Why removing the name is not anonymity

Three fields are usually enough

In the late 1990s Latanya Sweeney showed that a substantial majority of the US population could be uniquely identified from just three pieces of information: five-digit postal code, date of birth and sex. None of the three is a name. All three appear routinely in datasets released as anonymous. A later analysis using different census data put the figure lower but still in the majority range — the exact percentage is disputed and the conclusion is not.

Sweeney demonstrated it concretely by taking a supposedly anonymised medical dataset released by a state insurance commission, matching it against a public voter roll she bought for twenty dollars, and identifying the state governor's own hospital records.

The general principle: identification does not require an identifier. It requires enough attributes to be unique, and people are unique surprisingly quickly.

The famous cases

Netflix, 2007. Netflix released 100 million anonymised film ratings for a research competition. Narayanan and Shmatikov matched them against public IMDb reviews and re-identified users, exposing viewing histories including politically and sexually sensitive titles. Ratings and dates alone were sufficient.

AOL, 2006. AOL published 20 million search queries with user IDs replaced by numbers. Journalists identified a specific 62-year-old woman from her searches alone. Search history is a fingerprint because everybody searches for their own town, their own illnesses, their own name.

Mobility data. Work by de Montjoye and colleagues found that four approximate time-and-place points are enough to uniquely identify most people in a mobile-phone dataset, and four is a very small number — home, work, and two errands.

What this means for text

Free text is the hardest case of all, and it is exactly what people paste into AI tools.

Structured data has fields you can decide to remove. Text has identity distributed everywhere: the phrasing, the rare condition, the unusual job title, the name of a small school, the date of an event, the combination of a city and a role. "A 34-year-old woman in Kochi who runs a bakery and had a rare autoimmune diagnosis in March" contains no name and identifies a person.

Automated redaction tools catch names, emails and phone numbers well and miss context almost entirely. They are worth using and they are not sufficient.

The test that works: after redacting, ask whether someone who knows this person would recognise them. Usually the answer is yes, and usually the person who would recognise them is exactly the person you are worried about.

The techniques that do work, and their price

k-anonymity. Generalise the data until every record is indistinguishable from at least k−1 others: replace exact age with a ten-year band, postcode with a district. Real protection, and it degrades if a group shares a sensitive value — if all five people in a bucket have the same diagnosis, you have learned it about all of them without identifying anyone. Extensions called l-diversity and t-closeness address that at further cost to utility.

Differential privacy. The strongest formal guarantee available. Calibrated random noise is added so that the result is almost the same whether or not any single person is in the dataset, with a parameter that quantifies exactly how much is leaked. The US Census used it for the 2020 release; Apple and Google use it for telemetry. The cost is real: noisy answers, especially for small groups, which is why the 2020 census application was contested by researchers who needed small-area accuracy.

Synthetic data. Generate artificial records with similar statistics. Useful for development and testing, and not automatically private — a generator trained on a small dataset can reproduce real records closely, and evaluating that requires its own work.

Notice the pattern: every technique trades utility for privacy, on a dial. Anyone offering both at full strength is selling something.

The practical position

For everyday work: treat "anonymised" as "harder to identify", never as "impossible to identify". Remove more than feels necessary, especially the rare attributes, because rarity is what identifies. Change the specifics that are not load-bearing for your question — the town, the exact date, the unusual detail — and keep the structure that is.

And if the data is genuinely sensitive, the honest answer is often not to de-identify it but to keep it on a machine you control. That is the next lesson.