Anonymization and Why It Often Fails

In 2006, Netflix released a supposedly anonymized dataset of 100 million movie ratings for a public prize. Researchers de-anonymized users by cross-referencing with public IMDB reviews. Similarly, the AOL search log leak in 2006 exposed identifiable users from supposedly scrubbed queries. Anonymization is hard, and naive anonymization is almost always broken.

The Sweeney result

Why naive anonymization fails

• Quasi-identifiers combine: age + ZIP + job is often unique
• Auxiliary data: an attacker can cross-reference with public sources
• High-dimensional data (location traces, browsing history) is almost always unique
• Rare attributes (unusual diseases, rare job titles) trivially identify
• Linking attacks: merge two 'anonymous' datasets and identities emerge

Formal techniques

Differential privacy: the gold standard

Differential privacy, formalized by Cynthia Dwork and colleagues in 2006, adds carefully calibrated noise so that the output of an analysis barely changes whether any one individual's data is included or not. Apple, Google, and the US Census all use differential privacy in production.

import numpy as np

def dp_count(data, true_count, epsilon=1.0):
    # Laplace noise scaled by sensitivity (1 for counts) / epsilon
    noise = np.random.laplace(loc=0, scale=1/epsilon)
    return true_count + noise

# 1000 people have condition X
# DP releases a noisy count that still tells useful stats
# but hides any single individual
noisy = dp_count(data=None, true_count=1000, epsilon=1.0)
print(f'Reported count: {noisy:.0f}')

Practical guidance

1. 1Do not release raw data, even with names removed
2. 2Aggregate to coarse categories (age ranges, not ages)
3. 3Generalize quasi-identifiers (5-digit ZIP becomes 3-digit)
4. 4Suppress rare combinations
5. 5Use differential privacy for any computation on sensitive data
6. 6Assume attackers have auxiliary data you don't know about

The big idea: anonymization is harder than it looks. Formal techniques like differential privacy are the only reliable path. If you cannot afford formal guarantees, do not release the data.