"We only collect anonymized data". Roughly what are the limits of this?

Question

Say a program that Bob is using asks to collect "anonymized data". Bob agrees. But roughly at what point is "anonymized" a false statement?

If I have Bob's shopping habits, gendre, device make, ip address/general location area, etc.; at some point, it's more than enough to uniquely identify Bob. In fact, I remember coming across plenty of academic literature about the subject back in 2015 (relevant wiki link)

My question is: are there definitive rulings/laws on the matter? It's definitely a gray area, but I'd like to know any concrete law/legislation surrounding it. Especially in the jurisdiction of the USA, and California in particular.

Answer 1

Assuming that you are referring to online data collection, "personal information" is defined in California in Cal. Civ 1798.140 as

information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:

(A) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.

(B) Any personal information described in subdivision (e) of Section 1798.80.

(C) Characteristics of protected classifications under California or federal law.

(D) Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

(E) Biometric information.

(F) Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.

(G) Geolocation data.

(H) Audio, electronic, visual, thermal, olfactory, or similar information.

(I) Professional or employment-related information.

(J) Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).

(K) Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

(L) Sensitive personal information.

But also, it "does not include consumer information that is deidentified or aggregate consumer information". To answer the next question,

“Deidentified” means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:

(1) Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.

(2) Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.

(3) Contractually obligates any recipients of the information to comply with all provisions of this subdivision.

The conspicuous lack of "and" or "or" in these clauses raises a red flag, in case the AG deems that all three conditions must be met to qualify as "deidentified"