How Virginia, Colorado and Texas define de-identified data

Under Virginia, Colorado and Texas privacy laws, data that cannot reasonably be linked to an individual is considered de-identified and is exempt from most consumer-privacy duties. The exemption depends on how thoroughly you strip identifiers and on a written promise not to re-identify the data.

The three state laws in plain terms

Virginia Consumer Data Protection Act (VCDPA): Virginia calls data de-identified when a reasonable person could not use the information, alone or together with other reasonably available data, to identify a consumer. If you document the de-identification steps and agree in writing not to attempt re-identification, the data falls outside the definition of personal data.

Colorado Privacy Act (CPA): Colorado uses the same "reasonable link" standard. The data is exempt if you remove direct identifiers and take reasonable steps to keep the remaining fields from being combined with other sources to reveal a resident. A written commitment not to re-identify is also required.

Texas Data Privacy and Security Act (TDPSA): Texas defines de-identified data as information that does not permit identification of an individual, either directly or by inference, when combined with other data that is reasonably available. Like the other two states, Texas exempts such data after you document the de-identification process and sign a contractual promise not to re-link the records.

All three statutes converge on one point: if a reasonable person cannot link the record to a specific person, the data is no longer "personal" for the purposes of the law.

How the test works in practice

1. Strip direct identifiers. Remove names, email addresses, phone numbers, Social Security numbers, driver-license numbers, precise geographic details smaller than a state, and any unique device IDs.
2. Assess residual risk. Ask whether someone could combine the leftover fields, say a job title, a small town, and a date, with publicly available information to pinpoint a person. If a reasonable person would say "no," the data passes the test.

A quick self-check you can run: take a sample of five records, redact the items in step 1, then try searching the remaining combination of fields online. If you cannot locate a specific individual, the sample likely satisfies the "reasonable link" standard used by Virginia, Colorado and Texas.

Need data de-identified to meet HIPAA, CCPA or GDPR? See how we do it

When HIPAA's rules also matter

If your company handles protected health information (PHI), the HIPAA de-identification standard (45 CFR 164.514) applies in addition to any state law. HIPAA offers two approved methods:

• Safe Harbor: Remove the 18 listed identifiers, including names, full dates (except the year), ZIP + 4, and device identifiers, and have no actual knowledge that the remaining data could identify someone.
• Expert Determination: Engage a qualified expert who documents that the risk of re-identification is very small.

Even when a dataset meets the state "reasonable link" test, HIPAA still requires one of these two methods before a covered entity can treat health data as de-identified. Our de-identification workflow is designed to satisfy both HIPAA and the state standards, so you can address all applicable rules in a single project.

Our de-identification service

We can run the full de-identification workflow for you. Learn more on our de-identification service page.

Our process maps the systems that hold the data, identifies the applicable laws, exports the raw files to a secure, logged workspace, and deletes the originals on a recorded date. Names are replaced with stable placeholders such as "employee 632," the key is destroyed, and dates, locations and numbers are redacted as required. Trained human reviewers verify that free-text fields contain no hidden identifiers, and a re-identification check using the "reasonable link" test is performed. A written record of the results is then provided.

The de-identification work is billed as a separate project; we quote after we understand your systems and volume. In most licensing deals the AI lab that buys the data pays for the de-identification, but the exact arrangement is negotiated case-by-case.

Request a de-identification quote

Press the button below to start a quote request. We will ask a few basic questions, prepare a one-page summary of your answers, and then present you with the best offers from vetted AI labs. No data moves until you approve the final terms, and you retain full ownership of your company data. For details on U.S. privacy rules see the U.S. privacy page.

Request a de-identification quote