The Federal Trade Commission on Monday warned
companies against incorrectly asserting that the data they collect is either anonymous or has been anonymized.
“Companies that make false claims about anonymization can expect to hear
from the FTC,” Kristin Cohen, acting associate director for the division of privacy and identity protection, wrote in a post on the agency's business blog.
“Companies
may try to placate consumers’ privacy concerns by claiming they anonymize or aggregate data,” Cohen wrote. “Firms making claims about anonymization should be on guard that these
claims can be a deceptive trade practice and violate the FTC Act when untrue.”
She pointed to research showing that anonymized data can be re-identified, writing: “One set of
researchers demonstrated that, in some instances, it was possible to uniquely identify 95% of a dataset of 1.5 million individuals using four location points with timestamps.”
Many data
brokers and web companies have historically represented that they dealt in “anonymized” information about users.
But privacy advocates have long argued that the information
compiled and shared by data brokers has clues to people's identities.
“Data brokers sell rich profiles with more than enough information to link sensitive data to real people, even if
the brokers don’t include a legal name,” the digital rights group Electronic Frontier Foundation wrote last
year.
“In particular, there’s no such thing as 'anonymous' location data,” the organization added. “Data points like one’s home or workplace are identifiers
themselves, and a malicious observer can connect movements to these and other destinations.”
The FTC's warning about anonymization claims comes in a broader post about sensitive health
and location data. The new post also comes just days after President Joe Biden urged the FTC to consider taking steps that would protect the privacy of
consumers who seek information about reproductive healthcare.
“The misuse of mobile location and health information -- including reproductive health data -- exposes consumers to
significant harm,” Cohen wrote. “The exposure of health information and medical conditions, especially data related to sexual activity or reproductive health, may subject people to
discrimination, stigma, mental anguish, or other serious harms. Those are just a few of the potential injuries -- harms that are exacerbated by the exploitation of information gleaned through
commercial surveillance.”