Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization
2010 · paper · Law
Argues that computer science research showing easy reidentification of anonymized data undermines the privacy protection that laws and regulations assume. The article claims this mistake pervades information privacy law and offers tools for responding to anonymization's failure.
Checked: PDF from cs.cornell.edu, fetched 5 Oct 2026. Page numbers are those of that PDF.
9 findings
Reference or label Note 50 pin-cites "Sweeney, supra note 8, at 567 fig.4", but note 8 gives the Sweeney article as starting at page 571 ("…KNOWLEDGE-BASED SYS. 571, 572 (2002)").
- p. 12 Footnote 50
Sweeney, supra note 8, at 567 fig.4.
- p. 7 Footnote 8
10 INT’L J. ON UNCERTAINTY, FUZZINESS & KNOWLEDGE-BASED SYS. 571, 572 (2002)
- p. 7 Footnote 8
KNOWLEDGE-BASED SYS. 571, 572 (2002).
Only the authors can say what is right here.
Judge's note: Checked the images of note 50 (p. 12) and note 8 (p. 7). A pin cite to page 567 falls before the cited article's first page (571). The pin cite may belong to a different Sweeney article in the same volume, but the article does not say so. Only the authors can say which source or page is meant.
Second check: another model agreed
Report a problem with this finding
Reference or label Note 308 cites Opinion 1/2008 ("00737/EN WP 148"), but its URL is ".../docs/wpdocs/2007/wp136_en.pdf", the same URL note 28 gives for the 2007 Opinion 4/2007 (WP 136).
- p. 67 Footnote 308
docs/wpdocs/2007/wp136_en.pdf [hereinafter 2008 Working Party Opinion]
- p. 9 Footnote 28
01248/07/EN WP 136
- p. 67 Footnote 308
00737/EN WP 148, at 19 (April 4, 2008), available at http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2007/wp136_en.pdf
- p. 67 fn 308
Opinion 1/2008 on Data Protection Issues Relating to Search Engines, 00737/EN WP 148, at 19 (April 4, 2008), available at http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2007/wp136_en.pdf
Only the authors can say what is right here.
Judge's note: The page images show identical URLs in note 28 (p. 9, WP 136) and note 308 (p. 67, WP 148). The URL in note 308 points to a different document from the one cited. Only the authors can supply the correct URL.
Second check: another model agreed
Report a problem with this finding
Reference or label Note 237 cites "De-Anonymizing Social Networks, supra note 117, at 6–7". Note 117 defines that short form as the proceedings version starting at page 173.
- p. 47 Footnote 237
De-Anonymizing Social Networks, supra note 117, at 6–7
- p. 24 Footnote 117
30TH IEEE SYMP. ON SECURITY & PRIVACY 173, 203
Only the authors can say what is right here.
Judge's note: Note 117 (p. 24) gives "PROC. 2009 30TH IEEE SYMP. ON SECURITY & PRIVACY 173" and defines the short form, sending readers to note 169 for the draft. Other pin cites to this short form are 173–74, 177 and 182–85. The pin cite "at 6–7" falls outside the published pagination, so it probably refers to the draft listed in note 169. Only the authors can supply the correct page.
Second check: another model agreed
Report a problem with this finding
Reference or label Note 145 gives the short form "WILSON & COLBY, supra note 131, at 501", but note 131 cites "PAUL WILTON & JOHN COLBY, BEGINNING SQL 90–93 (2005)".
- p. 30 Footnote 145
WILSON & COLBY, supra note 131, at 501
- p. 26 Footnote 131
PAUL WILTON & JOHN COLBY, BEGINNING SQL 90–93 (2005)
- p. 30 Footnote 145
WILSON & COLBY, supra note 131, at 501.
- p. 26 Footnote 131
PAUL WILTON & JOHN COLBY, BEGINNING SQL 90–93 (2005).
Judge's note: Checked both images. The surname in the short form does not match the full citation it points back to. The different pin page (501 against 90–93) is not in itself an error.
Second check: another model agreed
Report a problem with this finding
Reference or label Note 168 reads "See infra Part IV.B (discussing motive).", but motive is discussed as a factor under Part IV.C ("The Test"), p. 1767; Part IV.B (Regulatory Principles) only asks in passing "Who will try to invade the privacy".
- p. 35 Footnote 168
See infra Part IV.B (discussing motive).
- p. 67 Part IV.C.1, 'Motive' factor
Motive
Judge's note: Checked the crop of note 168 and the text of Part IV.B (pp. 1761–62) and Part IV.C (the "Motive" factor, p. 1767). The motive discussion is in IV.C, so the pointer is wrong.
Second check: another model agreed
Report a problem with this finding
Reference or label Note 177 cites "Children’s Online Privacy Protection Act of 1998, Pub. L. No. 106-170"; a 1998 Act carries a 106th-Congress Public Law number.
- p. 37 Footnote 177
Children’s Online Privacy Protection Act of 1998, Pub. L. No. 106-170
Only the authors can say what is right here.
Judge's note: Rests on outside knowledge: Public Law numbers start with the number of the enacting Congress, a 1998 statute belongs to the 105th Congress, and COPPA was enacted in Pub. L. No. 105-277. The page image of note 177 (p. 37) prints exactly "Act of 1998, Pub. L. No. 106-170". The same note gives the 1999 GLBA as 106-102, which makes the mismatch visible within the note.
Second check: another model agreed
Report a problem with this finding
Reference or label Note 336 cites "EU Data Protection Directive, supra note 3, art. I(a)" for the personal-data definition that notes 188 and 208 cite as "art. 2(a)".
- p. 75 Footnote 336
EU Data Protection Directive, supra note 3, art. I(a).
- p. 41 Footnote 208
EU Data Protection Directive, supra note 3, art. 2(a).
- p. 38 Footnote 188
EU Data Protection Directive, supra note 3, art. 2(a).
- p. 75 footnote 336
art. I(a)
Judge's note: The page images show "art. I(a)" in note 336 (p. 75) and "art. 2(a)" in note 188 (p. 38). The text at note 336 quotes the same "identified, directly or indirectly ... identification number" definition that note 188 supports, so the citation should read art. 2(a).
Second check: another model agreed
Report a problem with this finding
Reference or label Note 269 says "The final six bars represent t-closeness", but in Figure 1 the final bars are labelled d=1.2, d=1.0, d=0.8. Only t=0.4, t=0.3 and t=0.2 are t-closeness.
- p. 55 Footnote 269
The final six bars represent t-closeness.
- p. 54 Figure 1 x-axis
d=1.2
- p. 54 Figure 1 x-axis labels
t=0.4 t=0.3 t=0.2 d=1.2 d=1.0 d=0.8
Only the authors can say what is right here.
Judge's note: On the Figure 1 x-axis (p. 54), the l-group is followed by three t-pairs and then three d-pairs. Counted as individual bars, the final six bars are the d-pairs. Counted as label positions, the final six include the three d-settings. Either way, labelling them all t-closeness does not match the figure. The article never names the d method.
Second check: another model agreed
Report a problem with this finding
Wording Introduction: knowing "when and how they rated any three of the movies" lets one "identify more than 80 percent of Netflix users". Part I.B.1.c reports no three-movie result: it gives 84% (six obscure movies, no dates), 99% (six movies, dates ±2 weeks) and 68% (two movies, ±3 days).
- p. 5 Introduction, second paragraph
when and how they rated any three of the movies they have rented?
- p. 5 Introduction, second paragraph
tify more than 80 percent of Netflix users.
- p. 21 Part I.B.1.c, Netflix Prize results
he will be able to identify that person 84 percent of the time.
Only the authors can say what is right here.
Judge's note: Checked page 5 (intro and note 5, cited at 121) and page 21 (body and notes 101–103). None of the body figures is a three-movie result. The only figure above 80% needs six movies and uses no dates. The source may contain such a figure, but the article never reports it, so only the authors can reconcile the two passages.
Second check: another model agreed
Report a problem with this finding
19 minor (typos and the like; most checked by the judge only)
Reference or label Note 81 cites "Golle, supra note 4, at 1", but note 4 cites Golle at "77, 78". Note 237 cites "De-Anonymizing Social Networks, supra note 117, at 6–7", but note 117 cites proceedings starting at 173, and notes 124, 130 and 216 use pages 173–185.
- p. 19 Footnote 81
Golle, supra note 4, at 1.
- p. 5 Footnote 4
5 ACM WORKSHOP ON PRIVACY IN THE ELEC. SOC’Y 77, 78 (2006)
- p. 5 Footnote 4
5 ACM WORKSHOP ON PRIVACY IN THE ELEC. SOC’Y 77, 78 (2006).
- p. 47 Footnote 237
De-Anonymizing Social Networks, supra note 117, at 6–7
Only the authors can say what is right here.
Judge's note: Checked the images of notes 81, 4, 237 and 117. Pages 1 and 6–7 do not fit the published pagination given in the full citations. They probably come from standalone PDF versions; note 117 mentions a draft at note 169, but the supra references point to the published versions. Only the authors can say which pages are meant.
Second check: another model agreed
Report a problem with this finding
Reference or label Notes 56 and 58 cite "Sweeney, supra note 8, at 3.", but note 8 uses journal pagination starting at 571.
- p. 13 Footnote 56
Sweeney, supra note 8, at 3.
- p. 14 Footnote 58
Sweeney, supra note 8, at 3.
Only the authors can say what is right here.
Judge's note: Checked the image of note 56 (p. 13); note 58 has the same wording in the text layer. Page 3 cannot fall within the article as cited in note 8 (journal pages 571 onward). It probably refers to a preprint's page numbering, but nothing in the article says so. This is a different pin cite from C003, so it is kept as a separate cluster.
Second check: another model agreed
Report a problem with this finding
Wording P. 1742 says the Privacy Rule "expressly recognizes the identifying power of ZIP code, birth date, and sex, and carves out special treatment for those who delete or modify them, along with fifteen other categories". Elsewhere the article treats sex as retainable in safe-harbor data.
- p. 42 Part II.C.1, second paragraph
expressly recognizes the identifying power of ZIP code, birth date, and sex, and carves out special treatment for those who delete or modify them, along with fifteen other categories
- p. 14 Footnote 59
Under the HIPAA Privacy Rule, these three changes would qualify the resulting table as deidentified health information.
- p. 37 Part II.A.3.a
the Privacy Rule requires the researcher to generalize birth dates to years and ZIP codes to their initial three digits.
- p. 42 Part II.C.1
expressly recognizes the identifying power of ZIP code, birth date, and sex, and carves out special treatment for those who delete or modify them, along with fifteen other categories of information.
Only the authors can say what is right here.
Judge's note: P. 37 says the safe harbor covers "eighteen enumerated identifiers" and describes the Rule as requiring only that birth dates be generalized to years and ZIP codes to three digits. P. 14 says suppressing the name, generalizing the birth date to the year and truncating the ZIP code are "three changes" that, per note 59, would qualify the table as deidentified. Table 3 (p. 15) keeps the Sex column unchanged. Counting ZIP, birth date and sex plus fifteen others to reach eighteen puts sex among the enumerated identifiers, which conflicts with the article's own account of the Rule. The authors should clarify which reading they intend.
Second check: another model agreed
Report a problem with this finding
Wording Note 307 says "See supra Part II.A.3 (listing privacy statutes that draw distinctions based on data type)", but the list of such statutes (DPPA, FERPA, FDA rules) is in Part II.B.
- p. 66 Footnote 307
See supra Part II.A.3 (listing privacy statutes that draw distinctions based on data type).
Judge's note: The contents (p. 3) show that Part II.A.3 covers HIPAA (II.A.3.a) and the EU Directive (II.A.3.b). The multi-statute list is in Part II.B (pp. 1740–41), and note 167 points to notes 203–207 there. The pointer is partly apt because HIPAA's list is in II.A.3, so either reading could be defended.
Second check: another model agreed
Report a problem with this finding
Wording On p. 1772 the text says "Google’s Global Privacy Officer, Peter Fleischer", while note 324 on the same page says "Mr. Fleischer serves as Google’s Global Privacy Counsel."
- p. 72 Body text, Part IV.D.2.a
Google’s Global Privacy Officer, Peter Fleischer
- p. 72 Footnote 324
Mr. Fleischer serves as Google’s Global Privacy Counsel.
- p. 72 footnote 324
Mr. Fleischer serves as Google’s Global Privacy Counsel
- p. 72
Google’s Global Privacy Officer, Peter Fleischer, offers hypothetical situations
Only the authors can say what is right here.
Judge's note: The page 72 image confirms both titles on the same page. The two cannot both be his formal title, and only the authors can say which is correct.
Second check: another model agreed
Report a problem with this finding
Wording p. 1775 says "Still, courts in Germany, France, and the UK have held to the contrary," but the only UK authority given (p. 1772, n.323) is guidance from the regulator: "INFO. COMM'R'S OFFICE, DATA PROTECTION GOOD PRACTICE: COLLECTING PERSONAL INFORMATION USING WEBSITES 3 (2007)".
- p. 75 Part IV.D.2.b, first paragraph
Still, courts in Germany, France, and the UK have held to the contrary.
- p. 72 Footnote 323
INFO. COMM’R’S OFFICE, DATA PROTECTION GOOD PRACTICE
Only the authors can say what is right here.
Judge's note: I viewed the crops and full page 72. On pp. 1771–72 the text reads "courts and regulators in Sweden and Spain deciding that IP addresses fall within the Directive and those in France, Germany, and the UK finding they do not." The cite for the UK is n.323, a good-practice note from the Information Commissioner's Office, which is a regulator, not a court. Page 1775 restates this as holdings by 'courts' in all three countries. The paper cites no UK court decision, so the later sentence attributes a court holding that its own source does not show. This is a wording overstatement, and the authors could fix it by writing 'courts and regulators'.
Second check: another model agreed
Report a problem with this finding
Typo Note 1 prints the signal "E.g." with no following comma ("E.g. Douglas J. Sylvester & Sharon Lohr"), unlike "E.g.," elsewhere (e.g. notes 9, 98, 129).
- p. 4 Footnote 1
E.g. Douglas J. Sylvester & Sharon Lohr
Judge's note: Checked the crop of page 4. Note 1 reads "E.g. Douglas J. Sylvester" with no comma. Notes 9, 98 and 129 use "E.g.,".
Second check: none (judge only)
Report a problem with this finding
Typo Page 28 twice reverses the Article's defined term: "At least for forget-and-release methods" and "do better than forget-and-release anonymization"; elsewhere it is "release-and-forget".
- p. 28 Part I.B.3.b, second paragraph
At least for forget-and-release methods
- p. 28 Part I.B.3.b, second paragraph
techniques that do better than forget-and-release anonymization
- p. 28 same paragraph
do better than forget-and-release anonymization
- p. 11 Part I.A.2
release-and-forget anonymization
Judge's note: Checked the crop of page 28. Both reversed instances are present. The Article uses "release-and-forget" elsewhere, e.g. the heading of Part I.A.2 and note 61.
Second check: none (judge only)
Report a problem with this finding
Typo Note 297 cites "Lakshmanan et al., supra note 46", but note 46 is a two-author work ("Laks V.S. Lakshmanan & Raymond T. Ng").
- p. 65 Footnote 297
Lakshmanan et al., supra note 46
- p. 12 Footnote 46
Laks V.S. Lakshmanan & Raymond T. Ng
Judge's note: Page images of note 297 (p. 65) and note 46 (p. 12) checked. The short form should be "Lakshmanan & Ng".
Second check: none (judge only)
Report a problem with this finding
Typo Note 65 reads "See infra II.A.", leaving out "Part", unlike every other cross-reference (e.g. note 64: "See infra Part II.A.3.a.").
- p. 16 Footnote 65
See infra II.A.
Judge's note: Checked the crop of page 16. The word "Part" is missing there, while the next-door note 64 includes it.
Second check: none (judge only)
Report a problem with this finding
Typo Note 68 reads "N.Y. TIMES, Aug 23, 2006", with no period after the abbreviation, while notes 67 and 69 use "Aug."
- p. 17 Footnote 68
N.Y. TIMES, Aug 23,
Judge's note: Checked the crop of page 17. The image shows "Aug 23," in note 68 and "Aug. 11" and "Aug. 9" in notes 67 and 69.
Second check: none (judge only)
Report a problem with this finding
Typo Note 97 names the repository "ARVIX" ("ARVIX, Oct. 16, 2006, at 1, http://arxiv.org/abs/cs/0610105v1"); the URL in the same note shows it is arXiv.
- p. 21 Footnote 97
ARVIX, Oct. 16, 2006
- p. 21 Footnote 97
ARVIX, Oct. 16, 2006, at 1, http://arxiv.org/abs/cs/0610105v1
- p. 25 fn 125
Alesandro Acquisti & Ralph Gross
- p. 21
ARVIX, Oct. 16, 2006, at 1
Judge's note: Checked the crop of page 21. The small caps read A-R-V-I-X, so the letters are transposed and this is not a rendering artefact. The "Alesandro" misspelling raised by one reviewer is judged under C011.
Second check: none (judge only)
Report a problem with this finding
Typo Note 125 spells the author's name "Alesandro Acquisti & Ralph Gross"; the body text on the same page and note 54 spell it "Alessandro".
- p. 25 Footnote 125
Alesandro Acquisti & Ralph Gross
- p. 25 Body text
Alessandro Acquisti and Ralph Gross
- p. 25
Alesandro Acquisti & Ralph Gross, Predicting Social Security Numbers
Judge's note: Checked the crop of page 25 and the crop of note 54 (p. 13), which reads "Alessandro Acquisti".
Second check: none (judge only)
Report a problem with this finding
Typo In Table 6, Helen's Sex cell reads "Feale"; the same record reads "Female" in Table 7.
- p. 27 Table 6, Helen row, Sex column
Feale
Judge's note: Checked the full image of page 27. Table 6 shows "Feale" in Helen's row, and the joined Table 7 shows "Female" for Helen.
Second check: none (judge only)
Report a problem with this finding
Typo FERPA is expanded as "the Federal Education Rights and Privacy Act (FERPA)"; the statute is the Family Educational Rights and Privacy Act.
- p. 40 Part II.B, last paragraph
Federal Education Rights and Privacy Act (FERPA)
- p. 40
the Federal Education Rights and Privacy Act (FERPA)
Only the authors can say what is right here.
Judge's note: Rests on outside knowledge: the statute at 20 U.S.C. § 1232g is officially named the Family Educational Rights and Privacy Act. The page 40 image prints "Federal Education Rights and Privacy Act (FERPA)". The acronym is correct but the expansion is not.
Second check: none (judge only)
Report a problem with this finding
Typo "Federal Drug Administration regulations permit the disclosure" names the agency wrongly; it is the Food and Drug Administration.
- p. 41 Part II.B, first paragraph
Federal Drug Administration regulations permit the disclosure
- p. 41 Part II.B
Federal Drug Administration regulations
Only the authors can say what is right here.
Judge's note: Rests on outside knowledge: the agency whose rules are at 21 C.F.R. is the Food and Drug Administration. The page 41 image prints "Federal Drug Administration".
Second check: none (judge only)
Report a problem with this finding
Typo "as Cynthia Dwork puts, “to a new approach to formulating privacy’s goals.”" is missing the word "it" after "puts".
- p. 53 Part III.B.1.a, last paragraph
as Cynthia Dwork puts, “to a new approach to formulating privacy’s goals.”
- p. 53 Part III.B.1.a, last paragraph
as Cynthia Dwork puts, “to a new approach
Judge's note: The page 53 image confirms the wording. Fix: "as Cynthia Dwork puts it".
Second check: none (judge only)
Report a problem with this finding
Typo Footnote numbering skips 267: on p. 1754, note "266" (figure caption) is followed directly by "268".
- p. 54 Figure 1 caption and footnotes
268. These bars represent techniques that achieve k-anonymity
- p. 54 Figure 1 footnotes
266. This figure has been adapted from a figure in id. at 76.
Judge's note: The page 54 image shows only footnotes 266 and 268. Page 55 begins with 269. The text layer contains no footnote 267 anywhere.
Second check: none (judge only)
Report a problem with this finding
Typo Note 322 reads "Posting of Jeremy Mittma". The author's surname appears to be truncated.
- p. 72 Footnote 322
Posting of Jeremy Mittma
Only the authors can say what is right here.
Judge's note: Rests on outside knowledge: the author of the Proskauer Privacy Law Blog post is Jeremy Mittman. The page 72 image prints "Mittma".
Second check: none (judge only)