Data brokers and online ad companies should avoid claiming that the data they collect or transfer is “anonymous” if there is any chance that the data could be linked to an individual.
That's according to the Federal Trade Commission, which signaled Wednesday that it will continue to scrutinize companies' disclosures about privacy -- including statements by businesses that they “anonymize” data when, in actuality, they merely assign pseudonyms to consumers.
The agency specifically debunks claims that companies can anonymize personal data by “hashing” -- which involves using algorithms to convert people's names or email addresses into alphanumeric sequences.
Those alphanumeric strings, comparable to serial numbers, “aren’t 'anonymous' and can still be used to identify users, and their misuse can lead to harm,” agency staff said in a technology blog post.
advertisement
advertisement
“All user identifiers have the powerful capability to identify and track people over time, therefore the opacity of an identifier cannot be an excuse for improper use or disclosure,” the post states.
“Companies should not act or claim as if hashing personal information renders it anonymized,” the agency wrote. “FTC staff will remain vigilant to ensure companies are following the law and take action when the privacy claims they make are deceptive.”
The FTC has alleged in enforcement actions that pseudonymous information -- such as mobile device identifiers -- can identify users.
Most of those cases have settled, but at least one case currently in court -- a complaint by the FTC against the mobile data broker Kochava -- could result in a definitive ruling about pseudonymous identifiers.
In that matter, the FTC alleged that Kochava engaged in an unfair practice by selling precise geolocation data as well as mobile advertising IDs -- unique, 32-character identifiers that persist, unless consumers proactively reset them.
Kochava has always countered that the data at issue isn't “personally identifiable.” (The company has also raised other arguments, including that the allegations against it, even if proven true, wouldn't support a finding that it engaged in unfair acts.)
Earlier this year, U.S. District Court Judge B. Lynn Winmill in the Northern District of Idaho rejected Kochava's bid to dismiss the case before trial. The matter remains pending in front of Winmill.