Anonymity-washing

TL;DR

This paper highlights the issue of anonymity-washing, where the perceived privacy protection of data is misrepresented, and calls for clearer guidance and cooperation to address this growing concern.

Contribution

It provides a comprehensive overview of anonymity-washing, synthesizing legal and technical perspectives, and offers recommendations to improve data anonymization practices.

Findings

Lack of coherent support for practitioners

Misuse of pseudonymization and outdated techniques

Need for clearer technical guidance and regulation

Abstract

Anonymization is a foundational principle of data privacy regulation, yet its practical application remains riddled with ambiguity and inconsistency. This paper introduces the concept of anonymity-washing -- the misrepresentation of the anonymity level of ``sanitized'' personal data -- as a critical privacy concern. While both legal and technical critiques of anonymization exist, they tend to address isolated aspects of the problem. In contrast, this paper offers a comprehensive overview of the conditions that enable anonymity-washing. It synthesizes fragmented legal interpretations, technical misunderstandings, and outdated regulatory guidance and complements them with a systematic review of national and international resources, including legal cases, data protection authority guidelines, and technical documentation. Our findings reveal a lack of coherent support for practitioners, contributing to the persistent misuse of pseudonymization and obsolete anonymization techniques. We conclude by recommending targeted education, clearer technical guidance, and closer cooperation between regulators, researchers, and industry to bridge the gap between legal norms and technical reality.