Key takeaways
- Anonymization for AI training replaces every personal detail with a consistent stand-in, so Sarah is Employee 14 in every message and the record still makes sense.
- The data vendor or a specialist de-identification firm does the work, software first and people second, and AI labs see only the cleaned version.
- Records too sensitive to clean safely, such as HR, medical and privileged legal files, are deleted rather than anonymized.
- Under GDPR pseudonymized data is still personal data, so agree the rules, review samples and get retention and deletion terms in writing.
01
What data anonymization means for AI training data
The short answer
Data anonymization for AI training means removing or replacing every detail that could identify a person, so a record still shows how the work was done but no longer shows who did it. Before company records reach AI labs, the data vendor swaps names, email addresses, phone numbers, street addresses and account numbers for consistent stand-ins, and deletes anything too sensitive to clean.
Why company records need cleaning before AI can use them
AI models learn by studying examples, and the examples they study are called training data. The most valuable training data now comes from the records employees create inside businesses as they work, such as support tickets, email threads, team chat and CRM records (the customer relationship management software where sales and service history lives). Together, those records show a job being done from the customer's first request to the final result.
Those records are full of people: every ticket names a customer and every email has a sender. Companies license these records to two kinds of buyer. AI labs are the companies that build and train AI models, and data vendors are the companies that buy records from businesses, clean and anonymize them, and turn them into training material for the labs.
AI labs and data vendors pay for the account of how each job was handled: what the customer asked for, what the employee did and how it turned out. They have no use for who the customer or the employee was. We explain how labs use those records in why AI companies want your data.
What counts as personal information (PII)
Personal information, often called PII (personally identifiable information), is any detail that identifies a person on its own or when combined with other details. Privacy specialists split it into two kinds, and anonymization has to deal with both.
- Direct identifiers
- Details that point to one person by themselves: a full name, an email address, a phone number, a street address, a Social Security or national ID number, a bank account or card number, a face in a photo or a voice in a recording.
- Indirect identifiers
- Details that are harmless alone but identify someone in combination: a job title, a birth date, a ZIP code, a small town, a rare medical condition, or a mention like "the only welder on our night shift."
Company names count too. A record that names your client can reveal who that client is and what they paid, so client and vendor names get the same treatment as people's names.
What a record looks like before and after
An anonymized record keeps every part of the work and changes only the identities. In the diagram below, an office manager emails a colleague and asks her to phone a client's contact about an invoice that is 30 days overdue. After anonymization, the request, the reason and the outcome are untouched. Every person, company and phone number has been swapped for a stand-in, a label such as "Employee 14" or "[phone]" that takes the place of the real detail.
02
Anonymization vs. pseudonymization vs. de-identification vs. redaction
The short answer
Anonymization makes data permanently unidentifiable. Pseudonymization replaces identities with stand-ins that whoever holds the key, a separate list matching each stand-in to the real name, could trace back. De-identification is the umbrella term for both, and redaction blacks details out with nothing in their place. Data vendors prepare company data for AI training by pseudonymizing it with consistent stand-ins and deleting whatever is too sensitive to clean.
Four terms that get used as if they meant the same thing
People use these words loosely, but privacy law does not. Each one describes a different result, and the difference decides whether privacy laws such as Europe's GDPR still apply to the data.
- Anonymization
- Changing data so that nobody, including the company that holds it, can reasonably identify the people in it again. Under European law, truly anonymous data is no longer personal data at all.
- Pseudonymization
- Replacing each identity with a stand-in, such as "Employee 14", while a separate key or mapping table records who is who. Whoever holds the key could reverse it, so the law still treats the result as personal data.
- De-identification
- The general term for any process that removes the link between data and the people it describes. The U.S. National Institute of Standards and Technology (NIST) defines it this way, and it covers both pseudonymization and anonymization.
- Redaction
- Blacking out or deleting a detail and leaving nothing in its place, the way a released government document shows black bars. It removes the identity and also the information about who did what.
A fifth term, data masking, usually means hiding real values in copies of a database used for software testing, for example showing only the last four digits of a card number. It is a technique rather than a result, and it can produce either pseudonymized or anonymized data.
Which one happens to your company's data
Company data licensed for AI training is pseudonymized: every person and company gets a consistent stand-in. Records that are too sensitive to transform safely are deleted outright.
Indirect clues are removed or made less precise, for example by turning a birth date into a birth year. The goal is a dataset that no buyer can trace back to anyone. For the buyer that is anonymization in practice, even though the vendor keeps a mapping table (the private list that links each stand-in to the real person) while it works.
| Method | Can it be reversed? | Does the record stay useful? | Personal data under GDPR? |
|---|---|---|---|
| Anonymization | No | Partly; heavy anonymization can remove details the work depends on | No |
| Pseudonymization | Only with the separate key | Yes; who did what stays clear | Yes, for whoever can re-identify it |
| Redaction | No | Poorly; nobody can tell people apart | Depends on what is left |
| AI training pipeline | Not by the buyer | Yes | Treated as personal data while the vendor holds the key |
03
Why consistent stand-ins keep anonymized data useful
The short answer
Consistent stand-ins keep anonymized data useful because the same person gets the same label in every message, email and record, so a model can still follow who asked, who answered and who followed up. Black-bar redaction removes the identities and the story with them, which is why AI training data is pseudonymized instead.
What black bars destroy
A record is valuable for training because it shows one person asking for something, another person acting on it, and someone following up. Redaction erases the names that tell a reader which person took which step. If every name becomes "[REDACTED]", a model cannot tell whether the person who asked for a refund is the same person who approved it a week later.
The diagram below shows the same three-message thread both ways. On the left, the words survive, but nobody can tell who asked, who made the call or whether the same client asked twice. On the right, every identity is hidden and all three questions still have answers.
How one person keeps one stand-in everywhere
Giving each person one stand-in everywhere is harder than it sounds, because the same person appears under several names. The same customer might be "Mike" in chat, "Michael Brennan" in an email signature and "mike.b@" in a CRM field. The anonymization software first works out which mentions refer to the same person, a step called entity resolution, and then gives all of them one stand-in.
micro1, the data vendor we typically refer companies to, describes this in its published research on PII transformation. The research describes anonymization as rewriting the whole dataset at once, rather than searching each file for names one at a time. It also says the same real person should map to the same synthetic identity across every file in the dataset.
Labels, tags and synthetic people
Stand-ins come in three styles, often mixed in one dataset.
- Numbered labelsPeople and companies become "Employee 14", "Contact 203" or "Client 7", which also tells a model whether each one is an employee, a customer's contact or a client company.
- Type tagsContact details become "[phone]", "[email]" or "[account]", so a model knows a number was there without seeing it.
- Synthetic identitiesEach real person becomes an invented one, with a fake name, email and employer that fit together; micro1's research calls these identity "bundles". Realistic invented details keep each record reading like a real email or chat rather than a form full of labels.
The demo below uses the first two styles on a short thread about a customer renewing its contract. Switch between the two views to see what changes and what stays.
Redaction demo
Your data, and what buyers see
A Slack thread, an email and a CRM note from the same job. Every person, company and number is swapped for a stand-in that stays the same everywhere.
An illustration with made-up names. The work stays readable: a renewal was requested, priced, confirmed and closed, and nobody in it can be identified.
04
What gets replaced, what gets deleted and what stays
The short answer
Names, company names, email addresses, phone numbers, street addresses and account numbers are replaced with stand-ins. HR files, medical information, privileged legal advice, trade secrets and anything too revealing to clean safely are deleted entirely. The work itself, meaning the requests, steps, decisions and outcomes, stays as written.
Replaced: anything that identifies a person or account
Every direct identifier gets a stand-in, so each sentence still reads correctly with a label where the name or number used to be. That covers names of people and companies, email addresses, phone numbers, street addresses, account and ID numbers, usernames and email signatures.
Deleted: what is too sensitive to risk
Some material is never cleaned, because one missed detail could expose a person's health, employment record or legal trouble. The working rule in the industry is simple: if something is highly sensitive, delete it rather than try to anonymize it.
- Categories you choose to excludeHR files, employment records and medical information are the most common exclusions. Exclusions are opt-in: nothing is left out unless you ask, so the choice is yours.
- Material buyers require you to leave outBuyers ask companies to leave out trade secrets and legally protected material. The most common example is advice from the company's lawyers covered by attorney-client privilege, the rule that keeps communications between a lawyer and a client confidential.
- Records that identify someone without a nameA long email thread about one employee's illness, a lawsuit or a family emergency can reveal who it is even with every name replaced. Threads like that are deleted.
Kept: the work a model learns from
Everything that describes the job stays as written. That includes what the customer asked for, each step employees took and in what order, the decisions they made and the reasons they gave, the software they used, and whether the job ended fixed, paid, closed or lost. The diagram below sorts everything in a record into these three groups.
05
How company data is anonymized, step by step
The short answer
Company data is anonymized by the data vendor in-house or by a specialist de-identification firm, never by the company that owns it. Software makes the first pass: it finds personal details and replaces or deletes them. The vendor's reviewers then check the output, and the company that owns the data reviews samples. Only the cleaned version reaches AI labs.
Who does the anonymizing
The company selling the data does not anonymize anything itself. The data vendor that licenses the data does the work, either with its own anonymization software (AI models trained to find personal details in text) or by sending the data to a de-identification firm, a company whose only job is stripping personal details out of records. Either way, the cleaning happens before any AI lab sees a line. The vendor's duty to anonymize is written into the licensing agreement, the contract that sets what the buyer may do with the data.
The data vendor does receive your raw records, over an encrypted transfer, because it cannot clean what it cannot see. The AI labs that buy from the vendor receive only the anonymized version.
Software first, then people
Anonymization runs in two halves. Software processes every record first, and then people check the results, as the diagram below shows.
What people catch that software misses
The software keeps the private mapping table so the same person always gets the same label. micro1 also runs an AI agent, a program that works through a task on its own, to recheck the passages where the software could not tell for certain whether a detail identifies someone.
Software still misses things a careful reader catches. A name can sit inside a scanned PDF, and a customer can be identifiable from "the bakery on the corner of Main Street". Human reviewers read a sample of the cleaned records, look for misses like these, and send any record that still identifies someone back to be fixed.
06
What you approve before any data is used
The short answer
The company that owns the data agrees the anonymization rules, chooses its exclusions and reviews anonymized samples of its own records before any data is used. These terms go into the data licensing agreement, so the company controls what is replaced, what is deleted and what is left out.
The three things you sign off on
Agree the anonymization rules Before transfer
You and the data vendor agree what gets replaced, which kind of stand-in replaces it, and what gets deleted. The rules go into the licensing agreement, along with the vendor's commitment not to share the data with anyone until it is anonymized.
Choose your exclusions Before transfer
An exclusion is a system or category of records you keep out of the deal entirely, and nothing is excluded unless you ask. Whole systems or categories, such as HR files, payroll or health information, can be left out so they never leave your company.
Review samples Before use
You read anonymized versions of your own records. Your team is best placed to spot a nickname or a customer the software missed, because you know who those people are.
Questions to ask the data vendor
- Who does the anonymizing?The answer should name either the vendor's own team and software or a specific outside de-identification firm.
- What happens to the mapping table?Ask who can see the table that links stand-ins to real names, and when it is destroyed. Destroying it is what moves pseudonymized data closer to anonymous.
- How are attachments, images and audio handled?Names hide in PDFs, screenshots and call recordings. Faces in photos and voices in recordings need different tools from text, or they should be excluded.
- Does the buyer's contract forbid re-identification?The AI labs that receive the data should be contractually barred from trying to work out who is in it.
The trade-off: exclusions can lower the price
Every exclusion removes material a buyer would have paid for. Companies are paid $100K to $2M or more per dataset, and the top of that range goes to complete records that follow each job from start to finish.
Excluding a sensitive system is often the right call anyway. Exclusions are a normal topic for the first call with a data vendor, and the decision is yours. The data vendor can tell you on that call how leaving a system out changes the offer.
07
How long raw data is kept, and what deletion covers
The short answer
micro1's contracts allow it to keep a company's raw, un-anonymized data for up to 180 days, and it says the real period is usually much shorter. Raw data is deleted on an agreed schedule once it has been used. Deleting the files does not remove what an AI model has already learned from them.
Raw data has a deadline
The raw copy exists only so the vendor can clean it and build training material from it. micro1 says its contracts allow up to 180 days and that it usually deletes far sooner. Its data partnerships page says raw data is deleted according to an agreed schedule and deleted at the end of an engagement under the agreed terms.
How the data is held in the meantime
micro1 says each company's data is kept separate from other companies' data, runs through isolated pipelines (processing systems that handle no other company's records), and is open only to a limited number of authorized staff on company-managed devices. It also says data is licensed only to labs and enterprises based in the U.S. and allied countries.
Worth knowing
A trained model cannot unlearn a dataset on request. Deleting the files does not remove what a model absorbed from them, which is one more reason anonymization has to be right before the data is used. Get retention and deletion terms in writing; our data licensing guide covers the other terms to ask for.
08
Can anonymized data be re-identified?
The short answer
Yes. Anonymized data can sometimes be re-identified by combining the details that remain, which is why removing names is never enough on its own. The risk is reduced by deleting revealing records, generalizing rare details, using random stand-ins, keeping the mapping key separate, and contractually banning buyers from trying.
How people are traced without their names
Re-identification means working out who a person in anonymized data really is. It works by combining indirect identifiers until only one person fits. A job title rules out most of a company, a city rules out most of a country, and a start date or a rare piece of equipment can leave a single person. A 2019 study in Nature Communications by Rocher, Hendrickx and de Montjoye estimated that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes, such as age, gender, ZIP code and marital status.
A consistent stand-in can make this easier, because it gathers everything one person did under one label. In 2006 AOL released search logs in which each user appeared only as a number. The New York Times read the searches of user No. 4417749 and found Thelma Arnold, a 62-year-old widow in Lilburn, Georgia, because her searches, which included landscapers in her town and people with her surname, together pointed to her.
Why a stand-in must be random
A stand-in has to be assigned at random, not calculated from the real value. Turning an email address into a scrambled code with a formula, a technique called hashing, looks anonymous but is not: anyone with a list of email addresses can run the same formula and match the codes. The U.S. Federal Trade Commission put it bluntly in 2024: hashing still doesn't make your data anonymous.
How the risk is reduced
- Delete what can't be made safeThreads about one person's health, discipline or family are removed rather than cleaned, because context alone gives them away.
- Generalize rare detailsAn exact birth date becomes a year, and a street becomes a region, when the precise value adds nothing to the work.
- Keep the key apartThe mapping table stays with the vendor, under restricted access, and never travels with the data to an AI lab.
- Test it like an attacker wouldThe UK regulator, the ICO, recommends a "motivated intruder" test: could a reasonably competent person, using public sources and no specialist skills, identify someone from the data? If yes, it isn't anonymous yet.
- Ban re-identification by contractBuyers agree not to attempt it, and California's privacy law makes that kind of commitment part of its definition of deidentified data.
09
How GDPR and CCPA treat anonymized vs. pseudonymized data
The short answer
Under the EU and UK GDPR, truly anonymous data falls outside data protection law, but pseudonymized data is still personal data for anyone who can re-identify it. Under California's CCPA, deidentified data is excluded from personal information only if the business takes reasonable technical measures, publicly commits not to re-identify it, and binds recipients to the same rules. This is general information, not legal advice.
GDPR: anonymous data is out, pseudonymized data is in
The EU's General Data Protection Regulation (GDPR) does not apply to anonymous information, meaning data that no longer relates to an identifiable person. Recital 26, one of the explanatory paragraphs at the start of the regulation, says identifiability is judged by the means "reasonably likely to be used", taking cost, time and available technology into account. The same recital says pseudonymized data that could be attributed to a person with additional information is still information about an identifiable person.
The UK's data regulator, the Information Commissioner's Office (ICO), takes the same line in its guidance on pseudonymisation: it reduces risk but does not take data outside the law. Its guidance on making anonymisation effective sets out the motivated intruder test described above.
Whose hands the data is in now matters in the EU
The European Data Protection Board, the body of EU privacy regulators, adopted Guidelines 01/2025 on pseudonymisation for public consultation in January 2025, treating pseudonymized data as personal data. In September 2025 the EU Court of Justice ruled in EDPS v SRB (C-413/23 P) that pseudonymized data is not personal data in every case and for every person. Pseudonymized data can fall outside the law for a recipient that has no reasonable means of re-identifying anyone, while staying personal data for the organization that holds the key.
CCPA: deidentified data comes with three duties
California's Consumer Privacy Act (CCPA) defines "deidentified" in Civil Code section 1798.140 as information that cannot reasonably be used to infer information about, or be linked to, a particular consumer. A business can only rely on that status if it meets three conditions.
- It takes reasonable measures to make sure the data cannot be associated with a consumer or household.
- It publicly commits to keep and use the data only in deidentified form and not to try to re-identify it.
- It contractually requires anyone who receives the data to follow the same rules.
Health records held by U.S. healthcare providers and insurers follow a separate rule under HIPAA, the federal health privacy law. Its de-identification standard requires either removing 18 listed identifiers or a formal determination by a qualified expert. That strict standard is one reason data vendors mostly avoid medical data.
How the rules compare
| Law | Anonymized or deidentified data | Pseudonymized data |
|---|---|---|
| EU GDPR | Outside the law if no one can reasonably identify anyone | Personal data for whoever can re-identify it |
| UK GDPR | Outside the law if effectively anonymized | Personal data; reduces risk but stays in scope |
| California CCPA | Not personal information, if the three duties are met | Not deidentified by itself |
What anonymization doesn't settle
Anonymization protects the people in your records, but it does not settle whether you have the right to license them. Customer contracts, confidentiality agreements and the terms of the apps the records live in still apply. Slack, HubSpot and Zendesk, for example, restrict AI training on data pulled through their APIs, the connections that let other software copy data out automatically. We cover those checks in is it legal to sell company data?
A sample is itself a disclosure, because even a handful of example tickets puts real records in another company's hands. That is why a lawyer should review the deal before you send even a sample.
Questions
Frequently asked questions
How is company data anonymized for AI training?
Company data is anonymized for AI training by replacing every personal detail, such as names, email addresses, phone numbers, street addresses and account numbers, with a consistent stand-in, and by deleting records too sensitive to clean. Software makes the first pass and people review the output. The data vendor or a specialist de-identification firm does the work, and AI labs receive only the cleaned version.
What is the difference between anonymization and pseudonymization?
Anonymization makes data permanently unidentifiable, so even the organization holding it cannot trace it back to a person. Pseudonymization replaces identities with stand-ins, such as "Employee 14", while a separate key records who is who. Because whoever holds the key could reverse it, GDPR still treats pseudonymized data as personal data, while truly anonymous data falls outside the law.
Do I have to anonymize my company's data myself?
No. The data vendor that licenses your data anonymizes it in-house, or a specialist de-identification firm does it. The company that owns the data agrees the anonymization rules, chooses which categories to exclude and reviews anonymized samples of its own records before anything is used. It does not do the scrubbing itself.
Will my employees' or customers' names end up in an AI model?
Your employees' and customers' names should never reach an AI model. Names, emails, phone numbers, addresses and account numbers are replaced with consistent stand-ins before any AI lab sees the data, sensitive records such as HR and medical files are deleted, and people review the output. Reviewing samples of your own anonymized records is the best way to confirm nothing was missed.
Why not just redact names with black bars?
Black-bar redaction makes training data far less useful, because nobody can tell who asked, who answered or who followed up. Consistent stand-ins remove the identity but keep the sequence: Sarah is Employee 14 in every message, so the thread still makes sense. That readable record of work is what AI labs and data vendors pay for.
Can anonymized data be re-identified?
Anonymized data can sometimes be re-identified by combining leftover details such as job title, location and dates. A 2019 Nature Communications study estimated 99.98% of Americans could be re-identified from 15 demographic attributes. The risk is reduced by deleting revealing records, generalizing rare details, using random stand-ins, keeping the mapping key separate and banning buyers from attempting re-identification.
How long does the data vendor keep my raw data?
micro1's contracts allow it to keep a company's raw, un-anonymized data for up to 180 days, and micro1 says it is usually much shorter. Raw data is deleted on an agreed schedule once it has been used. Deletion removes the files but not what a model has already learned from them, so get retention and deletion terms in writing.
Is anonymized data still covered by GDPR or CCPA?
Truly anonymous data falls outside GDPR, but pseudonymized data remains personal data for anyone able to re-identify it. Under California's CCPA, deidentified data is not personal information only if the business takes reasonable measures, publicly commits not to re-identify it and contractually binds recipients to the same rules. This is general information, not legal advice; have a lawyer review any deal.
Bottom line
Privacy is handled before anything leaves
You set the rules, the data vendor does the work, and you see samples before anything is used. Apply and you can ask about anonymization on the intro call, before you share a single file.
Not legal, tax or financial advice. Figures come from micro1's published pages and public reporting as of November 2026.