For US consumer or staff data, does the de-identification meet the CCPA definition, including a public commitment and contract terms binding the buyer?
Reasonable measures documented, a published commitment not to re-identify, and the licence obliges the buyer (and anyone it passes data to) to do the same.
Page out of reach at the last check, 16 Oct 2026Basis: stated
In the source's own words
“"Deidentified" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information: (1) Takes reasonable measures to ensure that the information cannot be associated with a consumer or household. (2) Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information ... (3) Contractually obligates any recipients of the information to comply with all provisions of this subdivision.”
Where it was read
What it is about
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide