Can Customer Data Ever Be Truly Anonymous?

There is a comforting idea at the heart of a lot of data governance. If information is sufficiently stripped of the things that identify a person, then what remains can be treated as anonymous. The name goes. The email address goes. The phone number goes. The obvious joins are removed or obscured. What is left may still be useful for analysis, modelling or measurement, but the person has disappeared.

The problem is that the person has only disappeared relative to what can be known now.

Anonymity is usually treated as a property of the data itself: this dataset is identifiable, that one is pseudonymous, another is anonymous. But in practice anonymity also depends on the world surrounding the data. It depends on what other information exists, who has access to it, what can be connected, what can be inferred and how much technology is available to do the connecting and inferring.

None of those things stands still.

A dataset that could not realistically be tied back to an individual ten years ago may be much easier to attribute today. Not because the dataset changed, but because everything around it did. More information exists. More of it is searchable. More of it is machine-readable. More organisations possess large amounts of independent information about the same people. Matching has improved. Computing has become cheaper. Models are better at finding relationships that would previously have been invisible or commercially useless.

Which suggests two questions that ought to accompany every confident assertion that customer data is anonymous:

Anonymous to whom, and for how long?

Anonymity depends on the world around the data

In the previous article in this series I argued that removing an identifier does not remove identity. A hashed email address is a particularly clean example because it can conceal the readable identifier while preserving the connection required for matching. But hashing is only one mechanism. Identity can also emerge from combinations of information that did not look identifying when each piece was viewed alone.

That exposes a weakness in the way businesses tend to think about anonymisation. We behave as though identity is something contained inside particular fields. Remove the fields and identity has gone.

But identity can also be reconstructed from relationships.

A location means one thing. A location at a particular time means more. Repeated locations and times begin to describe a routine. Add a purchase, a device characteristic, a workplace, a public professional profile or another source of behavioural information and the possible population can narrow very quickly. No single field has to contain the person’s name for the combination to point towards a person.

Routes back to identity

The distinction between information that already exists elsewhere and information that can be inferred matters here.

The first route back to identity is external information. A supposedly anonymous record can become identifiable because something else exists that allows the pieces to be joined. That something else might be publicly available information, information held by a commercial partner, data obtained from another source, information created by the customer elsewhere or a dataset that did not even exist when the original information was anonymised. In that case, the world has acquired more pieces of the jigsaw.

The second route is different. Nothing new has to appear. The capability to extract meaning from the existing pieces can improve. A pattern that once looked like noise can become distinctive. A sequence that once required an analyst and days of work can be recognised automatically. Weak signals can become useful when models learn how to combine them.

The first expands the available information. The second expands what the information can mean.

And the consequences do not stop at discovering who the person is.

Years of transactions, movements or behaviours accumulate around a record believed to be anonymous. If that record later becomes attributable to an individual, identification does not simply add a name to the latest observation. The accumulated history becomes attributable too. A body of information that was safe partly because nobody knew whose history it was becomes the history of a particular person, and once that connection exists, further conclusions can be drawn from everything already attached to it.

That is one reason the passage of time does not make anonymous information less consequential. In some circumstances it does the opposite. The record becomes richer while the external world becomes better at resolving who it belongs to.

Anonymity is better understood as a condition than as a permanent property. It can be entirely reasonable to conclude that a dataset cannot realistically be attributed to individuals today. But that conclusion rests on assumptions about available data, available technology, available actors and the cost of making the connection. Change enough of those assumptions and the conclusion changes too, even though the supposedly anonymous dataset remains exactly as it was.

The most revealing data may not look sensitive

This creates a practical problem for businesses, because the data most vulnerable to losing anonymity is not the data that looks most sensitive when viewed field by field.

We are accustomed to giving special treatment to obviously sensitive information, and rightly so. But the data that creates the shortest path back to a person can look much more mundane.

A timestamp can be ordinary. So can a postcode, an order value, a browser event, a product category or a journey between two locations. Yet some combinations are unusually distinctive. Others create continuity, allowing separate observations to accumulate around the same person. Others become revealing only because they are placed in an environment where the recipient already knows something complementary.

A medicine can be perfectly safe on its own and problematic when taken with another. The danger does not reside entirely in either ingredient. It emerges from the interaction.

Data can behave in much the same way. A field that looks harmless in one environment can become highly revealing in another. A dataset that is difficult to attribute when held by one organisation may be much easier to attribute when given to a partner with richer independent knowledge. A combination that looks safe today can move up the risk hierarchy if a new dataset or a new capability appears tomorrow.

The unit that matters is therefore not simply the field and not simply the dataset. It is increasingly the combination: the data, the other information it can meet, the environment in which it is placed and the capabilities available there.

Not every combination is dangerous. They are simply not equally consequential.

Build a hierarchy of anonymity risk

If anonymity can weaken, the answer is not to pretend that every anonymised dataset is one technological breakthrough away from disaster. That would be as unhelpful as treating every dataset as permanently safe because somebody removed the obvious identifiers.

The more useful response is to build a hierarchy.

Start with distinctiveness. Broad aggregate statistics generally create a very different problem from person-level records containing rare combinations of attributes. Precise location, unusual behaviour, uncommon transactions and fine-grained timestamps can all make a record easier to single out even when no obvious identifier is present.

Then ask how much continuity survives. A stable pseudonym, device ID, account reference or repeated behavioural pattern can allow observations to accumulate over time. The more continuity survives, the easier it becomes for other facts to attach to the same person, and the greater the historical consequence if identity eventually returns.

Then ask: anonymous to whom? Which partners already possess information about the same people? Which have strong identity-resolution capabilities? Which operate large networks, platforms or ecosystems in which fragments that are meaningless to you may be highly informative to them? The same supposedly anonymous data does not create the same exposure in every recipient environment.

Finally ask: for how long? How much of the conclusion that this information is anonymous depends upon present-day limitations? Are you relying on a match currently being too expensive, too slow, too inaccurate or too technically difficult? Those are not permanent characteristics of the data. They are characteristics of the environment surrounding it.

Businesses already understand this instinctively in cybersecurity. Nobody seriously argues that because a system was secure when it was built, it must therefore still be secure five years later. Threats change, tools improve and weaknesses that were once theoretical become practical.

Anonymity deserves the same instinct.

The compliance status can move

There is a further business consequence that is easy to miss. This is not only a question of technology outrunning an old internal risk assessment. The status you are relying on may itself depend on continued non-identifiability.

Current ICO guidance explicitly tells organisations to take likely technological developments into account when considering whether someone can be identified, and to revisit that judgement as technology and publicly available information change. Its anonymisation guidance goes further: information can move along a spectrum of identifiability as techniques improve, costs fall or new datasets become available, potentially reaching the point where data-protection law applies where it previously did not.

The judgement was not wrong when it was made. The facts it depended on changed.

So “anonymous” is not a compliance status that can be stamped onto a dataset once and then forgotten. If the ability to identify people changes, the legal significance of continuing to hold, use or share that information changes with it.

That makes the hierarchy more than an exercise in theoretical privacy risk. If a business is relying on the proposition that information is anonymous, it needs to understand what makes that proposition true and which of those assumptions are most vulnerable to change.

Some datasets will be extremely robust. Others will be fragile because they retain too much distinctiveness, continuity or contextual richness. Some partners will add very little to the identification problem. Others may already hold exactly the information needed to collapse the anonymity almost immediately.

It is not a hierarchy of what looks most private. It is a hierarchy of what is most capable of becoming attributable.

And that distinction matters because businesses are making long-lived decisions about data in a world where the ability to connect and infer is changing very quickly. Data is copied, licensed, archived, shared, transformed and retained. Once it leaves the environment in which the original anonymity judgement was made, the business cannot assume that every future recipient will inhabit the same information world or possess the same capabilities.

The uncomfortable implication is that anonymisation buys distance rather than permanence.

That distance can be enormously valuable. It can reduce risk, limit exposure and make legitimate analysis possible without unnecessarily identifying people. But distance should not be mistaken for an absolute guarantee that identity can never return.

Can customer data ever be truly anonymous?

Yes, sometimes. But the more useful business question is whether you know what your claim of anonymity depends on.

Anonymous to whom, and for how long?

Because the data may not change at all.

Everything around it will.