supporting a recipient-centred assessment in the SRB case
  • September 4, 2025: The Court of Justice rules in EDPS v Single Resolution Board
  • November 19, 2025: The European Commission presents the Digital Omnibus
  • February 10, 2026: The EDPB and EDPS adopt a joint opinion opposing the personal data amendment
  • February 20, 2026: A Council compromise text drops the proposed personal data definition change
  • March 4, 2026: France's Conseil d'Etat upholds the Criteo fine
  • March 2026: South Korea revises its guidelines on pseudonymous data for AI
  • July 7, 2026: The EDPB adopts draft Guidelines 02/2026 on anonymisation
  • October 30, 2026: Consultation on the anonymisation guidelines closes

Summary

Who: Controllers and processors handling personal data, including advertisers, agencies, publishers, identity providers and clean room operators, under supervision by national data protection authorities, the EDPB and the Court of Justice.

What: A technique and a legal category under Article 4(5) GDPR that replaces identifiers with pseudonyms, keeps the reversal material separate and protected, and reduces risk without removing the data from the regulation.

When: Defined in German law in 2001, in EU law by the GDPR in 2016, elaborated by EDPB guidance in January 2025, reinterpreted by the Court of Justice in September 2025 and under legislative review through the Digital Omnibus since November 2025.

Where: Across the European Economic Area as the core jurisdiction, with borrowed definitions in California and distinct pseudonymous data rules in South Korea, and in every advertising flow that hashes, tokenises or matches identifiers.

Why: It lets marketers measure, match and share data about individuals while lowering exposure if the data leaks or is misused, and the unresolved question of whether pseudonymised data is personal for every recipient decides how much regulation follows it.