A historical perspective on auxiliary information, distinctive records and why removing names does not necessarily prevent re-identification.
A name is only one identifier
The idea of anonymization sounds simple: remove a person’s name and obvious contact details, then publish the remaining information. This can be useful in narrowly defined circumstances, but the guarantee is weaker than it appears when records contain rich behavioral information. The remaining facts may describe a combination of traits or activities that few other people share.
The original 33 Bits of Entropy blog drew attention to this difficulty through examples involving online social networks, location pairs and consumer records. Its title referenced a basic information-theoretic observation about the amount of information required to distinguish among billions of possibilities, not a universal recipe for identifying anyone.
Auxiliary information changes the picture
A dataset does not exist in isolation after publication. A person attempting to join records may have access to social profiles, directories, public documents or other releases. Two sources that appear harmless separately may become identifying when their patterns overlap.
The historical social-network paper made the danger tangible by examining graph structure. The location-pair analysis showed how routines can have identifying power. These examples do not imply that every record can be matched successfully; they show why release decisions require a threat model.
Statistical methods can help, but purpose matters
Protection strategies include restricting access, limiting collection, aggregating records, assessing disclosure risks and carefully specifying the analysis that data recipients may run. Some techniques provide mathematical privacy guarantees under explicit assumptions; others aim to lower risk without ruling it out.
The 33 Bits of Entropy research essay is a historical starting point for the distinction between removing familiar identifiers and reasoning rigorously about what a disclosure permits.
Good practice starts before publication
Teams should decide why they need each field, who will receive it, how long it will be retained and which additional datasets might exist. Publication is often difficult to reverse. A privacy review conducted only after a release cannot restore the original degree of control over copies that have circulated.
Researchers and publishers also have obligations to avoid unnecessary exposure in their demonstrations. Reporting that a dataset is vulnerable can be informative without posting enough individual details to make affected people easier to identify.
An archive, not a promise
This site preserves a map of early research and commentary but does not certify modern anonymization methods or offer legal advice. The most useful lesson is methodological: ask what claims are actually supported by a data-release design, then evaluate the consequences when that design meets the open web.
For readers interested in the larger history, the original topic-organized sitemap helps trace how policy, cookies and de-anonymization were treated as connected fields.
Uniqueness is not the same thing as certainty
Researchers sometimes describe a record as unique within a dataset. This is a useful property to measure, but uniqueness does not automatically identify the person behind the record. Successful attribution also requires a route to outside information that links a distinctive pattern to someone’s name or account. Data quality, errors and missing records influence the result.
The distinction matters in both directions. Overstating identification can cause unjustified alarm, while assuming missing names make records safe ignores plausible linkages. Risk assessment should state the adversary’s knowledge, the method used and the limits of the conclusion.
A problem for scientific reproducibility
Researchers often want to release detailed datasets so colleagues can verify published work. At the same time, detailed records may make the subjects easier to identify. The conflict cannot always be resolved by a mechanical pass that deletes obvious fields. Teams may need restricted access, synthetic examples, aggregate results or carefully designed query access.
There is also a public-interest dimension. Reporting a weakness can lead organizations to improve their treatment of personal information, but distributing individual records widely may create the very harm the research is intended to prevent. Documentation should explain what evidence is available and why it is sufficient for a claim.
What has changed since the early research
The range of collected information has widened as phones, connected devices and web services have become routine. Large-scale data processing also makes it easier to combine sources. Older demonstrations should therefore be read as explanations of a general problem rather than definitive measurements of every present-day system.
At the same time, privacy engineering has developed tools for controlling access, limiting exposure and analyzing data with explicit protections. Those techniques can be valuable when their assumptions are respected. Treating them as magic labels would repeat the older mistake of equating a procedure with a blanket guarantee.
Explore the background: Do Not Track in historical context · Online anonymity research · Archive homepage.