An anonymized user ID represents a person without directly storing identifying attributes such as a name, email address, or phone number. It supports analysis while reducing exposure of personal information. section 8.3.1 section 8.1.2
Use an anonymized ID as part of a broader protection strategy:
- Replace personal information in analytical records with the ID. section 8.3.1
- Disconnect identifying information from research or program data. section 8.1.2
- Combine the ID with generalization, retention limits, restricted access, and consent practices rather than treating it as the only safeguard. section 8.3.1 section 8.1.2
Website behavior analytics
An e-commerce analytics team replaces names, email addresses, and phone numbers with anonymized user IDs, generalizes precise locations to city, state, and country, limits granular records to twelve months, and restricts access to trained analysts. section 8.3.1
Figure 8.6 When all else fails, treat protected information as radioactive.
Use the figure to reinforce the risk-based principle of treating protected information with exceptional care. section 8.3.1
