Why you can't really anonymize your data
One of the joys of the last few years has been the flood of real-world datasets being released by all sorts of organizations. These usually involve some record of individuals' activities, so to assuage privacy fears, the distributors will claim …
Context & Ripple Effects
This piece lands mid-wave in the open-data boom of the early 2010s: governments, hospitals, and web companies were racing to publish rich behavioral datasets, and 'we removed the names' had become the standard assurance that made those releases socially acceptable. It extends the skepticism Bruce Schneier laid out in early 2010, when he argued that anonymity online is far more fragile than it appears.
The argument matters because so much of the era's data-sharing rests on that one technique: if record-level anonymization fails against someone who combines the release with outside information, then every publisher relying on identifier-stripping has been offering reassurance rather than protection.
First-order effects
- Organizations releasing 'anonymized' datasets can no longer treat identifier removal as sufficient diligence — the analysis holds that such records can be matched back to individuals once joined with any external data.
- Researchers and journalists gain a defensible basis for testing published datasets for re-identification, since the claim that anonymization protects privacy is now contested on the record.
Second-order effects
- Dataset publishers face a fork between withholding releases altogether and investing in stronger safeguards — formal privacy guarantees, aggregation, or controlled access tiers — raising the cost of every future open-data program.
- Downstream consumers of public datasets (researchers, startups building on government and health data) inherit the legal and ethical exposure of data they did not collect themselves.
Third-order effects
- If the pattern holds, 'anonymized' stops functioning as a safe harbor in policy debates over data release, and the field shifts toward explicitly trading dataset utility for measurable privacy protection — with access restrictions becoming the norm rather than the exception.
The trend: Open-data publishing is colliding with the demonstrable failure of identifier-stripping, forcing institutions to choose between dataset utility and provable privacy.