The Information That Is Needed to Identify You: 33 Bits
With more than 6.6 billion people in the world, it’s easy to feel safely anonymous.
Many data collectors assure consumers that they don’t collect or store personally identifiable information — things like full names, Social Security numbers or credit-card numbers. But researchers say it’s often possible to identify people even without that information.
The problem, says Paul Ohm, an associate professor at the University of Colorado Law School, is that there’s a lot of data available about people. When clever statisticians tap those sources, Mr. Ohm says, “you should never bet against re-identification.”
Take, for example, a database that stores a user’s ZIP code, gender, age and model of car. On their own, these things sound anonymous. But if the ZIP code has 20,000 people, gender narrows that down to 10,000. Age could cut it down to a few hundred, and once you add model of car, you could be looking at a handful of people. Add other characteristics, like specific browser type and computer operating system, and you may be describing just one individual.
