Quasi-Identifiers in Research Data: Why Removing Names Does Not Anonymise a Study (2026)

TL;DR: Deleting the name column does not anonymise a research dataset. The identifier is not any single field; it is the combination of screener answers you kept. Sweeney's 1990 census study found that 87% of the US population was uniquely identified by just {5-digit ZIP, gender, date of birth}, and Golle's 2000-census replication put the same figure at 63.3%. A 120-person study segmented on role, company size, industry, country and tenure has roughly 11,520 possible profiles for 120 people, so almost every respondent sits alone in their own cell. The fix is not more redaction of quotes; it is measuring the uniqueness of your quasi-identifier set with a single GROUP BY before you publish anything.

The identifier is the combination, not the field

Every research team knows to strip names and email addresses before sharing a study. Almost none of them measure what is left.

What is left, in a typical B2B study, is a screener: role, seniority, company size band, industry, country, tenure with the product, plan tier. Individually, none of those is personal data in any intuitive sense. Thousands of people are "Director of Engineering." Thousands work at companies of 201-500 people. Thousands are in fintech.

But almost nobody is all three at once in your dataset, and that is the only population that matters. A field that identifies nobody on its own can identify everybody in combination. This is the concept Latanya Sweeney formalised as the quasi-identifier, defined in her 2000 Carnegie Mellon working paper as "a set of data elements in entity-specific data that in combination associates uniquely or almost uniquely to an entity and therefore can serve as a means of directly or indirectly recognizing the specific entity that is the subject of the data."

The word doing the work there is combination. Anonymisation reviews that go field by field cannot see it, because the risk does not live in any field. It lives in the cross-product.

The number that should end the argument

Sweeney ran the experiment on 1990 US Census summary data. Her abstract reports that "87% (216 million of 248 million) of the population in the United States had reported characteristics that likely made them unique based only on {5-digit ZIP, gender, date of birth}." Coarsening the geography helped, but less than you would hope: at the level of city or town, "About half of the U.S. population (132 million of 248 million or 53%) are likely to be uniquely identified by only {place, gender, date of birth}," and at county level the figure was still 18%.

Six years later Philippe Golle re-ran the study on the 2000 census and got a materially different headline. His paper reports that "in 1990 (resp. 2000), only 61% (resp. 63%) of the US population was uniquely identifiable by {gender, ZIP code, full date of birth}," against Sweeney's 87%, and notes candidly that "we lack detailed information about the methodology and data collection of [10], so we can offer no definite explanation for this discrepancy."

Cite the smaller number. It is the better-documented one, and it is still catastrophic: on a 2000-census basis, roughly three Americans in five are unique on three fields that nobody thinks of as identifying.

Golle's Table 1 is the more useful artefact anyway, because it shows the gradient. The fraction of the US population uniquely identifiable by {gender, location, date of birth} was:

Read the top row from right to left. Dropping the day from a date of birth takes uniqueness from 63.3% to 4.2%. That single act of coarsening does more for privacy than any amount of careful quote redaction, and it costs almost nothing analytically, because no research question in the world depends on knowing a respondent's birthday.

Your screener is a quasi-identifier set

Here is the version that applies to your study rather than to the census.

Suppose you run a 120-respondent study and your intake collects five segmentation fields: role (6 values), company size band (5), industry (8), country (12) and tenure band (4). That is 6 x 5 x 8 x 12 x 4 = 11,520 distinct profiles for 120 people.

Under a uniform allocation model, the expected number of respondents who are alone in their profile is n(1 - 1/C)^(n-1). Run it down the ladder:

Two honest caveats about that table. First, it is a model, not a measurement of your data. Second, uniform allocation is the pessimistic case: spreading people evenly across cells maximises the number of singletons. We checked this by simulation on the 240-cell row - uniform allocation produced 73.0 singletons, a Zipf-skewed allocation produced 39.7, and an allocation with half the sample piled into one cell produced 46.8. Real screener data is skewed, so your true uniqueness will usually be lower than the table says.

That caveat cuts both ways, though. It means the table is not a substitute for the measurement. It is an argument for doing the measurement, which takes one query:

Group your respondent table by the exact set of fields that will appear in the deliverable, count rows per group, and look at how many groups have a count of 1.

If that number is not close to zero, your "anonymised" export is a list of individually identifiable people with the names temporarily hidden.

What the regulators actually codify

Two of the most-copied de-identification standards in the world are the two implementation specifications in the US HIPAA Privacy Rule at 45 CFR 164.514(b), and they are worth reading even if you are nowhere near health data, because they are the clearest statement of the two available strategies.

Expert Determination, at (b)(1), turns on the judgement of a qualified person - in the regulation's words, "A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable" - who "determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual." Note "in combination with other reasonably available information" - the standard is explicitly about the join, not about the file.

Safe Harbor, at (b)(2), takes the opposite approach: a list of 18 categories of identifier that must be removed, no judgement required. Two entries on that list are the direct descendants of Sweeney's work:

• (B) "All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code" - and even the three-digit ZIP is zeroed out for any such area covering "20,000 or fewer people."
• (C) "All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death" - plus a requirement that "all ages over 89" be collapsed into a single "age 90 or older" category.

That is Golle's Table 1 turned into law. Coarsen the geography, drop the day and the month, cap the tail of the age distribution.

One more entry on the Safe Harbor list matters specifically to modern research tooling: (P) "Biometric identifiers, including finger and voice prints." If you run voice interviews, the raw audio is an identifier in its own right, regardless of what was said in it. Transcripts and audio need different retention policies for that reason alone.

Where this bites in customer research specifically

Three failure modes recur, and none of them is caught by a name-and-email scrub.

The over-collected screener. Teams collect segmentation fields in case we want to cut by that later, then cut by two of them and export all seven. Every unused field is pure re-identification risk with zero analytical return. Collect what the research question needs; the research brief is the right place to decide that, before intake, not after.

The identifying verbatim. A quote that names no one can still be unique. When we migrated off Oracle last spring after the acquisition closed identifies exactly one company to anyone in that market. Quote-level review is necessary, but it is a different control from quasi-identifier management, and teams routinely do the first and skip the second.

The tiny published cell. Someone drops a chart into a board deck with a bar labelled "Enterprise, APAC (n=2)." The bar is the disclosure. This is the problem that k-anonymity exists to solve - and, as it turns out, the obvious fix of hiding the small bar has its own failure mode, while a run of individually safe charts has another one again.

How Koji changes the shape of this problem

Koji is an AI-native research platform: an AI interviewer runs conversational voice or text interviews, asks its own follow-up questions, and produces analysed reports without a human moderator in the room. That architecture touches quasi-identifier risk at three specific points.

Structured questions make the quasi-identifier set explicit. Koji supports six structured question types alongside free conversation - open_ended, scale, single_choice, multiple_choice, ranking and yes_no - and each one carries a stable question ID from the interview plan through analysis into report aggregation. That matters here because it means your segmentation fields are enumerable. You can look at a study and say exactly which fields form the quasi-identifier set, rather than reverse-engineering it out of a spreadsheet someone exported in March. A traditional survey tool gives you a flat CSV and leaves the inventory to you.

Coarse-by-default option sets. Because single_choice questions declare their options up front, the decision to offer "201-500 employees" rather than a free-text headcount is a design-time decision that is visible in the study configuration and reviewable before a single interview runs. Coarsening after the fact is redaction; coarsening at design time is data minimisation, and only one of those is defensible to a privacy reviewer.

The interview does the probing, so the screener does not have to. The strongest driver of over-collection is the fear of missing context, which pushes teams to collect a dozen intake fields "just in case." Koji's AI asks up to three follow-ups per question based on what the respondent actually said, which means the depth comes from the conversation rather than from the demographic grid. Fewer intake fields, better context - that is a genuine reduction in identifiability, not a trade against insight.

None of this makes the determination for you. Koji is a processor of the data you choose to collect; the decision about which fields belong in an export is yours. What the platform can do is make the set visible, keep it small by default, and keep the audio, the transcript and the aggregate report on separate access paths.

A working checklist

1. Enumerate the quasi-identifier set. List every field that will appear in the deliverable and that a reader could plausibly know about a respondent from another source. That last clause is the test, and it is the one in the HIPAA Expert Determination language.
2. Measure uniqueness on your actual table. One GROUP BY over that field set. Count the groups of size 1.
3. Coarsen before you suppress. Golle's table says granularity is the biggest single lever. Bands beat exact values; regions beat countries; year beats full date.
4. Set a floor for published cells and enforce it in the report template, not in a reviewer's memory.
5. Treat audio as an identifier, not as a container for one, and give it its own retention window.
6. Re-run step 2 after every export, because the field set drifts as analysts add cuts.

The point of all six steps is to move anonymisation from a judgement call made under deadline pressure to a number you can compute. Sweeney's contribution was not really the 87%. It was the demonstration that identifiability is measurable at all.

Frequently asked questions

Does removing names and email addresses anonymise research data?

No. Direct identifiers are the easy part. Sweeney's census work showed that 87% of the 1990 US population was unique on {5-digit ZIP, gender, date of birth} alone, and Golle's 2000-census replication still found 63.3%. In a research context, a screener carrying role, company size, industry and country will usually make most of your respondents unique within your own dataset, whether or not their name is attached.

What is a quasi-identifier in customer research?

Any set of fields that, in combination, singles out a respondent - typically your screener and segmentation variables. Sweeney's informal definition is "a set of data elements in entity-specific data that in combination associates uniquely or almost uniquely to an entity." Job title, seniority, company size band, industry, region, tenure and plan tier are the usual suspects in B2B research.

How do I measure re-identification risk in my own study?

Group your respondent table by the exact field set that will appear in the deliverable and count rows per group. Groups of size 1 are re-identifiable records. This is the only measurement that matters, because risk is a property of your data, not of a general statistic about the population.

Is HIPAA Safe Harbor relevant if I do not handle health data?

Legally, no. Practically, it is the most useful checklist available, because 45 CFR 164.514(b)(2) enumerates 18 identifier categories and encodes the two big coarsening levers - geography no finer than a three-digit ZIP covering more than 20,000 people, and dates reduced to year with ages over 89 capped. Borrowing that structure gives you a defensible default without inventing one.

Do voice interviews create extra identifiability risk?

Yes, and it is explicit in the regulation: 45 CFR 164.514(b)(2)(i)(P) lists "Biometric identifiers, including finger and voice prints" among the identifiers Safe Harbor requires you to remove. A voice recording identifies the speaker independently of its content, so audio needs a shorter retention window and tighter access controls than the transcript derived from it.

Should I collect fewer screener fields?

Almost certainly. Every extra field multiplies the number of distinct profiles, and uniqueness climbs fast: in the worked example above, five fields produce 11,520 profiles for 120 people and leave 99% of respondents unique, while three fields produce 240 profiles and leave 61%. Fields you do not analyse are pure risk. Decide the segmentation plan in the brief and collect to it.

Related Resources

• Anonymizing Customer Interview Data - the hygiene playbook that sits upstream of this measurement: intake minimisation, participant codes, quote review and retention windows.
• k-Anonymity for Segment Reporting - the operational rule for how small a published segment may be, and why generalisation beats suppression.
• The Differencing Attack - why hiding the small cell and publishing the total discloses the cell exactly.
• Structured Questions in AI Interviews - the six question types, and why an explicit question schema makes your quasi-identifier set enumerable.
• GDPR-Compliant AI User Research - lawful basis, data subject rights and processor obligations for interview data.
• The Privacy Budget in Research Reporting - why a sequence of individually safe releases is not a safe sequence.