Anonymity fails by combination, not by name

The failure mode nobody anticipates

Somebody agrees to tell you something difficult (about a debt, an illness, an employer, a family) on the condition that they are not identifiable. You change the name, blur the face, and publish.

They are identified within a week, and not by anyone clever. They are identified because the piece mentioned a town of forty thousand people, a trade with perhaps nine practitioners in it, a daughter at a named school and an accident “about two years ago”. Each fact on its own identifies nobody. Together they identify exactly one person, to anybody who already knows them a little.

This is jigsaw identification, and it is the way anonymity actually fails. Removing the name does very little work, because the name was never the identifier. The combination was.

Count the population each detail leaves

The practical method is to go through the piece detail by detail and ask, for each one, roughly how many people it still fits. Then multiply down.

• “A city in the north”: millions.
• “A town of forty thousand”: tens of thousands.
• “...who repairs violins”: perhaps a handful.
• “...whose daughter is at St Anne’s”: one.

The moment the number reaches single figures you are publishing an identity. The fix is to make details less specific in ways that do not damage the truth of the story: “a small town”, “a skilled trade”, “a school-age child”. If the specificity was load-bearing (if the story only means something because it is violins) then you have a decision to make with the person, not a detail to quietly adjust.

Blur, pixelation and voice masking are weaker than they look

• Pixelation and mosaic reduce an image to a coarse grid. That grid is a lossy but structured transformation, and where the original is drawn from a small set of possibilities (a known group of people, a limited set of characters) the mapping can often be run backwards well enough to narrow the candidates. Pixelated text has been recovered this way repeatedly. Treat pixelation as obfuscation, not as deletion.
• Moving blur leaks across frames. A tracked blur that slips for two frames on a turn of the head is two clean frames in a file anyone can step through.
• Pitch-shifted voice is a reversible operation. Shifting it back is a menu item in free software. If a voice must be protected, have somebody else read the words, or use a text-to-speech voice and say that you have.

The robust versions are all subtractive: crop the face out of frame, replace the audio, remove the detail from the shot rather than covering it. What is not in the file cannot be recovered from the file.

The metadata you forget

A photograph from a phone usually carries EXIF data including the exact coordinates where it was taken, the device, and the timestamp. Publishing a “location withheld” image with its GPS intact is a common and complete failure. exiftool is free and removes it in one command:

exiftool -all= -overwrite_original photo.jpg

Most social platforms strip EXIF on upload; your own website, a PDF, an email attachment and a file-sharing link generally do not. Check rather than assume, because the platforms that strip it are protecting their users, not yours.

Documents have the same problem in a different place. A PDF exported from a word processor carries the author name and often the file path, which is frequently a person’s full name and their employer’s network.

Show them before you publish

The single most useful step is also the one people skip: show the person the finished piece and ask whether they feel exposed. They know their own life. They will spot the detail that identifies them to their brother-in-law and that means nothing to you.

This costs you a day and it changes what you are doing from a promise you hope to keep into one you have checked.

Say what you cannot promise

Here is the limitation, and it should be said to the person out loud before they agree to anything. You can make identification harder. You cannot make it impossible, and you cannot make it revocable. Once a file is public it can be copied, archived, indexed and searched by tools that did not exist when you published it, and the risk of re-identification only ever goes up as more data about everyone accumulates elsewhere.

A person deciding whether to speak is entitled to that sentence, not a reassurance. Some of them will decide not to, and that is the system working.