Anonymization vs Pseudonymization for AI Training Data: What Each Achieves Legally

Anonymization turns records into data that no longer relates to an identifiable person by any means reasonably likely to be used, which takes them outside data protection law, while pseudonymization replaces identifiers with codes that extra information can reverse, so the data usually stays personal data. For a company licensing records for AI training, it decides whether GDPR duties travel with the data. Six EU texts between 2016 and 2026 shape the answer, and three of them (two EDPB drafts and a Commission proposal) are not final as of November 9, 2026.

Since September 4, 2025, the Court of Justice judges pseudonymized data from the means of each recipient (C-413/23 P), so the same records can be personal data for a seller who keeps the key and not for a buyer without it. This is one legal question within AI training data licensing, and a buyer's word "anonymized" is program wording, not a legal finding: no buyer page names the test the delivered data meets. US statutes say "deidentified" instead and attach their own conditions.

DataPacts Editorial Team checked each legal text, court record and buyer statement on this page against its primary source, and the page on how we source, date and check every figure sets out the rules.

What Data Anonymization Means, and Why It Is a Legal Result

Data anonymization is the processing that leaves no person identifiable in a dataset, and whether it succeeded is a legal conclusion about the data, not a property of the tool that produced it. "Anonymized" names the process, while "anonymous" names the status the data reaches, and only the status changes which law applies. GDPR Recital 26 sets that status for the EU: information is anonymous when no person is identifiable by any means reasonably likely to be used, and singling out a person counts as such a means.

Which means count, and for whom? The EDPB's 2026 draft guidelines split the question into record isolation, linkage and inference, assessed from the perspective of each entity holding the data. US law asks a parallel question with a different word. The California Consumer Privacy Act calls data "deidentified" under Cal. Civ. Code 1798.140(m) when reasonable measures prevent association with a consumer and the holder commits publicly and by contract not to reidentify it. Neither this nor HIPAA's "de-identified" equals the EU's "anonymous", because each statute attaches its own conditions and legal effect.

Every anonymization claim in a data license therefore answers three questions: anonymous for whom, against which means, and after which training.

Anonymous vs Pseudonymized Training Data at a Glance

Pseudonymized data keeps a key or other additional information that can re-attach identities, and anonymous data has none that anyone is reasonably likely to use, which is why the two carry different duties for a seller and a buyer. The table compares the two statuses as of 2026-11-09.

A dataset whose key exists anywhere, at the seller or at a service provider, starts in the pseudonymized column for whoever can reach that key.

How EU Law Decides Whether Licensed Records Are Anonymous

EU law decides anonymity with one test in Recital 26 and later texts that read it differently, two of them drafts as of November 9, 2026. The table lists the six texts by date, with their status as of 2026-11-09.

Recital 26: The Means Reasonably Likely to Be Used

Recital 26 of the GDPR says the data protection principles should not apply to anonymous information and judges identifiability by all the means reasonably likely to be used, such as singling out. The recital belongs to Regulation (EU) 2016/679, in force since May 24, 2016 and applying from May 25, 2018 (Art. 99), so every later text interprets it. For a license, the test applies to the dataset as delivered, together with what the buyer could combine it with. A licensed email archive with names removed still fails the test when signatures, project names or message dates let a recipient single out the sender. The later texts disagree mainly about whose means count.

Three Draft EDPB Criteria: Record Isolation, Linkage, Inference

The EDPB's Guidelines 02/2026 on Anonymisation, adopted on July 7, 2026 for public consultation and not final as of November 9, 2026, treat data as anonymous only when no record can be isolated, linked or inferred. The three criteria of the draft are listed below.

• No Record Isolation: no record about a person stands out from the others in the dataset.
• No Linkage: no record can be connected with other data about the same person.
• No Inference: no meaningful information about a person can be deduced from the data.

The draft assesses anonymity from each relevant entity's perspective, with contextual and simplified approaches. Section 3.4 (paragraphs 79 to 82) says membership and other inference "would, in particular, be the case for AI models or synthetic data", and a meaningful inference breaches the third criterion. Datasets already assessed as anonymous under the Article 29 Working Party's Opinion 05/2014 need no new assessment, although the draft calls periodic reassessment good practice.

Whose Perspective Counts: C-413/23 P and the Recipient

On September 4, 2025 the Court of Justice held in EDPS v SRB (C-413/23 P) that pseudonymized data are not personal data in all cases and for every person, so the answer can differ between the seller who holds the key and the buyer who does not. The case asked whether pseudonymized comments the Single Resolution Board sent to Deloitte were personal data, and whether the Board had to name that recipient to their authors. The judgment and its procedure are covered under EDPS v SRB.

The Court also held that the duty to inform people about recipients is judged at collection, from the controller's perspective, and it set aside the General Court's judgment in T-557/20 and referred the case back. A seller's notice duties therefore do not disappear because the buyer cannot re-identify anyone.

The EDPB's consultation version of Guidelines 01/2025 on Pseudonymisation (consultation 2025-01-17 to 2025-03-14) reads the question the other way: data attributable with additional information are personal data even when another person holds that information. No final version exists as of November 9, 2026, so both readings stand side by side.

What Pseudonymization Still Earns a Seller Under the GDPR

Pseudonymization does not take records out of the GDPR for the seller, but it counts as a safeguard in the tests a seller must pass to license them. GDPR Art. 6(4)(e) names appropriate safeguards, which may include encryption or pseudonymisation, among the factors for whether a new purpose is compatible with the purpose of collection, and licensing records collected for operations is such a new purpose. The EDPB's 01/2025 consultation draft adds that the risk reduction may support a legitimate interest under Art. 6(1)(f) as well as compatibility under Art. 6(4).

Pseudonymized records keep every other GDPR duty for AI training data: a legal basis, notices and transfer rules. Those duties are set out under GDPR and AI training data. The highest fine tier, Art. 83(5) of Regulation (EU) 2016/679, reaches EUR 20,000,000 or 4 % of total worldwide annual turnover, whichever is higher.

Proposed Change: Entity-Relative Personal Data in COM(2025) 837

The Commission's Digital Omnibus proposal COM(2025) 837 of November 19, 2025 would write an entity-relative sentence into the Art. 4(1) definition of personal data and add an Art. 41a on pseudonymised data, but it is a proposal. The procedure 2025/0360(COD) is awaiting committee decision in the European Parliament as of November 9, 2026. Until a text is adopted, a license signed now cannot rely on the proposed wording.

Deidentified, Not Anonymous: How US Statutes Frame the Same Question

US privacy statutes use "deidentified" rather than "anonymous", and each attaches its own conditions, so data can be deidentified under one statute and still regulated under another. California treats deidentified data as outside personal information under Cal. Civ. Code 1798.140(m) when three conditions hold: reasonable measures against association with a consumer, a public commitment not to reidentify, and contractual obligations on every recipient. Licensing personal information for money is a sale under the same statute, so the three conditions decide which regime a California license falls under. HIPAA's closest analogue to a pseudonymization key is the re-identification code of 45 CFR 164.514(c), which a covered entity may keep if the code is not derived from information about the person and is not disclosed.

Each US standard defines a process with conditions rather than a status that holds everywhere. The operational step of PII removal and de-identification before licensing covers which identifiers to strip from each data type. Health data meeting 164.514(a)-(b) falls outside the Privacy Rule under 164.502(d), while a limited data set, with 16 direct identifiers removed, stays protected and serves only research, public health or health care operations under a data use agreement. In the Spirit Airlines bankruptcy (Bankr. S.D.N.Y. 25-11897), the Bill of Sale requires the CCPA standard plus 45 CFR 164.514 for health data (Dkt. 1463), and the sale is not approved as of November 9, 2026. The table compares four US standards as of 2026-11-09.

Anonymous and Pseudonymous Data in Other Jurisdictions

Outside the EU and US, several laws make anonymity the condition for a particular use, and some name pseudonymized data as a separate, narrower category. Finland shows the narrowest version: under Act 552/2019 as amended by 1159/2025, development and innovation, including AI product development, receive only anonymous aggregated statistics. Québec allows anonymization only under accepted practice and government criteria and makes re-identifying de-identified or anonymized information an offence. Canada's Bill C-36 and Malaysia's consultation paper would add rules, but one is a bill and the other a draft. The table lists seven instruments alphabetically, with status as of 2026-11-09.

Rules That Reach Anonymized Data Anyway

Some rules apply whether or not records are anonymized, so anonymization cannot by itself make them licensable. The DOJ rule at 28 CFR Part 202, effective April 8, 2025, bars bulk US sensitive personal data, even anonymized, from buyers in or linked to China, Cuba, Iran, North Korea, Russia and Venezuela, and 26 CFR 301.7216-2(o)(2) bars selling anonymized tax return statistics except with the sale of the business. Spirit Airlines' consumer transaction systems are excluded "in any form, deidentified or otherwise" (Dkt. 1684, 2026-10-05), and the full list of company data that cannot be licensed for AI training has its own page.

Techniques and the Legal Result Each Can Reach

No technique is anonymous by name: removing names, hashing or masking usually leaves pseudonymized data, and only combinations that defeat isolation, linkage and inference can reach anonymity under the draft EDPB test. The table gives the usual legal result of seven techniques, read against the draft EDPB criteria as of 2026-11-09; it is an assessment aid, not a certification.

Free text is the hardest case for a seller: email, chat and shared documents carry names, roles and events in the message body, not only in fields that a tool can strip. Removing direct identifiers rarely suffices, because Luc Rocher, Julien Hendrickx and Yves-Alexandre de Montjoye estimated in Nature Communications (10:3069, July 23, 2019) that 15 demographic attributes correctly re-identify 99.98 % of Americans in any dataset. Generalization works best where a rule fixes the level: HIPAA Safe Harbor keeps a three-digit ZIP code only where the area holds more than 20,000 people.

Data Masking vs Anonymization

Data masking hides or replaces values so a viewer cannot read them, and it anonymizes only if nothing left in the record, or held elsewhere, lets someone re-identify the person. A masked column that a mapping table can restore is pseudonymized data for anyone who can reach the table, which is the situation the EDPB's 01/2025 draft describes. Irreversible masking still leaves the other fields, and the 02/2026 draft asks whether they isolate a record or link it to other data.

Anonymization Tools and the Assessment They Cannot Replace

Anonymization tools apply techniques, while the legal result depends on the whole dataset, the recipient and the means available, which no tool certifies. ARX, an open-source anonymization tool, reads SQL databases, MS Excel and CSV files (checked 2026-11-09), and the comparison of de-identification vendors and PII redaction tools sits with the operational step. A tool's output is assessed like any other dataset: against isolation, linkage and inference, from the perspective of each recipient.

What Buyers Mean When They Say "Anonymized"

Buyer programs use "anonymized" and "de-identified" for their own processing steps, and none of their pages states which legal test the delivered data meets. The table sets out the wording of four buyers on their own pages, alphabetically, as of 2026-11-09.

micro1 states that it de-identifies sensitive information itself and that companies need not anonymize before transfer, checked 2026-11-09, and its research note of September 24, 2026 describes an identity-preserving transformation with consistent synthetic identities. Consistent identities keep each person's records linked across the dataset, so the method works like pseudonymization: whoever holds the mapping can re-attach identities, and the draft linkage and inference criteria still have to be tested. Each company data partnership program words this step differently, and the terms of the company data partnership programs sit side by side on their own page.

Who anonymizes matters as much as the word. Scale AI states that it anonymizes inside the data holder's environment before any data is extracted (checked 2026-11-09), so identifiable records stay in the seller's systems, while micro1 processes the data after receipt. In the Spirit Airlines case, the consumer privacy ombudsman's supplemental report records that micro1 proposed to de-identify the data itself rather than use an independent party (Dkt. 1684, 2026-10-05). The same report names Tonic.ai as the deidentification agent (Dkt. 1684), and the sale is not approved as of November 9, 2026, with a hearing set for November 17, 2026.

After Training: Why the Buyer's Model Gets Its Own Anonymity Test

Anonymous input does not settle the status of the model, because the EDPB's Opinion 28/2024 of December 17, 2024 asks separately whether personal data can be extracted from a trained model or obtained through queries. The opinion treats a model as anonymous only when the likelihood of both is insignificant, and among corrective measures it names erasure of the dataset used to develop the model or of the model itself (para. 114). The 2026 draft adds that inference from AI models can breach the No Inference criterion.

Anonymize, Pseudonymize or Do Not License: Benefits, Risks, Downsides and Alternatives

Anonymizing records before a license can remove most data protection duties for that data, pseudonymizing keeps them, and not licensing personal records at all is a valid outcome. The four lists below set out each path's benefits, risks, downsides and alternatives.

Benefits

• Anonymous data falls outside the GDPR principles under Recital 26, so no legal basis, notice or transfer tool is needed for it.
• Data meeting CCPA 1798.140(m) or HIPAA 164.514(a)-(b) leaves personal information or the Privacy Rule respectively.
• A named standard gives both sides a fixed reference, as in the Spirit Bill of Sale (sale not approved as of November 9, 2026, hearing November 17, 2026).

Risks

• Re-identification, shown by the 2019 Nature Communications estimate above.
• Legal uncertainty: C-413/23 P and the EDPB 01/2025 draft point in different directions, and the 02/2026 criteria are not final.
• The model question: a trained model gets its own test under Opinion 28/2024.
• Fines: data wrongly treated as anonymous stays under the GDPR and its Art. 83(5) fine tier.

Downsides

• Lower usefulness: breaking linkage removes relations between records, and no public figure exists for the loss.
• Cost and time for assessment and processing, which Mercor states it covers (checked 2026-11-09).
• Consistent pseudonyms leave the data personal for the seller who holds the key.

Alternatives

• License only records that never contained personal data.
• License pseudonymized data with a legal basis and the Art. 6(4)(e) safeguards.
• Offer synthetic data instead, judged by the same test (named in the EDPB 02/2026 draft; counted as deidentified in Utah).
• Do not license personal records at all.

Whether to sell or license data at all comes before the choice of form, and that decision is set out under should you sell or license your data to AI companies.

Where the Anonymization Decision Sits in the Process to Sell or License Company Data

The anonymization decision follows the rights and consent checks and comes before the manifest, the buyer's diligence and the contract, because it sets what can be described and delivered. The full sequence to sell or license company data to AI companies runs in the order below, and this page covers the legal side of step 5.

1. Data sale readiness
2. Rights audit
3. Customer consent and confidentiality clauses
4. Employee notice and consent
5. Anonymization decision, with PII removal and de-identification
6. The data manifest
7. AI data licensing agreements
8. Alternatives to selling data to AI labs, open at every step

Rules by Jurisdiction and Sector Behind This Comparison

Each rule above has, or will have, its own page in the law section. They are indexed under AI training data law by jurisdiction, and three pages go deeper on this topic.

• When is an AI model anonymous: EDPB Opinion 28/2024
• EU Digital Omnibus: the COM(2025) 837 proposal
• HIPAA and AI training data: de-identification and limited data sets

This page is information, not legal advice.

Synthetic Data Instead of Anonymized Records

Synthetic data generated from personal records is judged by the same anonymity test, and the EDPB's 2026 draft names synthetic data as a case where inference can breach it. Utah Code 13-61-101 counts it as deidentified data; its buyers and limits are covered under synthetic data for AI training and the privacy question under synthetic data and privacy law.

Buyer Programs and Court Records Cited on This Page

The buyer wording above comes from each program's own page, checked November 9, 2026, and the Spirit record from the bankruptcy docket. Three of the sources have pages of their own.

• Mercor data buyer profile
• micro1 data buyer profile
• US bankruptcy data sales, including the Spirit Airlines case (Bankr. S.D.N.Y. 25-11897)

Frequently Asked Questions

What is the difference between anonymization and pseudonymization?

Anonymized data cannot be linked back to a person by any means reasonably likely to be used, while pseudonymized data can be re-linked with additional information such as a key. Since September 4, 2025, pseudonymized data is not personal in all cases for a recipient without the means to re-identify (C-413/23 P).

What is pseudonymised data?

Pseudonymised data is personal data whose identifiers have been replaced so it can be attributed to a person only with additional information kept separately. The EDPB's Guidelines 01/2025, a consultation version with no final text as of November 9, 2026, treat it as personal data even when another party holds that information.

Is anonymized data still personal data under the GDPR?

Truly anonymous data is not, under Recital 26, but data a buyer calls anonymized is personal data if anyone can re-identify people with means reasonably likely to be used. The EDPB's draft Guidelines 02/2026 test this through record isolation, linkage and inference, and they are not final as of November 9, 2026.

What is the difference between data anonymization and encryption?

Encryption keeps data reversible for whoever holds the key, so encrypted personal data stays personal data, and the GDPR lists encryption beside pseudonymisation as a safeguard. That safeguard appears in Art. 6(4)(e) as a factor for whether a new purpose, such as licensing, is compatible with the original one.

Is hashed or tokenized data anonymous?

Usually not: a hash or token that stays consistent across records is a pseudonym, and the draft EDPB criteria still ask whether records can be isolated or linked. A consistent token lets a recipient connect every record about the same person, which is the linkage the draft tests for.