By Asha Geire (originally published under The Traveling Privacy Lawyer blog on Substack on May 26, 2026)
The logic that nameless data is safe data has been the operating assumption of the modern information economy for the better part of two decades. That assumption may soon be under pressure, and data-driven companies should take notice.
Two independent factors are converging to weaken the legal proposition that anonymized behavioral data is not personal data. The first is commercial: it concerns what the data is used for and who benefits. The second is technical: it concerns what can now be done with the data after it leaves the building. Together, they suggest the anonymization defense is more fragile than most compliance frameworks assume.
Factor One: Anonymized Data Retains Its Commercial Connection to the Individual
When behavioral data is collected at scale and sold after anonymization, the companies doing the selling characterize the transaction as providing a neutral analytical service. The FTC may push back on that framing in the future.
Behavioral datasets record how people move through apps, where they hesitate, what holds their attention, and when they disengage. That data carries genuine commercial value derived directly from individuals’ activity. The value does not disappear when identifiers are removed. It is precisely because the data reflects real human behavior, at the individual level, that it is worth purchasing. The anonymization step is the mechanism companies use to convert that personal experience into a tradable commodity while maintaining that no personal information changed hands. The FTC’s emerging position is that this characterization does not survive scrutiny of the full transaction.
The FTC’s 2022 settlement with Epic Games is instructive. The resolution found that Epic had collected personal information from children under 13 without verifiable parental consent and had failed to give parents meaningful ability to review or delete their children’s data. The COPPA violations alone carried a $275 million penalty, part of a combined $520 million settlement. The case was not specifically about anonymized behavioral data, but it demonstrated the FTC’s willingness to examine the full data pipeline: what was collected, from whom, how was the data used, and whether consent was genuine. That is a materially different posture than asking only whether the right fields were removed before sale.
The proposed FTC rule changes on children’s data, floated in 2024, made the doctrinal direction more explicit. The proposals cover data minimization, restrictions on secondary commercial use, and narrowed exceptions for internal analytics. They reflect a regulatory framework being built around the premise that collection is the relevant legal event, not the anonymization procedure that follows it. The FTC has stated in accompanying commentary that the commercial value derived from behavioral data, and the reasonable expectations of the individuals who generated it, are factors informing the proposed rules. The anonymization step, in this framing, does not sever the legal relationship between the data and the person.
Factor Two: Advances in Re-identification Capabilities Are Closing the Gap Between Anonymous and Identifiable
Separately, and independently, the technical case for anonymization as reliable privacy protection has been eroding for nearly two decades.
In 2006, Netflix released what it called an anonymous dataset of 100 million movie ratings as part of a machine learning competition. Within weeks, two researchers at UT Austin re-identified specific users by cross-referencing the data with public IMDb reviews using standard statistical methods, with no proprietary access required. The finding has since been replicated across location data, medical records, browsing histories, and purchase sequences. The consistent conclusion is that behavioral data, at sufficient granularity, does not need a name attached to it to identify the person who generated it. The pattern itself is the fingerprint. AI and improving analytical tools have made this easier, not harder, in the years since.
Children’s data is particularly exposed. A child exists in a small, legible world: a specific grade, a specific school district, a household with siblings of known ages. Behavioral signatures narrow quickly in that context, and the gap between anonymized and re-identifiable is considerably shorter than in adult population datasets, regardless of how carefully the anonymization procedure was followed. This is not a failure of execution. It is a structural property of small, identifiable populations.
Regulators are incorporating this technical reality into their frameworks. The FTC’s 2024 proposed rules explicitly reference the capacity of current technology to combine datasets and re-identify individuals as a factor informing the rulemaking. That is a direct acknowledgment that the anonymization defense is being stress-tested at the policy level, not just in academic literature. The relevant question is no longer whether anonymization was performed correctly. It is whether anonymization, correctly performed, continues to achieve what the legal defense requires it to achieve.
The Netflix re-identification paper was published in 2008. The industry has had nearly two decades to treat that finding as a structural problem rather than an academic curiosity. Some companies did. Many more built business models that depend on the legal definition holding.
What Companies Should Do Now
Given where enforcement and technology are both headed, companies would be well advised to stress-test their anonymized datasets against current re-identification methods. Those collecting and monetizing behavioral data, particularly children’s data, should also examine whether their data pipeline, viewed as a whole, can withstand the kind of scrutiny the FTC applied in Epic: not just whether the right fields were removed, but what was collected, from whom, for whose commercial benefit, and whether the people who generated the data had any meaningful understanding of the transaction.
The gap between what a privacy policy describes and what the data pipeline actually does has historically been where enforcement begins.
**Disclaimer: This newsletter is for informational purposes only. It is not legal advice, and reading it does not create an attorney-client relationship. Consult a qualified attorney before making decisions based on anything published here.**