What Is Anonymization vs. Pseudonymization?

Anonymization irreversibly strips data of any way to link it back to an individual, placing it outside the scope of privacy laws like GDPR entirely. Pseudonymization, which includes techniques like hashing, replaces identifying data with a reversible or matchable substitute, and remains legally classified as personal data because re-identification is still possible.

This distinction is where a lot of well-intentioned privacy engineering go wrong. Teams frequently believe they’ve anonymized data when they’ve only pseudonymized it: Hashing (Privacy Context) an email is the clearest example, since the same email always produces the same hash, which is precisely what makes it useful for ad matching and precisely why it’s still personal data. True anonymization is a much higher bar than most implementations reach.