Dark console-style card reading Can Anonymous AI Data Ever Be Anonymous? You Have Until 30 October

Can “Anonymous” AI Data Ever Be Anonymous? You Have Until 30 October

by
Reading Time: 5 minutes

Toh phir, if your data was “anonymised” before it trained a model, who gets to decide it really is?

Anonymous data is the magic phrase of AI. Europe is rewriting what it means right now, and you are allowed to weigh in.

🔑 The Word That Carries the Weight

Here is why the word matters so much.

Under the EU’s GDPR, personal data is regulated. Anonymous data is not. The EDPB, the body of Europe’s data protection regulators, says so in plain terms in its new draft: anonymous data is not subject to the GDPR, which gives organisations greater freedom to use it.

So “we anonymised it” is a very convenient sentence. It can unlock datasets for research, analytics and AI training that would otherwise be locked down.

That also means the definition of “anonymised” is where the real power sits.

📜 The Draft: What It Actually Says

In July 2026, the EDPB adopted draft Guidelines 02/2026 on Anonymisation for public consultation. They replace a 2014 opinion from the older Article 29 Working Party, and the draft itself says why: the law, the case law and the technology, including AI, have all moved on since then.

The core test is three questions about a dataset:

  1. No record isolation. Can anyone single out one person’s record?
  2. No linkage. Can the data be matched with other data to find a person?
  3. No inference. Can anyone draw a specific, meaningful conclusion about an individual from it?

If all three hold, the data can be treated as anonymous. If one fails, the analysis continues, but the easy “it’s fine” is gone.

Two details change how you should read any “anonymised” claim:

  • Who is looking matters. The draft offers a contextual approach, which takes account of what different parties could actually do, and a simplified approach, which ignores those differences and is more conservative. It is also why the same dataset can be anonymous for one holder and personal for another.
  • “Means” is meant broadly. The draft counts anything from reading a document to running a web search to running complex analyses, and it considers how a “chain” of means across different parties could come together.

📌 Real-World Case: When “Anonymous” Was Not

None of this is a purely European worry. The classic proof is older than most AI tools.

📌 Real-world case: A paper first posted in 2006 by Arvind Narayanan and Vitaly Shmatikov tested the Netflix Prize dataset, which held “anonymous” movie ratings from about 500,000 subscribers. Using public IMDb reviews as background knowledge, they showed that an attacker who knew only a little about a subscriber could pick out that person’s record. (arXiv)

Names had been removed. The people were still findable, because the pattern of what they rated was itself a fingerprint.

That is exactly what the linkage and inference criteria are built to catch.

The draft has its own everyday example. A company runs an “anonymous” team survey and tells a manager only the totals. If everyone took part and nobody scored above 3, the manager can infer that the whole team is critical. The data was aggregated, but it still told the manager something about each person.

🤖 And What About AI Models?

Sach batao, this is the question most readers actually have: does the draft say anything about models trained on data?

Yes, but carefully. It notes that inferences can be drawn from aggregated data such as AI models and synthetic data. A person can query, or in the case of AI models prompt, the data with extra information to draw out something about a specific individual. If that inference is specific and meaningful, the No Inference criterion is violated. The draft also mentions attacks that can extract data from supposedly anonymous AI models, and points to the EDPB’s separate Opinion 28/2024 on AI models.

That opinion, adopted in December 2024 at the request of Ireland’s data protection authority, takes a case-by-case view. A model trained on personal data is anonymous only if both of two risks are insignificant: that personal data can be extracted from the model, and that it can be obtained through queries. (Hunton)

Notice what the draft does not do. It does not declare that all trained models are personal data, and it does not declare that they are anonymous. It gives you a test.

There is one more inference type in the draft that fits AI neatly: membership inference. The idea is that you can sometimes tell whether a particular person’s data was in the original dataset at all. The draft’s own example is a “supposedly anonymous” dataset about a rowing club, where analysing certain attributes reveals that one named member was included, and therefore belongs to the club.

Swap “rowing club” for any sensitive list, and you can see why regulators care about this question for training data.

🕸️ The Companion Draft on Web Scraping

The anonymisation draft did not arrive alone. In the same July 2026 release, the EDPB also adopted guidelines on web scraping in the context of generative AI, open for consultation until the same 30 October date. They say the GDPR applies when scraping involves personal data operations such as collection and storage, flag purpose limitation and transparency as areas needing particular attention, and give examples of using legitimate interest as a legal basis for AI training, building on the Opinion on AI models. (EDPB news release)

I have not read that second document closely, so treat this as a pointer, not an analysis. But the pairing is the point. One text asks when is data safe to use freely? The other asks how may you collect it in the first place? Together they sketch the rules for the front door and the back door of an AI training set.

🔧 Anonymising Is Itself a Job

One more detail is easy to miss, and it matters for anyone who builds with data.

The draft says the act of anonymising is itself processing of personal data. So it needs a legal basis, and organisations should document what they did and why it works. It also warns that a security incident can force a reassessment, for example if the anonymity relied on some information staying secret and that information leaks.

Two more points sit in the same neighbourhood:

  • A contract that bans re-identification does not count as a legal prohibition. It can help, but only alongside technical measures, because contracts can be changed or ignored.
  • The likelihood of re-identification typically rises over time as technology advances.

Put together, the message is that anonymity is a state you have to keep checking, not a stamp you apply once.

🪙 Token Truth

Anonymous is a claim about an attacker, not about a dataset.

A dataset is never anonymous on its own. It is anonymous against someone with certain data, tools and patience. Change the attacker, the extra data or the year, and the answer can change. That is the same trap behind most easy-to-count AI numbers: the label sounds like a fact, and it is really an assumption. (If you want that thread, start with Episode 1 of The Token Diaries.)

✍️ You Can Comment, Until 30 October

Seedhi baat: this draft is still open for feedback, and you do not need to be a lawyer to use that.

The consultation runs from 8 July to 30 October 2026, closing at 23:59 CET. You submit through the online form on the EDPB’s consultation page. There is also a short companion document, “Guidelines at a Glance: how to assess the anonymity of data”. Comments are published on the EDPB website, though you can choose not to have your name and affiliation shown. (EDPB consultation page)

Useful input for a non-specialist is concrete: real examples where “anonymised” data turned out to be re-identifiable, or definitions that would be hard to apply in practice.

🔎 How to Read the Next “Anonymised” Claim

Three quick checks:

  1. Against whom? Who is the assumed attacker, and what could they realistically combine the data with?
  2. Still true? Has anyone re-tested since the technology or the data around it changed?
  3. Who maintains it? Is anonymity treated as a process with documentation, or a one-off label?

None of this means every dataset is secretly personal. It means the word deserves a follow-up question.

If a company told you your data was “anonymised” before using it to train an AI model, what would you want to know before believing it?

📚 References

What’s your Reaction?
+1
0
+1
0
+1
0
+1
0
+1
0
+1
0
+1
0