&quot;We only collect anonymized data&quot;. Roughly what are the limits of this?
<p>Say a program that Bob is using asks to collect &quot;anonymized data&quot;. Bob agrees. But roughly at what point is &quot;anonymized&quot; a false statement?</p>
<p>If I have Bob's shopping habits, gendre, device make, ip address/general location area, etc.; at some point, it's more than enough to uniquely identify Bob. In fact, I remember coming across plenty of academic literature about the subject back in 2015 (<a href="https://en.wikipedia.org/wiki/Data_re-identification" rel="nofollow noreferrer">relevant wiki link</a>)</p>
<p>My question is: are there definitive rulings/laws on the matter? It's definitely a gray area, but I'd like to know any concrete law/legislation surrounding it. Especially in the jurisdiction of the USA, and California in particular.</p>

<p>Assuming that you are referring to online data collection, &quot;personal information&quot; is defined in California in <a href="https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&amp;part=4.&amp;lawCode=CIV&amp;title=1.81.5" rel="nofollow noreferrer">Cal. Civ 1798.140</a> as</p>
<blockquote>
<p>information that identifies, relates to,
describes, is reasonably capable of being associated with, or could
reasonably be linked, directly or indirectly, with a particular
consumer or household. Personal information includes, but is not
limited to, the following if it identifies, relates to, describes, is
reasonably capable of being associated with, or could be reasonably
linked, directly or indirectly, with a particular consumer or
household:</p>
<p>(A) Identifiers such as a real name, alias, postal address, unique
personal identifier, online identifier, Internet Protocol address,
email address, account name, social security number, driver’s license
number, passport number, or other similar identifiers.</p>
<p>(B) Any personal information described in subdivision (e) of Section
1798.80.</p>
<p>(C) Characteristics of protected classifications under California or
federal law.</p>
<p>(D) Commercial information, including records of personal property,
products or services purchased, obtained, or considered, or other
purchasing or consuming histories or tendencies.</p>
<p>(E) Biometric information.</p>
<p>(F) Internet or other electronic network activity information,
including, but not limited to, browsing history, search history, and
information regarding a consumer’s interaction with an internet
website application, or advertisement.</p>
<p>(G) Geolocation data.</p>
<p>(H) Audio, electronic, visual, thermal, olfactory, or similar
information.</p>
<p>(I) Professional or employment-related information.</p>
<p>(J) Education information, defined as information that is not publicly
available personally identifiable information as defined in the Family
Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R.
Part 99).</p>
<p>(K) Inferences drawn from any of the information identified in this
subdivision to create a profile about a consumer reflecting the
consumer’s preferences, characteristics, psychological trends,
predispositions, behavior, attitudes, intelligence, abilities, and
aptitudes.</p>
<p>(L) Sensitive personal information.</p>
</blockquote>
<p>But also, it &quot;does not include consumer information that is deidentified or aggregate consumer information&quot;. To answer the next question,</p>
<blockquote>
<p>“Deidentified” means information that cannot reasonably be used to
infer information about, or otherwise be linked to, a particular
consumer provided that the business that possesses the information:</p>
<p>(1) Takes reasonable measures to ensure that the information cannot be
associated with a consumer or household.</p>
<p>(2) Publicly commits to maintain and use the information in
deidentified form and not to attempt to reidentify the information,
except that the business may attempt to reidentify the information
solely for the purpose of determining whether its deidentification
processes satisfy the requirements of this subdivision.</p>
<p>(3) Contractually obligates any recipients of the information to
comply with all provisions of this subdivision.</p>
</blockquote>
<p>The conspicuous lack of &quot;and&quot; or &quot;or&quot; in these clauses raises a red flag, in case the AG deems that all three conditions must be met to qualify as &quot;deidentified&quot;</p>

united-states privacy california data anonymization