PII Removal and De-identification Before Licensing Data for AI Training

De-identification is the removal or transformation of names, contact details and other identifiers in company records so the licensed copy can no longer reasonably be linked to a person, and in AI data deals it happens before the data reaches the AI lab. Most buyer programs state that they do the work themselves: Mercor states it covers extraction, anonymization and transfer costs, and micro1 states that companies need not anonymize before transfer (both checked November 9, 2026).

The standard to meet, the residual risk and the license terms stay the seller's decision. PII removal is one step of AI training data licensing, and it narrows what is sold without replacing the rights audit, the consent review or the option not to license. In the Spirit Airlines sale, the Bill of Sale requires the CCPA standard, plus 45 CFR 164.514 for health data, and puts the cost on the buyer (Dkt. 1463, 2026-08-14). Re-identification stays possible: Rocher and colleagues estimated in 2019 that 15 demographic attributes re-identify 99.98 % of Americans.

DataPacts Editorial Team checked every figure on this page against its primary source, and the page on how we source, date and check every figure sets out the rules.

What De-identification Means Before a Data License

De-identification removes direct identifiers such as names, email addresses and account numbers and reduces indirect identifiers such as job titles, dates and locations, so a record cannot reasonably be tied to a person. A direct identifier names the person on its own. An indirect identifier, also called a quasi-identifier, identifies someone only in combination with others, which is why removing names alone does not suffice.

Redaction, masking and pseudonymization are techniques, while anonymization is a legal result that depends on the jurisdiction. Mercor uses "de-identified" and "anonymized" for the same step on its pages, so the seller asks which standard is meant before signing. The EDPB's draft guidelines on anonymisation are a reminder that the legal word carries a test of its own.

Which Identifiers to Remove From Company Records

What has to come out depends on the data type, because identifiers sit in message headers, document metadata, commit authors, image pixels and voices, not only in names. The table lists the places identifiers sit and what buyers' own pages require, as of 2026-11-09.

Email, Chat and Shared Documents

Workplace email, chat and documents carry identifiers in headers, signatures, mentions and file metadata as well as in the text, and they hold employee, customer and third-party personal data at once. The Spirit Airlines asset schedule lists 100,000,000 emails, 500,000,000 Teams items and 175,658 employee records (Dkt. 1463, Exhibit A-2, 2026-08-14), and the estate hired an independent Deidentification Agent for unstructured data such as corporate emails (Dkt. 1684, 2026-10-05). AfterQuery states that it removes or pseudonymizes identifiers and masks customer identities (checked November 9, 2026).

The CCPA exemption for employee and business-to-business data has been inoperative since 2023-01-01 (Cal. Civ. Code 1798.145(m)(4), (n)(3)), so staff messages count as personal information. Removing names does not answer whether staff were told, and de-identification does not replace employee notice and consent when licensing internal communications.

Source Code Repositories

Code repositories hold personal data in commit authors, email addresses and comments, and secrets such as keys and passwords that must come out for security as well as privacy. pre.dev states that its exposure check removes secrets and personal data and pseudonymizes authors (checked November 9, 2026). Pseudonymized authors keep the commit history usable, while a leaked key harms the company whatever the privacy standard says.

Health Records, Medical Images and Recorded Visits

Health data must meet a health-data standard before licensing, and images and audio need de-identification beyond the text fields. Mercor's listings state that clinical records must be de-identifiable to HIPAA Safe Harbor or Expert Determination, that images must be fully de-identified including text burned into the pixels, and that digital health audio and text must be de-identified with consent covering secondary use (checked November 9, 2026).

Gradient Health states that it de-identifies imaging through DICOM PS3.15 2023a metadata redaction and pixel scanning, with Ethics Board review (checked November 9, 2026). Labelbox Prism states that medical data requires IRB approval or qualified de-identification (checked November 9, 2026).

Client Files in Law, Accounting and Advisory Firms

Client files contain the client's people and confidential business, so buyers ask either for client consent or for files that can be fully anonymized. Mercor's listings for law firms state client consent or full anonymization, and those for consulting and investment firms state the right to license once anonymized (checked November 9, 2026). Anonymization does not lift every bar: a tax preparer may not sell or exchange statistical compilations of return information for value, except with the transfer of assets on sale of the business (26 CFR 301.7216-2(o)(2), eCFR as of 2026-10-01).

Methods for Removing PII: Redaction, Masking, Pseudonymization, Generalization, Synthetic Replacement

Five methods remove or disguise identifiers, and they differ in what the buyer can still learn from the data and in how easily a person can be re-identified. The table compares them as of 2026-11-10, with one example or rule each.

micro1 describes an identity-preserving transformation with consistent synthetic identities (research note, 2026-09-24), which keeps relationships between records and so works like pseudonymization. Safe Harbor generalization shows how coarsening is specified: three-digit ZIP codes only where the area holds more than 20,000 people, and ages over 89 aggregated into 90 or older. A re-identification code is allowed under 45 CFR 164.514(c) only if it is not derived from information about the individual and is not disclosed, so the key stays with the seller.

De-identification Standards a Data License Can Follow

A de-identification standard is the legal or technical test the licensed copy must meet, and the license should name one. The table lists the standards that appear in this page's sources, as of 2026-11-10.

The CCPA Deidentified Standard: Three Conditions

Under Cal. Civ. Code 1798.140(m), data is deidentified only when the business takes reasonable measures against re-association, publicly commits not to re-identify, and binds every recipient by contract. Licensing personal information for money is a sale under the CCPA, while deidentified data that meets the test falls outside personal information, as set out in California's CCPA and AI training data rules. The three conditions are:

• reasonable measures that prevent the data from being associated with a consumer or household;
• a public commitment to maintain and use the data only in deidentified form and not to attempt re-identification;
• contractual obligations on every recipient to comply with the same two duties.

The Spirit debtors adopted the CCPA standard by letter of 2026-08-05 (Dkt. 1684, 2026-10-05). Utah's definition adds synthetic data and the same public commitment and contractual flow-down (Utah Code 13-61-101, in force since 2023-12-31).

Health Data: Safe Harbor or Expert Determination

Health data held by a covered entity or business associate is licensable without patient authorization only once de-identified under 45 CFR 164.514, by removing 18 identifier types (Safe Harbor) or by Expert Determination. Data that meets the standard falls outside the Privacy Rule (45 CFR 164.502(d)(2)), which does not bar licensing it. A limited data set keeps some dates and locations and stays protected health information, so licensing it for a fee is a sale needing authorization (164.508(a)(4)).

What De-identification Does Not Settle for EU Personal Data

Under the GDPR the question is whether data is anonymous, and the Court of Justice held on 2025-09-04 in C-413/23 P that pseudonymized data is not necessarily personal data for every recipient in all cases, while the EDPB's draft anonymisation guidelines test record isolation, linkage and inference. The EDPB's consultation draft on pseudonymisation (Guidelines 01/2025) takes the opposite starting point and treats data as personal when additional information exists, also when another person holds it; neither text is final as of November 9, 2026.

The legal status of each outcome is explained in anonymization vs pseudonymization for AI training data.

Who De-identifies the Data and Who Pays

Most buyer programs state that they de-identify company data themselves, inside the company's systems or after transfer, and only some say who bears the cost. The table lists each program's own statement, alphabetically, as of 2026-11-09; "not stated" means the point is not on the program's pages checked 2026-11-09.

Mercor and Turing state that they cover the cost, the Spirit Bill of Sale puts it on the buyer, and Handshake does not say. No program or vendor publishes a price for de-identification, so the table answers who pays but not how much. Where the work happens also differs: Scale AI states it anonymizes inside the holder's environment before any data is extracted, while micro1 de-identifies after transfer. A full list of terms sits among the company data partnership programs.

Seller, Bidder or Independent Agent: The Spirit Airlines Record

The Spirit Airlines bankruptcy sale shows a court-supervised choice: the estate hired an independent Deidentification Agent instead of letting the buyer de-identify the data. The Bill of Sale requires the CCPA de-identification standard, plus 45 CFR 164.514 for consumer health data, and places de-identification costs on the buyer (Bankr. S.D.N.Y. 25-11897, Dkt. 1463, 2026-08-14). The debtors named Tonic.ai as agent for unstructured data such as corporate emails and adopted the CCPA standard by letter of 2026-08-05 (Dkt. 1684, 2026-10-05).

micro1 filed a Notice of Intent to submit a competing and superior bid (ECF 1556, 2026-09-03), proposed to de-identify the data itself rather than use an independent party, and the ombudsman asked for the opportunity to review that proposal (Dkt. 1684). On 2026-08-14 the debtors named Google LLC the successful bidder at USD 10,000,000 and Mercor.io Corporation the alternate bidder at USD 7,500,000 (Dkt. 1463); the court had not approved the sale as of November 9, 2026, and a hearing is set for November 17, 2026 (Dkt. 1779).

The ombudsman's report says that from a privacy perspective approval of the sale of the deidentified data would be appropriate, and its footnote 3 states that risks to employees and third parties were not investigated. The debtors also excluded transactions and passenger name records, refunds, inflight purchases and Wi-Fi sales in any form, deidentified or otherwise (Dkt. 1684). De-identification narrows the sale and does not replace the choice of what to sell, as explained for US bankruptcy data sales.

PII Redaction Tools and De-identification Vendors

PII redaction tools detect identifiers in text, documents, images or tables and remove or replace them, and none of them guarantees complete removal. The table lists facts from each provider's own documentation, alphabetically, as of 2026-11-10; it is not a ranking or a review.

Documentation of the tools themselves states the same limit as the program pages: AfterQuery states that no process removes all risk on its own (checked November 9, 2026), so output needs the testing below.

Testing for Re-identification Before Delivery

A re-identification test tries to link the de-identified copy back to people, and it matters because a few remaining attributes can identify almost anyone. Rocher, Hendrickx and de Montjoye estimated that 99.98 % of Americans can be correctly re-identified in any dataset using 15 demographic attributes (Nature Communications 10:3069, 2019-07-23). Removing names and numbers therefore does not make a table of dates, places and job titles anonymous.

Buyers test as well. AfterQuery states that it runs a re-identification test before delivery, Ooak Data states that the seller reviews a sample, and Labelbox Prism states that models already trained on the data cannot be unlearned (all checked November 9, 2026). The last point means an error found after delivery cannot be reversed in a trained model. A seller's own testing has three parts:

• a sample review by the seller of the redacted output before transfer;
• a re-identification test on the delivered copy, including combinations of indirect identifiers;
• a written record of the standard applied and the result.

Where De-identification Does Not Make Data Licensable

Some rules apply whether or not the data is de-identified, so removing PII does not by itself make data licensable. Rights, contracts and secrecy duties are covered in the wider list of company data that cannot be licensed for AI training. Three rules reach de-identified or anonymized data:

• 28 CFR Part 202, effective 2025-04-08, bars bulk US sensitive personal data, even if anonymized or de-identified, from buyers in or linked to China, Cuba, Iran, North Korea, Russia and Venezuela, with thresholds of more than 10,000 US persons for personal health data and more than 100,000 for covered personal identifiers (202.205), and an onward-transfer contract bar for other foreign persons (202.302);
• 26 CFR 301.7216-2(o)(2) keeps the tax preparer bar on selling statistical compilations of return information for value;
• a HIPAA limited data set is not de-identified, and licensing it for a fee is a sale of protected health information.

The Spirit sale shows the same logic at company level: the debtors excluded whole systems "in any form", so no deidentified version of them is offered to any bidder either. The scope of the DOJ bulk sensitive data rule is covered on its own page.

Flow-down Terms for De-identified Data in the License

A de-identification standard only holds if the license carries it to the buyer and every later recipient. The CCPA definition makes this a legal condition, not a courtesy, because Cal. Civ. Code 1798.140(m) requires contractual obligations on recipients. The terms that carry the standard are:

• a commitment not to re-identify, matching the public commitment under the CCPA and the Utah definition;
• flow-down of the same commitment to sublicensees and later recipients;
• the named standard and who applies it, as the Spirit Bill of Sale names the CCPA standard and an independent agent;
• the privacy risk allocation: micro1's Data License Master Terms (updated 2026-11-08) have the licensor indemnify IP, privacy and publicity claims from the data, keep consent and release records 7 years after the agreement ends, and delete raw data at the earlier of 120 days after delivery completes or termination, with no duty to delete or retrain.

The last term matters because a seller carries privacy risk even for a copy it has de-identified. These terms are one part of the AI data licensing agreement clauses.

De-identify, License a Subset or Do Not License: Benefits, Risks, Downsides, Alternatives

De-identification lowers the privacy risk of a data license but does not remove it, so the decision is whether the remaining risk and the lost detail are worth the price.

Benefits

• Personal data is out of the delivered copy.
• Standards with legal effect exist: HIPAA de-identified data falls outside the Privacy Rule, and CCPA deidentified data falls outside personal information.
• Some programs carry the cost, as Mercor and Turing state.

Risks

• Re-identification remains possible, with 15 attributes enough in the 2019 estimate.
• Models already trained cannot be unlearned, so a late finding cannot be undone.
• A seller-side privacy indemnity, as in micro1's master terms, keeps liability with the licensor.

Downsides

• Lost detail lowers the usefulness of the data to the buyer.
• Staff time goes into sample review and testing.
• Employee risk may go unexamined: the Spirit ombudsman's footnote 3 states that risks to employees and third parties were not investigated.

Alternatives

• License a narrower subset.
• Exclude whole systems, as the Spirit debtors did with "in any form".
• Use an independent provider rather than the buyer, as in the Spirit sale.
• Do not license at all, which is a valid outcome.

The wider choice is set out in the page on should you sell or license your data, and no deadline applies to it.

Where PII Removal Sits in the Process to Sell or License Company Data

PII removal follows the inventory, rights audit and consent review and comes before valuation, the data manifest and any sample a buyer sees. The full sequence to sell or license company data to AI companies runs in this order:

1. Data inventory for an AI data sale
2. Rights audit
3. Customer consent and confidentiality clauses
4. PII removal and de-identification (this page)
5. What company data is worth
6. The data manifest
7. Samples and clean rooms
8. Security during an AI data sale

Buyer Programs Cited on This Page

The program statements above come from each program's own pages, checked November 9, 2026. Programs with a profile on this site are listed below; the others appear in the tables only.

• Handshake AI data buyer profile
• Mercor data buyer profile
• micro1 data buyer profile
• AI data partnership payouts and program terms compared

Frequently Asked Questions

What is data de-identification?

Data de-identification is removing or transforming identifiers in a dataset so its records can no longer reasonably be linked to a specific person. Under the CCPA, deidentified data also needs a public commitment not to re-identify and contractual duties on recipients (Cal. Civ. Code 1798.140(m)).

What is PII redaction?

PII redaction is deleting or blacking out personally identifiable information, such as names, phone numbers and account numbers, in text, documents, images or audio. It is one method of de-identification, and indirect identifiers can remain after redaction.

How is data deidentified?

Data is deidentified by finding identifiers, choosing a method for each, applying it and testing the result for re-identification. The methods are redaction, masking, pseudonymization, generalization and synthetic replacement, and a test matters because 15 demographic attributes can re-identify 99.98 % of Americans (Nature Communications, 2019-07-23).

Who pays for de-identification before a data license?

It depends on the program: Mercor and Turing state they cover the cost, the Spirit Airlines sale put it on the buyer, and Handshake does not say. No program or vendor publishes a price, and the statements were checked November 9, 2026.

What are the PHI identifiers?

HIPAA's Safe Harbor method lists 18 identifier types in 45 CFR 164.514(b)(2) that must be removed before health data counts as de-identified. ZIP codes are cut to three digits only where the area holds more than 20,000 people, and ages over 89 become 90 or older. The wider rules are covered under HIPAA and AI training data.