# What is data de-identification in a company data license? > Searching for de-identification before a data sale? In a license, it removes or swaps details that tie a record to a person. The legal tests and who does it. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-de-identification Published: 2026-08-29 Updated: 2026-10-14 ## The short answer Data de-identification means taking names and details out of records. It does not settle who owns the rights. In California, the data must not link back to a person. The business must publicly promise to keep it that way. Every buyer must sign on too. Search results for this phrase are mostly health-privacy pages and software vendors. We're covering it for an owner with an email, chat or ticket archive to license. > **De-identification removes or swaps the details that point to a person.** It's like pulling the name tags off the boxes in the attic. A name written inside a box still points to someone. ## What do the laws mean by de-identified? The tests differ by law, and each has its own text. **California.** Under the CCPA, deidentified information "cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer." The business must also take reasonable measures, publicly commit not to re-identify, and bind recipients by contract (Civil Code 1798.140(m)). Without that, a transfer of personal information for money or other valuable consideration counts as a sale. **Health information under HIPAA.** The rule offers two methods. One is an expert determination. The other is a safe harbor that removes 18 types of identifier ([45 CFR 164.514](https://www.law.cornell.edu/cfr/text/45/164.514)). **UK.** The ICO says pseudonymised data is personal data in the hands of anyone who holds the additional information. It marks its guidance as under review ([ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/)). **FTC.** In July 2024 the FTC wrote that hashes "aren't 'anonymous'" and can still identify users ([FTC](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous)). ## Why isn't de-identification enough by itself? Daniel Goldberg, a partner at Frankfurt Kurnit, wrote that removing identifying details from millions of emails and chats is "much harder than removing names from structured fields." He added that de-identification speaks to whether a record can be linked to a person. It does not speak to whether the content is confidential. He advised excluding high-risk data instead of relying on it ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). [Handshake AI](/buyers/handshake-ai)'s own page says a third party may be able to re-identify personal information in combination with other data. ## Who does the de-identifying in a deal? It varies by firm. [micro1](/buyers/micro1) staff said in an undated recorded forum talk that the company transforms the data itself. The same talk said redacting first would destroy the cross-tool trail it needs. This is self-reported. In the Spirit sale, the court-appointed privacy ombudsman's report says the debtors hired Tonic.ai to de-identify unstructured data. Before each transfer Tonic.ai is to deliver a certification, filed with the court, that the approved procedures ran. The ombudsman did not examine risks to employees or third parties ([ombudsman report, Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf)). The sale agreement asks for de-identification that preserves "referential integrity across the data set." The flight attendants' union challenged that ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). In the same talk micro1's David Revland, who works on human data, said micro1 swaps each name for the same stand-in every time, which keeps the links between records. A union made the same point about the Spirit sale, so ask any buyer how it handles links. Figure: comparison of Two ways to treat a name in free text: Redaction (Trail removed), Name swap (emphasized: What Revland (micro1) says it uses, Trail kept). micro1's David Revland said in an undated recorded forum talk that it swaps names for stand-ins, which keeps the trail across tools. _Redaction is a black marker. A name swap is a costume party where everyone wears the same costume all night._ ## What should an owner ask? 1. Who does the de-identification, and who pays for it? 2. To what standard, and does anyone certify it? 3. Do links between records survive, and why? 4. May we scrub first? Run the [rights check](/rights-check) and read the [risk map](/risks) before a buyer call. Talk to a privacy or commercial lawyer in your state before you sign. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) ยท [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [45 CFR 164.514](https://www.law.cornell.edu/cfr/text/45/164.514) - [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [FTC](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [ombudsman report, Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)