Anonymization
By Gareth HoyleLast updated How we research
Anonymization is a process that removes the association between a dataset and the people it describes, so that no one can be identified from it.
Anonymization is a process that removes the association between an identifying dataset and the data subject, in the definition NIST takes from ISO/TS 25237. US statutes rarely use the word. HIPAA and the CCPA set de-identification standards instead.
When does the FTC treat data as anonymous?
The FTC treats data as anonymous only when it can never be associated back to a person. FTC staff said so in a July 2024 post warning that hashed identifiers are not anonymous and that companies should not claim hashing makes personal information anonymized. A persistent ID that tracks a person or device over time does not meet the test.
Is an AI model trained on personal data anonymous?
An AI model trained on personal data is not automatically anonymous. In the EU, the EDPB's Opinion 28/2024, adopted in December 2024, says such a model is anonymous only if the likelihood of extracting personal data from it, or obtaining it through queries, is insignificant.
If you hold UK data
Under UK GDPR, anonymous information falls outside the law when identifying anyone from it is not reasonably likely, the test set out in the ICO's anonymization guidance.
Read our guide to UK GDPR, EU GDPR and CCPA when selling data for AI training and de-identification for AI training data.