Does hashing make data anonymous under FTC guidance?

No, hashing a name, email address, or device ID does not meet the FTC's standard for anonymous data. The FTC requires that data be unlinkable to an individual, and a simple hash remains a reversible or searchable link. Below we explain what the FTC, HIPAA, and other U.S. privacy statutes expect, and how our de-identification service can keep you compliant.

What the FTC says about hashing

The FTC Act, section 5, prohibits deceptive privacy claims. The agency has made clear that "hashing an email address or device identifier does not make the data anonymous." A hash is deterministic: the same input always yields the same output. Because another dataset can contain the original values, a third party can match the hash back to a person. Claiming that hashed data is "anonymous" would therefore violate the FTC's rules.

How other U.S. laws define de-identification

HIPAA (45 CFR 164.514)

Health-care entities must use one of two methods to treat health information as not individually identifiable:

• Safe Harbor, remove 18 specific identifiers, including names, dates (except year), ZIP codes smaller than a state, phone numbers, email addresses, record numbers, device IDs, IP addresses, and facial photos. The entity must also have no actual knowledge that the remaining information could identify someone.
• Expert Determination, a qualified expert evaluates the risk that a person could be identified, either alone or when combined with other reasonably available data, and documents that the risk is very small.

California Consumer Privacy Act (CCPA) and CPRA (Civil Code 1798.100 et seq.)

California treats data as de-identified when it cannot be reasonably linked to a consumer, the business takes steps to prevent re-linking, and it publicly commits not to re-identify the data. A simple hash fails this test because it still allows linking across records.

Other state privacy statutes (Virginia, Colorado, Connecticut, Texas, etc.)

These laws use the same "reasonable likelihood of linkage" standard and often require a public promise not to re-identify the data. Deterministic hashes are generally insufficient.

Gramm-Leach-Bliley Act (GLBA) - Privacy Rule (16 CFR 313)

Financial institutions may share "blind" data that does not identify a consumer. The rule looks at whether any personal identifiers remain; a hash of an account number is still an identifier.

FERPA (34 CFR 99)

Educational institutions must strip all personally identifiable information from student records and make a reasonable determination that no student can be identified, taking into account other releases and publicly available data.

COPPA (16 CFR 312)

For children's online data, any persistent identifier, including a hash of a device ID, counts as personal information. Disclosure of such data requires parental consent unless the use is strictly for internal operations.

Need data de-identified to meet HIPAA, CCPA or GDPR? See how we do it

Why simple hashing falls short

A hash preserves the uniqueness of the original value. If an attacker obtains a list of known emails, they can hash each one and compare it to the hashed column you released. This "dictionary attack" can re-associate the hashed string with the real person. Because the FTC's test looks at the reasonableness of linking data, any method that leaves a stable, deterministic link fails the test. Even salted hashes can be vulnerable if the salt is known or applied uniformly across many records.

Our de-identification service

We offer a stand-alone de-identification service that follows the steps required by the laws above:

1. Mapping and legal scope, we identify which systems hold the data, the applicable statutes (HIPAA, CCPA, etc.), and the required level of de-identification.
2. Secure export, raw files are copied to an isolated, logged workspace. The original copies are deleted on a recorded date.
3. Automated cleaning, names, emails, phone numbers, and other identifiers are replaced with stable pseudonyms such as "employee 632." Dates, locations, and numbers are truncated where required.
4. Human review, trained reviewers check free-text fields for hidden identifiers and confirm that the automated process removed them.
5. Re-identification test, a separate reviewer attempts to link the cleaned data back to individuals using publicly available sources. The outcome is documented.
6. Delivery and record, you receive the de-identified dataset together with a written memo describing the methods, the legal basis, and the result of the re-identification test.

We quote each project after we understand your systems and data volume. In a brokered licensing deal, the AI lab buying the data usually pays for de-identification, but who does the work and who pays can be negotiated case-by-case. You will review a sample before any final acceptance. For more on how we handle the data after you close a deal, see our blog post on what happens to Slack, email and tickets after you close.

How to test your own data

Pick a column that contains an email address or device ID. Apply a cryptographic hash (for example, SHA-256) to each value, then search the internet or your own marketing lists for the original values. If you can match any hashed value back to a real person, the data remains linkable and therefore is not anonymous under the FTC, CCPA, or HIPAA standards. When you see easy re-linkage, you need a more thorough de-identification approach, removal of the identifier, generalization of dates, or an expert determination. You can also check an offer for how personal information will be removed by reviewing our offer checking guide.

For a detailed quote on how we can clean your data and keep you on the right side of the FTC, HIPAA, and state laws, click the button below.

Request a de-identification quote