De-identified data under CCPA vs anonymous data under GDPR

Answer: Under the California Consumer Privacy Act, "de-identified personal information" is data that a reasonable person cannot link to a consumer after the direct identifiers have been removed. The GDPR calls data "anonymous" only when no person can be identified by any means, direct or indirect, and treats such data as outside the regulation. Because the CCPA threshold is lower, you often need tighter safeguards to satisfy the EU standard.

What CCPA calls de-identified personal information

California Civil Code §1798.140(o) says the data must have all direct identifiers stripped, names, email addresses, phone numbers, and the like. It also requires that the remaining information be processed so that a reasonable person could not re-identify a consumer by combining it with other data. Finally, the seller must keep a written assessment that the de-identification method is reasonable under the circumstances.

Reasonable is a flexible test. You can rely on industry-accepted techniques such as hashing, tokenisation, or aggregation, but you must be able to show that an average attacker could not reverse the process. The CCPA still treats the resulting set as personal information for certain purposes, for example if it later gets combined with other data that restores identity.

What GDPR calls anonymous data

Recital 26 of the GDPR defines anonymity as data that cannot be used to identify an individual, directly or indirectly, even when all available information is considered. When the data meets that definition, it falls completely outside the GDPR and no privacy obligations apply.

The GDPR's "all-available-information" test means the holder must evaluate every conceivable source that could be combined with the dataset. If any realistic scenario could lead to identification, the data is only pseudonymised and remains subject to the regulation.

Need data de-identified to meet HIPAA, CCPA or GDPR? See how we do it

How the standards affect your licensing or sharing plans

Aspect	CCPA de-identification	GDPR anonymity
Identification risk test	Reasonable-means test	All-available-information test
Treated as personal data after de-identification?	Yes, for some uses	No, if truly anonymous
Need for a written assessment	Required by statute	Not required, but good practice
Impact on data-licensing deals	Buyers may accept de-identified data for AI training, but may request additional GDPR-style review for EU customers	Buyers often demand fully anonymous data; otherwise they negotiate data-use restrictions

If you plan to license your company data to AI labs, the CCPA approach lets you move faster, but buyers serving EU customers will likely ask for a GDPR-style review. Meeting the GDPR anonymity bar gives you the cleanest legal footing worldwide, though it can reduce the amount of usable information. You can read more about licensing steps on our sell page.

Steps we take to produce de-identified data

When you request a quote through our de-identification service, we follow a transparent, auditable workflow:

1. Map your systems and applicable regulations. We identify which rules (HIPAA, CCPA, GDPR, etc.) apply to each data source.
2. Export to a secure, logged workspace. Raw copies are kept only for a recorded period, then deleted.
3. Replace direct identifiers with stable placeholders. Names become "employee 632", IDs become random strings. The key that links placeholders to real identities is destroyed.
4. Trim dates, locations and numbers. We apply the minimum-necessary reduction required by each law.
5. Human review. Trained reviewers read free-text fields to catch anything the automated tools missed.
6. Re-identification test. A separate analyst, who did not perform the cleaning, attempts to re-identify a sample. Their findings are documented and shared with you.

The de-identification service is billed as a separate project; we quote the cost after we understand the volume and the systems involved. In most licensing deals the AI lab that buys the data covers the de-identification fee, but the exact arrangement is negotiated case by case. You keep ownership of your operating records and can continue to use them internally.

A quick self-check before you ask for a quote

• Do you have at least 30 full-time employees? That is the minimum size we work with.
• Which types of data do you want to clean? Typical candidates include support tickets with resolutions, chat threads that show decision points, CRM activity logs, SOPs, knowledge-base articles, QA records, project histories and accounting exports.
• How many years of continuous history do you have on the same tools? Longer histories usually increase value and may affect the de-identification effort.

If you can answer these questions, you are ready to move forward. The next step is to click the button below and request a de-identification quote. We will send you a short questionnaire; no data moves until you approve the quote and the handling terms.

Request a de-identification quote

Why the distinction matters for compliance officers

A compliance officer who relies only on the CCPA definition may underestimate the risk of indirect re-identification when the same dataset is used in the EU. GDPR's stricter test can expose you to enforcement if a regulator finds that a "de-identified" set could still be linked to an individual. By following our rigorous workflow, you produce a dataset that satisfies the CCPA reasonable-means test and, when you add the extra trimming steps, also meets the GDPR all-available-information test. This dual compliance makes your data attractive to a broader pool of AI labs while protecting you from cross-border privacy pitfalls.