Hashing Doesn't Make Data Anonymous, FTC Rules

The U.S. Federal Trade Commission has stated that hashed IDs, which have been widely adopted as a privacy-safe alternative to third-party cookies, aren't anonymous after all.

"Companies often claim and act as if data that lacks clearly identifying information is anonymous, but data is only anonymous when it can never be associated back to a person," the agency said this week. "If data can be used to uniquely identify or target a user, it can still cause that person harm."

Hashing involves taking a piece of data, like an email address, phone number, or user ID, and converting it into a an alphanumeric sequence (called a hash).

"Hashing has a nice potential benefit: A hash by itself cannot easily be used to guess what the original data was," the agency said, noting that since hashes appear meaningless and seemingly can't be used to find the original phone number, for example, companies often claim that hashing allows them to preserve user privacy.

"This logic is as old as it is flawed," it said further. "Hashes aren't anonymous and can still be used to identify users, and their misuse can lead to harm. Companies should not act or claim as if hashing personal information renders it anonymized.

"While hashing might obscure how a user identifier appears, it still creates a unique signature that can track a person or device over time."

As such, the agency recommended against relying on hashing to reduce data sensitivity.

"Hashing is just one tool used in persistent user identification, and the FTC has recently called out other mechanisms of user tracking that rely on pseudonymous identifiers" it said. "Regardless of what they look like, all user identifiers have the powerful capability to identify and track people over time, therefore, the opacity of an identifier cannot be an excuse for improper use or disclosure."

Adam Schenkel, executive vice president of GumGum, a contextual advertising platform provider, supports the ruling.

"The FTC's notion that hashed IDs are not anonymous after all underscores the industry's challenge to find solutions that respect a user's privacy while driving brand outcomes. This news and the FTC's commitment to safeguarding data privacy for Americans is a clear indicator that privacy-invasive targeting tactics like third-party cookies and hashed IDs will not stand the test of time," he says.

"Instead, advanced contextual advertising emerges as a superior solution once again, because, not only is contextual respectful of a user's privacy, but it's also able to match ad content with a user's real-time interests and mindset. For marketers that want to reach all audiences, they should adopt advanced contextual for a safer, more effective addressability method and leave invasive tactics like third-party cookies and hashed IDs behind."