k-anonymity

k-anonymity is a property of a dataset in which each record shares its quasi-identifiers, such as birth year, postcode and gender, with at least k-1 other records, so none can be singled out by them.

Latanya Sweeney set out the model in 2002 (Sweeney, International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 2002). NIST's guide to de-identification explains it with equivalence classes (NISTIR 8053, October 2015). If birth year and state are the quasi-identifiers and k=4, every combination of those two values appears in at least four records. Later work added l-diversity and t-closeness, because a group of four can still share the same sensitive value.

In advertising the idea appears as minimum audience or cohort sizes. The IAB Tech Lab's clean room guidance lists k-anonymity, or cohort sizing, among the privacy controls, so each person cannot be told apart from at least k-1 others (IAB Tech Lab, Data Clean Rooms Guidance). It is weaker than differential privacy: combining several k-anonymous releases can still expose people.

Example: A retail clean room suppresses any report row with fewer than 50 shoppers. A brand asking for sales by postcode and day gets totals for large postcodes, while small ones fold into an "other" row.

Related terms: differential privacy, clean room, hashed email, PAIR, ADMaP.

Authoritative source: NIST, NISTIR 8053, "De-Identification of Personal Information" (October 2015), section on k-anonymity.