# De-identification for AI training data

URL: https://sellmydatatoai.net/guides/de-identification-for-ai-training-data
Reviewed: 2026-11-08

De-identification for AI training data means removing or transforming everything in your records that identifies a person, directly or indirectly, before a buyer sees them. Removing names is not enough. HIPAA's Safe Harbor method strips 18 types of identifier, and the CCPA adds a public commitment not to re-identify. You need exclusions, a documented method, a random review sample and a re-identification test.

## Key takeaways

- Removing names is not de-identification. HIPAA's Safe Harbor method removes 18 types of identifier, including most date elements and small ZIP code areas.
- Under the CCPA, data counts as deidentified only with reasonable technical measures, a public commitment not to re-identify and contracts binding every recipient.
- Replacement tokens leave data identifiable to whoever holds the key, so destroy the mapping table or keep it under separate control.
- Exclude HR, payroll, health and privileged material entirely rather than trying to redact it line by line.
- Prove the method with a written process, a random sample, a measured error rate and a re-identification test, all before transfer.

AI buyers want real working records: email threads, support tickets, call notes and code reviews. Those records are full of people. De-identification is the work that turns them into something you can license without handing over personal data, and it is often the step that decides whether a buyer signs.

This guide covers what US law means by de-identification, the techniques that work on the unstructured records AI buyers want, and how to prove to a buyer that your method worked. A separate section covers UK and EU rules. It describes what the law and regulators say. It is not legal advice for your records, so take independent advice before you rely on it.

## What does de-identification mean for AI training data?

De-identification for AI training data means removing or transforming the information in your records that identifies a person before anyone outside your company sees them. The word covers a range of outcomes, and the legal result depends on which standard your data has to meet.

US law sets those standards statute by statute. California Civil Code section 1798.140(m) treats information as deidentified when it cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer, and the business holding it takes reasonable measures, publicly commits not to re-identify it and contractually binds recipients to the same. For health data, 45 CFR 164.514 sets HIPAA's two methods.

| Term | What it means | Still regulated? |
| --- | --- | --- |
| Deidentified (CCPA) | Cannot reasonably be linked to a consumer, plus reasonable measures, a public commitment not to re-identify and binding contracts (Civil Code 1798.140(m)) | No, if every condition is met |
| De-identified health information (HIPAA) | Meets the Safe Harbor or Expert Determination method (45 CFR 164.514(b)) | Not protected health information under HIPAA |
| De-identified education records (FERPA) | All personally identifiable information removed after a reasonable determination (34 CFR 99.31(b)) | May be released without consent |
| Pseudonymized data | Identifiers replaced with tokens, with the key kept separately | Yes in most cases, for anyone who holds the key |
| Anonymized data (UK and EU) | No longer relates to an identifiable person (ICO) | No, if the anonymization is effective |

## Why is removing names not enough?

Removing names is not enough because people can be identified from combinations of ordinary facts. HIPAA's Safe Harbor method shows how far a recognized standard goes. According to the [US Department of Health and Human Services](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), it removes all date elements except the year, keeps the first three digits of a ZIP code only where that area holds more than 20,000 people, and groups everyone over 89 into a single category of 90 or older.

Research supports the caution. A 2019 study in Nature Communications by Luc Rocher, Julien Hendrickx and Yves-Alexandre de Montjoye estimated that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes.

Workplace records make the problem harder. An email that mentions a job title, an office and a date can point to one person with every name removed, and tools built for structured fields miss much of that context.

## Which legal tests apply to de-identified training data?

The legal test for de-identified training data depends on whose data it is and where they live. A US company's records usually fall under the CCPA or another state privacy law, a sector law if they hold health, financial or education data, and sometimes UK or EU rules for overseas contacts.

- California: the CCPA treats a transfer of personal information for value as a sale unless the data is deidentified, which requires reasonable technical measures, a public commitment not to re-identify and contractual obligations on recipients, according to Frankfurt Kurnit Klein & Selz.
- Other states: Husch Blackwell counted 24 states with comprehensive privacy laws in June 2026. Each sets its own definition of de-identified data, so check the law in each state where the people in your records live.
- Health data: HIPAA allows Safe Harbor, which removes 18 types of identifier and requires no actual knowledge that the rest could identify someone, or Expert Determination, where a qualified expert concludes the risk of identification is "very small" and documents the method.
- Education records: FERPA allows release without consent once personally identifiable information is removed and the institution has made a reasonable determination that a student's identity is not personally identifiable, taking account of other reasonably available information.

HHS's guidance is a useful checklist of identifier types even for records that are not health data. Meeting it does not by itself satisfy the CCPA, which also requires the public commitment and the contracts with recipients.

## How do you de-identify company records for AI training?

You de-identify company records for AI training in a fixed order: decide what to leave out, find every identifier in what remains, transform it, then test the result. Skipping the first step is the quickest way to fail a buyer's review.

1. **Exclude the highest-risk material**: Daniel Goldberg of Frankfurt Kurnit Klein & Selz advises sellers to "exclude high-risk data entirely rather than relying on de-identification", naming privileged material, HR and personnel files, payroll and tax records, and health and benefits information. Removing a whole folder is cheaper and safer than redacting it line by line.
2. **List direct and indirect identifiers**: Direct identifiers include names, email addresses, phone numbers, account numbers and signatures. Indirect identifiers include job titles, office locations, rare events, dates, usernames, file paths and document metadata. List them per source system, because a Slack export and a scanned contract hide identifiers in different places.
3. **Choose a technique for each field**: Suppress what adds nothing, replace names with consistent placeholders where conversation structure matters, and generalize dates and places to the level a buyer needs, such as month and region.
4. **Run automated detection, then human review**: Open-source tools such as Microsoft Presidio detect and replace common identifier types in text. Automated detection misses context, so have people review a random sample from each source and record what they find.
5. **Separate or destroy the key**: If you replace names with tokens, the table that maps tokens back to people keeps the data identifiable for whoever holds it. Destroy it, or keep it under separate control and never share it with the buyer.
6. **Test re-identification**: Ask someone who did not do the redaction to try to identify people in a sample, using public sources such as LinkedIn profiles and your own website, and record what they find.
7. **Document the method and the results**: Record the tools, rules, reviewers, sample sizes and error rates. Buyers ask for this, and it is your evidence if anyone later questions the release.

## Which techniques suit which types of record?

Different types of record need different techniques because identifiers sit in different places. The table shows where they usually hide and the technique most sellers use.

| Record type | Where identifiers hide | Usual technique |
| --- | --- | --- |
| Email and chat | Names, signatures, quoted replies, attachments, mentions | Consistent name tokens, strip signatures and headers, review attachments separately |
| Support tickets | Customer names, order numbers, addresses, pasted screenshots | Replace identifiers with tokens, drop images or review them by hand |
| Source code | Commit author names and emails, credentials, test fixtures with real customer data | Rewrite commit metadata, scan for secrets, replace fixture data |
| Call recordings | Voices, names spoken aloud, card numbers read out | Transcribe and redact, drop audio where the voice identifies, cut payment segments |
| Video | Faces, license plates, screens, name badges | Blur or exclude |
| CRM and spreadsheets | Names, emails, rare combinations of fields | Suppress direct identifiers, generalize fields, check group sizes |

Voice and faces need extra care. Illinois' Biometric Information Privacy Act lists a voiceprint and a scan of face geometry among its biometric identifiers and bars private entities from selling, leasing, trading or otherwise profiting from them. If a buyer wants raw audio, treat it as personal data unless you can show otherwise. Our page on [call recording data](https://sellmydatatoai.net/buy-ai-training-data/call-recording-data) covers what buyers check.

## Does consistent pseudonymization keep the data useful?

Consistent pseudonymization keeps conversational data useful because a model can still follow who said what to whom. Replacing every mention of one colleague with the same token, such as PERSON_14, preserves the thread in a way that deleting names does not.

The trade-off is legal. Tokens you can reverse with a key you keep are unlikely to meet the CCPA's test that information cannot reasonably be linked to a consumer, and a buyer that could link tokens to public sources may still be handling personal information. [Pseudonymization](https://sellmydatatoai.net/glossary/pseudonymization) reduces risk, but it is not the same as de-identification.

Consistency also raises linkage risk. A token that appears in thousands of messages builds a profile of one person's work, opinions and movements. Review the most frequent tokens by hand before release, and generalize or remove the details that would let an outsider attach a name to them.

## How do you prove de-identification worked?

You prove de-identification worked with evidence a buyer can check: a written method, a random sample, a measured error rate and an independent test. A statement that the data "has been anonymized" carries little weight on its own.

Buyers are starting to offer outside review. In the Spirit Airlines bankruptcy sale, micro1 offered to cover de-identification and independent review costs and to give an independent reviewer a 1% sample of the de-identified data, Fortune reported in September 2026.

Our own seller vetting includes the same principle: direct and indirect identifiers are removed by a documented method, and a re-identification test is run on a sample. The full standard is on [how we vet](https://sellmydatatoai.net/how-we-vet). Record the method and its results in your [data manifest](https://sellmydatatoai.net/guides/how-to-build-a-data-manifest) so the buyer sees them before the sample.

## Can de-identified data become identifiable later?

De-identified data can become identifiable later, because new public data and better tools change what an attacker can do. FERPA's rule reflects this by requiring schools to consider single or multiple releases and other reasonably available information before releasing de-identified records.

Training adds its own risk. Nicholas Carlini and colleagues showed in 2021 that they could extract hundreds of verbatim sequences from GPT-2's training data, including names, phone numbers and email addresses, and found that "larger models are more vulnerable than smaller models". A 2023 paper by Milad Nasr and others described an attack that made ChatGPT emit training data at a rate 150 times higher than normal.

Goldberg puts the seller's position plainly: once data is used to train a model, "it cannot practically be pulled back out". De-identify before transfer, not after.

> **Rule of thumb** If removing the identifiers from a record type would leave nothing a buyer wants, exclude that record type. Redaction is for data that keeps its value without the people in it.

## What should the license say about de-identification?

The license should say who de-identified the data, by what method, and what the buyer may not do with it. The terms most often used are:

- A buyer promise not to attempt re-identification or to link the data with other sources to identify people, matching the commitment the CCPA standard requires
- A ban on onward transfer except to named parties bound by the same terms
- Deletion of raw copies by a fixed date
- A procedure if either side finds personal data that slipped through
- Who pays for a re-review if the buyer's own checks find identifiers

The [AI data licensing agreement checklist](https://sellmydatatoai.net/guides/ai-data-licensing-agreement-checklist) covers these clauses in more detail. For the wider legal position, read our guide to [CCPA, state privacy laws and GDPR when selling data](https://sellmydatatoai.net/guides/gdpr-and-selling-data-for-ai-training).

## If you hold UK or EU data

UK and EU law talk about anonymization rather than de-identification, and set a stricter test than the CCPA. If your records include people in the UK or EU, these points apply as well.

- Anonymization: the ICO describes [anonymization](https://sellmydatatoai.net/glossary/anonymization) as "the way in which you turn personal data into anonymous information", says "data protection law does not apply to anonymous information" and warns that "simply removing direct identifiers from a dataset is insufficient to ensure effective anonymization".
- Pseudonymization: under Article 4(5) of the UK GDPR, data that cannot be attributed to a person without separately kept additional information is pseudonymized, and the ICO says it stays personal data for anyone who holds that information.
- The UK test: Recital 26 asks whether identification is possible by means "reasonably likely to be used". The ICO's motivated intruder is a reasonably competent person with internet access and public records who wants to identify someone, and the ICO says unstructured data "can require careful human judgment to determine if people are still identifiable".
- Re-identification offense: section 171 of the Data Protection Act 2018 makes it an offense to knowingly or recklessly re-identify de-identified personal data without the consent of the controller that de-identified it.
- EU case law: in EDPS v SRB (Case C-413/23 P), decided on September 4, 2025, the Court of Justice ruled that pseudonymized data is not personal data "in all cases and for every person", while the disclosing company's duties are judged from its own position when it collected the data.
- EU guidance: the European Data Protection Board's Guidelines 01/2025 say pseudonymized data "remains information related to an identifiable natural person", and its Opinion 28/2024 says AI models trained with personal data "cannot, in all cases, be considered anonymous".
- Voice: the ICO's biometric guidance, published in March 2024, lists voice among the characteristics that can underlie biometric data, which is special category data when used for unique identification.

If you hold records with people in them and want to know whether de-identification would leave enough value to sell, [book a free consultation](https://sellmydatatoai.net/book-a-consultation?side=seller). We will tell you which record types buyers want and which are better left out.

## Frequently asked questions

### Is pseudonymized data the same as de-identified data?

No. Pseudonymized data has identifiers replaced with tokens, but someone holding the key can reverse it. Under the CCPA, data is deidentified only if it cannot reasonably be linked to a consumer and the holder makes a public commitment not to re-identify it and binds recipients by contract. UK and EU regulators also treat pseudonymized data as personal data for anyone who holds the key.

### Does HIPAA Safe Harbor work for records that are not health data?

HIPAA Safe Harbor is a legal standard only for protected health information held by covered entities and business associates. Its list of 18 identifier types is a useful checklist for other records, but meeting it does not satisfy the CCPA's extra conditions of a public commitment and binding contracts, or the stricter UK and EU anonymization test. Take advice on which test applies.

### Can software de-identify my records automatically?

Software can do most of the first pass. Open-source tools such as Microsoft Presidio find and replace common identifiers like names, emails and phone numbers in text. They miss context, such as a job title that points to one person, so a human review of a random sample is still needed before any buyer sees the data.

### Who should run the re-identification test?

Someone who did not carry out the redaction, ideally with no inside knowledge of the people in the records. They should try to identify individuals in a random sample using public sources. HIPAA's Expert Determination method formalizes this with a qualified expert. For larger or sensitive datasets, an independent reviewer adds credibility with buyers, as micro1 offered in the Spirit Airlines sale.

### Will de-identification reduce what buyers pay?

It can, if identifiers carry the value. More often the opposite holds, because data with personal information you cannot clear is harder to sell. AIData.Broker lists uncleared personal data as a factor that lowers price, as reported by ddiy.co in October 2026. Consistent pseudonymization keeps conversations readable, which preserves most of the training value.

### Do I need to tell people their data will be de-identified?

Under the CCPA, a business may not use personal information for additional purposes incompatible with those it disclosed at collection without giving notice, and FTC staff warn against retroactive privacy policy changes. Preparing data for licensing is usually a new purpose, so check your notices first. In the UK, the ICO treats anonymization itself as processing. Take independent advice.

## Sources

- [California Civil Code section 1798.140 (definitions)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), California Legislative Information, accessed November 2026
- [California Civil Code section 1798.100](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100), California Legislative Information, accessed November 2026
- [Guidance regarding methods for de-identification of protected health information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), US Department of Health and Human Services, accessed November 2026
- [45 CFR 164.514: other requirements relating to uses and disclosures of protected health information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), eCFR, accessed November 2026
- [34 CFR 99.31: disclosure of personally identifiable information without prior consent](https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-D/section-99.31), eCFR, accessed November 2026
- [U.S. state privacy law landscape expands to 24 states](https://www.bytebacklaw.com/2026/06/u-s-state-privacy-law-landscape-expands-to-24-states-what-the-latest-legislative-wave-means-for-businesses/), Husch Blackwell (Byte Back), accessed November 2026
- [Biometric Information Privacy Act, 740 ILCS 14](https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57), Illinois General Assembly, accessed November 2026
- [AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive), Federal Trade Commission, accessed November 2026
- [Estimating the success of re-identifications in incomplete datasets using generative models](https://pmc.ncbi.nlm.nih.gov/articles/PMC6650473), Nature Communications (Rocher, Hendrickx and de Montjoye, 2019), accessed November 2026
- [Selling company data for AI training: what to know before you say yes](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), Frankfurt Kurnit Klein & Selz, accessed November 2026
- [Google wants Spirit Airlines' data. Micro1 wants to pay more](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/), Fortune, accessed November 2026
- [Extracting training data from large language models](https://www.usenix.org/conference/usenixsecurity21/presentation/carlini-extracting), USENIX Security Symposium 2021, accessed November 2026
- [Scalable extraction of training data from (production) language models](https://arxiv.org/abs/2311.17035v1), arXiv (Nasr and others, 2023), accessed November 2026
- [Presidio: data protection and de-identification SDK](https://microsoft.github.io/presidio), Microsoft, accessed November 2026
- [How much is company data worth to AI?](https://ddiy.co/how-much-is-company-data-worth-to-ai/), ddiy.co, accessed November 2026
- [Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/), Information Commissioner's Office, accessed November 2026
- [How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective), Information Commissioner's Office, accessed November 2026
- [Data Protection Act 2018, section 171](https://www.legislation.gov.uk/ukpga/2018/12/section/171), legislation.gov.uk, accessed November 2026
- [CJEU clarifies concept of personal data for a transfer of pseudonymised data to third parties](https://www.aoshearman.com/en/insights/ao-shearman-on-data/cjeu-clarifies-concept-of-personal-data-for-a-transfer-of-pseudonymised-data-to-third-parties), A&O Shearman, accessed November 2026
- [EDPB adopts pseudonymisation guidelines](https://edpb.europa.eu/news/news/2025/edpb-adopts-pseudonymisation-guidelines-and-paves-way-improve-cooperation_en), European Data Protection Board, accessed November 2026
- [Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models](https://edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf), European Data Protection Board, accessed November 2026
- [ICO publishes biometric data guidance](https://www.ropesgray.com/en/insights/viewpoints/102j5cq/ico-publishes-biometric-data-guidance), Ropes & Gray, accessed November 2026

---

Book a free consultation: https://sellmydatatoai.net/book-a-consultation