Pseudonymization vs anonymization in a data license
The short answer
Pseudonymization vs anonymization asks one thing. Can anyone link a record to a person? A stand-in name is a link. The UK ICO says it stays personal for anyone with the key. Anonymous data has to pass a harder test. Ask counsel whether your stand-ins count as anonymous.
The law treats these two ways of hiding who a record is about very differently.
In plain words
Pseudonymized data swaps each name for a stand-in label. Someone still holds the list that matches labels to names.
Think of it like this
Picture boxes in an attic with labels instead of names. If the list sits in a drawer, the boxes can be matched again. Burn the list and they cannot.
What is the difference between pseudonymization and anonymization?
The ICO describes pseudonymisation as techniques that replace, remove or transform identifying information and store it apart. The data stays personal data for anyone with the extra information. For a recipient without it, the data "may be anonymous" (ICO). The guidance is under review.
GDPR Recital 26 says pseudonymised data that could be tied to a person with extra information is data on an identifiable person. Anonymous information is different, because the person is no longer identifiable. The test asks what means are reasonably likely to be used, counting cost, time and available technology (Recital 26).
What did the EU's top court say about pseudonymization and recipients?
In EDPS v SRB (C-413/23 P, 4 Sep 2025), the Court of Justice held that pseudonymised data can fall outside data protection law from a recipient's view. The conditions are strict. The recipient must be unable to re-identify people. For the party that holds the means to re-identify, the data stays personal (Jones Day summary).
The EDPB's draft Guidelines 02/2026 on anonymisation are open for comment until 30 Oct 2026. They cover singling out, linkability and inference (EDPB).
What does California call it?
The CCPA's term is "deidentified." It has three parts. The business takes reasonable measures so the data cannot be tied to a consumer or household. It publicly commits not to re-identify it. It binds every recipient by contract to the same terms (Civ. Code 1798.140(m), statute text).
My de-identification page goes through it.
Why does the difference matter when you license data for AI?
micro1 wants the trail across tools.
David Revland, who works on human data at micro1, said in an undated recorded forum talk that micro1's team swaps each name for a consistent stand-in across platforms, so the role and cross-tool trail survive. That is pseudonymization by design.
A micro1 referral partner described the same step differently in a micro1 video. They called it full anonymization that removes phone numbers, emails and names (video, about 13:27). A swap and a removal leave you with different data. Ask which one the contract says, and who holds any name mapping.
The Spirit Airlines sale agreement likewise requires de-identification "while preserving referential integrity across the data set." The flight attendants' union argued that linked data could let identities be rebuilt (Doc 1489). See my union objection page.
The FTC wrote that hashing does not make data anonymous (FTC).
What should you ask a data company?
- Do links between records survive, and why does the buyer need them?
- Which legal test does the process aim to meet, and who certifies it?
- Who holds any key that can reverse the swap?
- What stops a recipient from combining the data with other sources?
My re-identification page covers how well scrubbing holds up. The data anonymization guide covers a full licensing deal. Run the rights check first.
This page is research, not legal advice. Have a privacy lawyer in your state read any contract before you sign. They like that.
Apply to micro1's data partnership (paid link)micro1's own data-partnerships pagePaid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
