Why the word "anonymous" promises so much
In data protection law, anonymous is not a marketing term but a legal consequence. The principles of data protection should not apply to anonymous information, meaning information that does not relate to an identified or identifiable natural person (Recital 26 GDPR). Calling your web analytics anonymous therefore also says: there is no legal basis to assess, no access request to answer, no retention period to set and no data processing agreement required for this data. If the classification is wrong, exactly these obligations are missing in practice.
Pseudonymous data is something else. The GDPR defines pseudonymization as processing after which personal data can no longer be attributed to a specific data subject without the use of additional information, provided that this information is kept separately and protected by technical and organizational measures (Art. 4(5) GDPR). Such data should be considered information on an identifiable person if it could be attributed by the use of additional information (Recital 26 GDPR). Pseudonymization can reduce the risks for data subjects and help meet the obligations (Recital 28 GDPR); it does not change the fact that the regulation applies.
The new guidelines draw a clear conclusion for transparency: controllers should not use descriptions like "anonymous", "de-identified" or "de-personalised" if individuals are actually still identifiable (EDPB 02/2026, para. 40). In marketing, unfair competition law adds to this: under German law, a misleading commercial practice is unfair if it is likely to cause consumers or other market participants to take a transactional decision they would not have taken otherwise (UWG, Section 5(1)). For infringements of the principles of processing and of data subject rights, which include the information obligations, the GDPR provides for fines of up to 20 million euros or up to 4 percent of total worldwide annual turnover, whichever is higher (Art. 83(5) GDPR).
What Guidelines 02/2026 are and where the procedure stands
The EDPB adopted the "Guidelines 02/2026 on Anonymisation" as version 1.0 on July 7, 2026, explicitly as the version for public consultation (EDPB 02/2026). Comments could be submitted until October 30, 2026 (EDPB). At the time of writing, only this version was available. A revised final version is pending, and details may still change until then.
The guidelines replace Opinion 05/2014 of the Article 29 Working Party on anonymization techniques, which set out three criteria for assessing anonymity in 2014 (EDPB 02/2026, para. 2). Classifications made under the old opinion need not be repeated merely because of the update, but the EDPB calls periodic reassessment good practice (EDPB 02/2026, fn. 3).
The relative approach: anonymous for whom?
The core was set by the Court of Justice in its judgment of September 4, 2025 in case C-413/23 P (CJEU): pseudonymized data does not have to be regarded as personal data in every case and for every person (CJEU, para. 86). For the controller who carried out the pseudonymization and knows the attribution, it remains personal data (CJEU, para. 76). For a recipient, this may be different if the recipient cannot reverse the protective measures and cannot attribute the data to a person by other means either, for example by cross-checking (CJEU, para. 77).
The judgment concerns the data protection regulation for the EU institutions, which is to be interpreted homogeneously with the GDPR where it is based on the same principles (Regulation 2018/1725, Recital 5). The guidelines therefore transfer the approach: whether information is anonymous is assessed from the perspective of each relevant entity, typically any party for whom the data is intended to be anonymous (EDPB 02/2026, paras. 6, 11 and 12). The goal remains that the data is anonymous for all relevant entities.
Two limitations are decisive for web analytics. First, whoever processes data on behalf of another takes on that party's perspective: if the data is personal for the controller, it is also considered personal for the processor (EDPB 02/2026, para. 15). An analytics service that measures on behalf of the website operator therefore cannot rely on its own lack of knowledge. Second, a transfer has a knock-on effect. If it is reasonably likely that data goes to a third party and it cannot be ruled out that this party can attribute it, it is personal for that transfer and indirectly also for the transferring party (EDPB 02/2026, para. 21). And the information obligation at the time of collection follows the controller's perspective at that moment, not the recipient's (EDPB 02/2026, para. 14).
The threshold: not zero, but insignificant
How likely may identification be? The guidelines answer with the Court: for information to be anonymous, the likelihood of a person being distinguished from others in the given context does not need to be zero; it should be insignificant in reality (EDPB 02/2026, para. 22). According to the CJEU, the risk appears insignificant, for example, if identification is prohibited by law or practically impossible because it would require a disproportionate effort in terms of time, cost and labor (CJEU, para. 82).
The guidelines interpret "means" broadly: from reading a document to a web search to complex analyses, including means that are only available through third parties (EDPB 02/2026, para. 28). Whether an entity is likely to use such means is assessed in light of all objective factors (EDPB 02/2026, para. 29). These include:
- Data: aggregation, uniqueness of the records, precision.
- Context: whether access is effectively and permanently restricted.
- Additional information: what allows attribution and how likely it is to be obtained.
- Effort: cost and time to obtain such information.
- Technology: current state and foreseeable developments.
Three points contradict common justifications. Lack of interest in identification is not a sound argument, because motives are hard to demonstrate and may change (EDPB 02/2026, para. 31). A contractual prohibition is not the same as a legal one and should only complement technical measures (EDPB 02/2026, para. 34). And the assessment ages: if new technology or additional available data pushes the likelihood of identification above the threshold, previously anonymous data becomes personal again (EDPB 02/2026, para. 35).
Identifier, attribute combination, fingerprint
According to the guidelines, identifying means distinguishing a person from others within a given context, making it possible to treat them differently (EDPB 02/2026, para. 19). As examples of a unique identifier, the guidelines list a name, social security number, e-mail address and IP address (EDPB 02/2026, para. 23). For website operators, the Breyer judgment of October 19, 2016 fits this picture: a dynamic IP address stored by a provider when a page is accessed is personal data for that provider if it has the legal means to have the person identified with the help of the data held by the internet access provider (CJEU, C-582/14).
More often than a single identifier, it is the combination that matters. Attributes that are not unique on their own can together fit only one person. The guidelines illustrate this with the only person on a street who is wearing a black suit and walking a dog at the same time (EDPB 02/2026, para. 24). Studies show how quickly combinations become unique: in phone mobility data of one and a half million people over 15 months, four time-location points were enough to uniquely identify 95 percent (Scientific Reports 2013). According to a model estimate, 99.98 percent of the US population would be correctly re-identified in any dataset using 15 demographic attributes (Nature Communications 2019).
For websites, paragraph 25 is particularly clear. There the guidelines describe how a website may fingerprint its visitors based on their unique combination of browser, operating system, screen resolution, time zone and other values, and use this fingerprint to identify them across pages and visits (EDPB 02/2026, para. 25). A pseudonym derived from it also allows identification, even for a third party that does not interact with the visitors directly (EDPB 02/2026, Example 6).
Measurements have put different numbers on how unique browsers are. In a sample of 470,161 browsers of privacy-conscious users collected by the Electronic Frontier Foundation (EFF), 83.6 percent had a unique fingerprint (EFF 2010). A later analysis of 2,067,942 fingerprints from a large French website found 33.6 percent unique fingerprints (Gómez-Boix et al., The Web Conference 2018). Both values lead to the same conclusion: a hash over browser attributes is not an anonymous value but, in case of doubt, an identifier.
Every method that links visits to each other creates an identifier. What matters for the classification is how long it is valid, who can recompute it and which attributes are attached to it.
What deleting the key achieves and what it does not
Many cookieless methods form an identifier as a hash of the IP address and a secret random value, the salt, and change it regularly. That is pseudonymization. What matters here is described in the EDPB Guidelines 01/2025, adopted on January 16, 2025 as a consultation version (EDPB 01/2025). A hash without a secret offers little protection: anyone who knows that only a SHA-256 hash was computed can apply it to all known input values and compare (EDPB 01/2025, fn. 23). The secret needs sufficient randomness; according to the guidelines, a date used as a parameter would have very low entropy (EDPB 01/2025, fn. 24).
If the salt is deleted at the end of the day, the identifier can no longer be recomputed from an IP address afterward, not even by the operator. That is an effective safeguard. It does not make the data anonymous by itself, however: even if all additional information held by the pseudonymizing controller has been erased, pseudonymized data can be considered anonymous only if the conditions for anonymity are met (EDPB 01/2025). The identifier loses its key, but the visit row keeps the time, page path, device type and approximate location. These are exactly the attributes that Guidelines 02/2026 test with their three criteria.
The three criteria applied to analytics data
The technical part of the guidelines tests anonymity against three criteria. If all three are met, the data may be regarded as anonymous; if one is violated, further analysis follows to determine whether the data can nevertheless be anonymous (EDPB 02/2026, para. 52).
Met if the data does not contain a unique combination of attribute values relating to a single individual. The more attributes a record carries, the more likely it is to be unique.
Met if no record can be linked to a record of the same person from another dataset, whether through a common identifier or a combination of attributes.
Met if no specific and meaningful inference about a single individual can be drawn from the data, alone or with additional information, not even from aggregated figures.
In addition, there are two ways of applying the framework (EDPB 02/2026, para. 45). The simplified approach ignores differences between entities, assumes that available means will be used by someone and errs on the side of caution. The contextual approach assesses the means of each entity individually but carries the risk of overlooking an entity (EDPB 02/2026, paras. 47 and 48). For web analytics, it looks like this:
| Form of data | Isolation | Linkage | Inference | Usual classification |
|---|---|---|---|---|
| Visit row with daily ID, time, page, device and location | often unique | possible via time and page, for example with orders or server logs | possible | pseudonymous, personal data |
| Visit row with customer number or login | unique | direct | direct | identified, personal data |
| Daily figures per page with large groups | usually met | usually met | rare | can be anonymous, document the assessment |
| Small segment, such as a location with one visitor | met | possible | likely | risk, grouped row needed |
The visit row is the critical case. Even without a name and IP address, it remains a record with many attributes, and on a small website the combination of time, page path and location quickly becomes unique. The website operator can often link it without effort: the visit row with the order confirmation at 2:03 pm matches exactly one order that the shop booked at 2:03 pm. From the operator's perspective, the row can therefore be attributed, and according to paragraph 15 this also applies to the service processing it on the operator's behalf.
Aggregated figures fare better. Aggregate data will usually satisfy the no record isolation criterion if the aggregation was done correctly (EDPB 02/2026, para. 58). However, the guidelines warn that information about individuals can be revealed even from aggregated data (EDPB 02/2026, para. 17). If a B2B website has a single visitor from a small town on a given day, the row "1 visitor from town X, pricing page" may describe exactly one person. With business connections, the network operator may also be the company itself.
A dataset as a whole is only anonymous if the anonymization is effective for all individuals it contains. A report with large groups alongside single rows pointing to one person is personal data as a whole, as long as the parts are not processed separately (EDPB 02/2026, para. 36).
How XICTRAQ® classifies its own data
XICTRAQ® calls the data of its audience measurement pseudonymous, not anonymous, and by the standard of the guidelines that is the accurate classification. To distinguish visits, a pseudonymous daily ID is derived from the IP address and a daily key. The daily key is a random value generated fresh each day and is deleted at the end of the day; after that, the daily ID can no longer be attributed to an IP address in the visitor statistics, and the IP address itself is not stored there (manual on tracker settings). The identifier is formed from the IP address and the daily key, not from browser attributes; no fingerprint within the meaning of paragraph 25 is created for it.
What remains is in the manual as well. The web server records requests for the measurement script together with the full IP address in its access log; entries there are deleted after ten days, entries in the error log only when it rotates (XICTRAQ manual). Besides page path, referring page and time, the visit rows carry screen and window size, browser and operating system category including version, language, internet provider and the approximate location down to postal code and coordinates, as listed in the template text in the manual. Some of these are the very attributes that paragraph 25 names as building blocks of a fingerprint: XICTRAQ® does not form an identifier from them, but they do count when assessing record isolation. And the automatic customer recognition from the Business plan upward links visits of logged-in customers to their customer number and, where available, a name or company; this data is explicitly personal, as the page on cookieless analytics states.
For location breakdowns, XICTRAQ® applies a k-anonymity threshold: cities and regions are aggregated so that each row shown covers a minimum number of distinct visitors, and smaller rows are folded into a single grouped row. The feature page itself states that the threshold reduces re-identification but does not replace a legal case-by-case review and is not a promise of anonymity. That matches the logic of the guidelines: the threshold addresses the inference criterion for small segments. It does not make the visit rows underneath anonymous.
Wording for privacy notices and marketing
Paragraph 40 leads to a simple working rule: describe what happens instead of attaching a label. Anyone who nevertheless relies on anonymity should document how it was achieved, including the testing of the supposedly anonymous data, and retain that documentation (EDPB 02/2026, para. 41). Comparing text with actual behavior also means checking whether a website loads third-party trackers before consent; the GDPR scanner checks this from the outside.
| Instead of | Better | Why |
|---|---|---|
| "We only collect anonymous data." | "We measure reach without cookies using a pseudonymous daily ID." | visit rows with an identifier are pseudonymous |
| "Your IP address is anonymized." | "Your IP address is used to form the daily ID and is not stored in the visitor statistics." | describes the actual process |
| "No personal data, no GDPR." | "The legal basis is [...]; retention and recipients are listed under [...]." | as long as data is personal, the obligations apply |
| "Anonymous statistics for your clients" | "Aggregated reports, small segments in grouped rows" | aggregates can be anonymous, visit rows usually cannot |
An excerpt for a privacy notice might look like this. The details in square brackets depend on your own setup and should be agreed with your data protection officer:
Audience measurement without cookies
To measure the reach of this website, we use [service] as a
processor. No cookies are set and no information is stored in your
browser. To distinguish visits, a pseudonymous daily ID is derived
from your IP address and a random value generated fresh each day;
the random value is deleted at the end of the day. Your IP address
is not stored in the visitor statistics. We record [attributes per
service, e.g. pages visited, referring page, time, browser, screen
size, device type and approximate location].
Legal basis: [...]
Retention of visitor statistics: [...]
Server logs of the service: [...]This applies even more strictly to marketing claims. "Without cookies", "nothing stored in the browser" and "IP addresses not in the visitor statistics" can be substantiated with a setup like the one above. "Anonymous" only if a documented assessment against the three criteria holds for all relevant entities.
What agencies should keep in mind
Agencies that set up and evaluate web analytics for clients typically act as processors. According to paragraph 15, the client's perspective applies to them: if the data is personal for the client, it is also personal for the agency, with all the obligations of processing on behalf. What belongs in such a contract is covered in the article on the data processing agreement under Article 28.
- Reports to clients: export aggregated values instead of visit rows, group small segments.
- Sharing with third parties: clarify first what additional information the recipient holds. A transfer to someone who can attribute the data also makes it personal for the sender.
- Copy for clients: do not carry promises of anonymity over into landing pages or offers.
- Client separation: restrict access per client; roles and the client portal in the Agency plan are described on the page for agencies.
Access requests, impact assessment and consent
Pseudonymous data comes with the usual obligations. Access requests concerning analytics data are often hard to answer, because a daily ID can no longer be attributed to a person once the salt is deleted; see the article on access requests under Article 15. Whether a data protection impact assessment is needed is covered in the article on the DPIA for web tracking.
One question is not answered by the anonymity assessment: whether consent is required for storing information on the end device or accessing it. That rule is tied to the device, not to personal data (TDDDG, Section 25(1)). Whether and how it is set to change is covered in the article on the cookie banner reform 2026; how cookieless measurement works technically is shown in the overview of cookieless tracking without consent banners.
Until the final version: what makes sense now
- Inventory: collect every place where "anonymous" appears, from the privacy notice to cookie notices and landing pages to offers and contracts.
- Data map: for each form of data, record which attributes it carries and who holds which additional information. The guidelines recommend this mapping as an early step (EDPB 02/2026, para. 51).
- Classification: treat visit rows as pseudonymous and call aggregated values anonymous only after a documented assessment.
- Exports: limit reports to third parties to aggregated values and group small segments.
- Review date: reassess once the final version is published and whenever a new data source is added.
The live demo shows the reports with sample data. When visitors arrive can be analyzed with aggregated visitor times without touching individual visits; events such as downloads and outbound links can also be recorded without cookies. The audience measurement is described on the page on cookieless analytics, the privacy notice text in the manual.
This article describes the guidelines in consultation version 1.0 and is not legal advice. Whether data is anonymous or pseudonymous in a specific case depends on the context and belongs in a case-by-case review with your data protection officer.
This article draws on: EDPB, Guidelines 02/2026 on Anonymisation, version 1.0, and the EDPB consultation page; EDPB, Guidelines 01/2025 on Pseudonymisation; CJEU, C-413/23 P, EDPS v SRB; CJEU, C-582/14, Breyer; GDPR, Art. 4(5), Art. 83(5), Recitals 26 and 28; Regulation 2018/1725; Section 25 TDDDG; Section 5 UWG; Rocher et al., Nature Communications 2019; de Montjoye et al., Scientific Reports 2013; Eckersley, EFF 2010; Gómez-Boix et al., The Web Conference 2018; XICTRAQ manual, tracker settings.