The end of “practical obscurity”

For decades, much of the world’s approach to privacy was shaped by practical constraints. Even when information was technically available, turning scattered data into a person’s identity required enough time, expertise, and resources that exploitation at scale was rarely worth the effort.

This idea became known as “practical obscurity.” It explained why removing names from datasets often felt like a meaningful privacy safeguard, why public records could remain difficult to exploit, and why information spread across many different sources was often treated as low risk.

Advanced Artificial intelligence (AI) is changing that equation by making it far easier to connect fragments of information that were previously too scattered, too complex, or too expensive to analyze.

In December 2025, Anthropic released a public dataset of 1,250 interviews its AI system had conducted with professionals, including 125 with working scientists. Participants had consented to publication, and the transcripts carried no names or direct identifiers. Within days, Tianshi Li, a researcher at Northeastern University, used a widely available language model with web search to link roughly a quarter of the scientist interviews back to specific published papers, recovering the authors and, in several cases, the individual interviewee.

A separate February 2026 preprint by Lermen, Paleka, Swanson, Aerni, Carlini, and Tramèr, researchers at ETH Zurich and Anthropic, took the next step and built the full pipeline: extract identity signals from raw posts, search millions of candidate profiles, reason over the best matches, and calibrate confidence. A similar type of agent correctly matched 226 of 338 pseudonymous forum users to their real LinkedIn identities (67%) at 90% precision, and at a cost of somewhere between $1.00 and $4.00 per person. The image below exemplifies the framework used in the Large-scale Language Model (LLM) deanonymization:

The single strongest predictor of whether someone could be unmasked was based on how much they had posted; identifiability rose steeply with content volume.

Key takeaway: Your digital footprint is no longer measured
in what you reveal, but in what AI can infer.

What matters about these examples is that nothing was breached or stolen. The information was already public, but what changed is the cost of inference. Inference is the process by which a trained AI model draws conclusions from data it has not seen before, for instance being used to connect scattered data fragments into a named person.

That shift has broad implications for privacy, security, and cryptography. Many protections have historically depended on the assumption that certain forms of identification were too difficult to perform in practice.

“Practical obscurity” was never about personal identification being impossible, but rather it was too costly, slow, or difficult to matter or be problematic at scale. Anonymization, pseudonymization, and redaction worked by raising the cost of linking data back to an individual, making large-scale exploitation economically and practically unappealing.

Modern privacy law still rests on this assumption and the European Union’s General Data Protection Regulation (GDPR) reflects it directly: under Recital 26, data counts as anonymous only when re-identification is not “reasonably likely,” judged by the means an attacker could realistically bring to bear through access to technological and financial resources.

The Court of Justice of the European Union reinforced this interpretation in its 2025 judgment in European Data Protection Supervisor (EDPS) vs. Single Resolution Board (SRB), finding that pseudonymized data is not automatically considered personal data for every organization that processes it. Whether information meets this criterion is personal data depends on whether the organization processing it has reasonable means of identifying the individual. The same dataset may therefore be personal data in one context and effectively anonymous in another.

The assumption that prohibitive access costs protect privacy has been steadily eroding with technological advancement. The U.S. Supreme Court gave the concept its name in 1989, in the Department of Justice vs. Reporters Committee for Freedom of the Press case. Journalists sought the FBI’s compiled criminal-history file on a private citizen, reasoning that because each underlying arrest record was already public, the compilation should be public too. The U.S. Supreme Court disagreed and did so unanimously; scattered across the courthouses that held them, those records amounted to what the justices called a compilation of otherwise hard-to-obtain information, and the privacy interest in preserving their practical obscurity was high.

Confirming where someone lived once meant paging through printed directories or making a round of phone calls. Checking a court record meant traveling to the right courthouse and waiting at the clerk’s counter for someone to retrieve it. Over the following decades, digitized records, search engines, and commercial data brokers steadily eliminated that friction, collapsing searches that once took days into seconds.

In the privacy research arena, Latanya Sweeney of Carnegie Mellon University, used 1990 U.S. Census data and determined that 87% of Americans could be uniquely identified from just three data points: ZIP code, birth date, and sex. Later replications using different census years brought that figure closer to 60%, but the underlying lesson held that only a handful of seemingly ordinary attributes are enough to uniquely identify most people.

Similarly, in 2008, researchers stripped the anonymity from Netflix’s supposedly anonymous movie ratings by matching them against public IMDb profiles. In 2019, a study in Nature Communications estimated that 99.98% of Americans could be re-identified in any dataset using 15 demographic attributes, concluding that conventional de-identification techniques could no longer reliably preserve anonymity under the GDPR’s “reasonably likely” standard.

While re-identification has long been possible, what protected privacy was that it remained too expensive, too slow, and too labor-intensive to do at scale. Privacy depended less on anonymity being absolute than on the cost of breaking it; artificial intelligence is dramatically collapsing that cost.

Historically, unstructured text has been one of the hardest forms of data to evaluate for privacy risk. A person’s writing style, interests, vocabulary, experiences, and patterns of expression can reveal far more than a single identifier. The same fragments of language, behavior, and context that once required a skilled researcher to manually piece together can now be analyzed automatically, at scale, and at a cost measured in pocket change compared to hours of expert labor.

In peer-reviewed work presented at ICLR in 2024, researchers at ETH Zurich, a Swiss University, demonstrated that large language models could infer personal attributes such as location, income, and sex directly from the way people write, reaching up to 85% accuracy at roughly 100 times lower cost and 240 times less time than human analysts. The models were not merely recalling memorized data but rather reading context, the same subtle cues a human profiler picks up on and doing it at industrial scale.

The diagram above illustrates a representative workflow for inferring personal attributes from user-generated text using a large language model (Source: ICLR):

• Step 1: An adversary begins with a collection of user-authored text, such as posts scraped from an online forum, and embeds the text within a predefined prompting template.

• Step 2: That prompt is submitted to a pre-trained LLM.

• Step 3: The pre-trained LLM analyzes the content and predicts personal attributes about the author, automating a process that would otherwise require manual analysis.

• Step 4: The inferred characteristics are then compiled into a structured user profile, demonstrating how publicly available text can be transformed into detailed personal information at scale.

The traditional mental model of a data breach is an attacker breaking through a wall, bypassing a lock, or gaining access to information that was never intended to be exposed. AI-enabled re-identification represents a different kind of privacy risk: No system needs to be compromised and no database needs to be stolen because the violation occurs through inference, where information that was individually public, fragmented, and seemingly harmless can be combined to reveal the identity and personal details of the person behind it.

The infringement this creates is not evenly distributed, and the authors of the 2026 study are explicit about who is exposed:

1. For governments, the capability means pseudonymous accounts belonging to dissidents, journalists, and activists can be linked to real identities for surveillance, and that de-identified public records and witness protections rest on shakier ground than assumed.

2. For commercial enterprises, it means competitors and malicious actors can map anonymous forum posts to real employees, potentially unmasking whistleblowers or reconstructing confidential plans from nothing but writing patterns matched against public profiles.

3. For individuals, the familiar boundary between public expression and private identity becomes increasingly fragile. What looks anonymous in isolation, a forum post, a product review, a passing comment, may not stay that way.

The security implications follow naturally. Once AI can build a detailed picture of an individual, that profile becomes a powerful tool for manipulation. In separate peer-reviewed research published in Expert Systems with Applications in 2026, researchers showed that AI agents could autonomously collect public information, generate detailed personal profiles, and create targeted phishing messages that performed comparably to those written by human experts.

Key takeaway: The same capability that makes AI
useful for understanding people is what makes people
easier to find, easier to influence, and easier to target.

The challenge created by AI inference is not only technical but legal. Nearly every modern privacy framework rests on a deceptively simple question: when can information reasonably be considered anonymous? For decades, the answer depended on practical limits: how much time, money, and expertise it would take to identify someone.

Europe is now confronting this tension directly. On one side, regulators are signaling that AI systems cannot be treated as anonymous simply because direct identifiers have been removed. In December 2024, the European Data Protection Board (EDPB) issued Opinion 28/2024, stating that AI models trained on personal data must be assessed individually and that anonymity depends on whether personal information can be extracted through available techniques, including inference and inversion attacks. That same month, Italy’s data protection authority fined OpenAI €15 million over findings related to ChatGPT’s legal basis for training and transparency obligations. OpenAI disputed the decision and announced an appeal. In March 2026 the court of Rome annulled the fine, a reminder of how unsettled the regulatory landscape remains.

At the same time, Europe is considering changes that would narrow when information counts as personal data at all. The European Commission’s Digital Omnibus proposal, published in November 2025, would write the court’s reasoning directly into the GDPR, making the test turn on whether the particular organization holding the data could realistically identify someone with it. The same proposal would make it easier to train AI models on personal data, provided companies are transparent about it and people can object. It remains under legislative consideration, and Europe’s own privacy regulators have raised concerns.

The uncertainty extends beyond data protection law. The EU AI Act’s obligations for high-risk AI systems were originally scheduled to apply in August 2026. Negotiators later reached a provisional agreement to delay those obligations until December 2027, though that change still requires formal adoption. Organizations preparing to comply are aiming at a target that is still moving, in both what is required and when it takes effect.

The United States is approaching the issue through a different path. Without a comprehensive federal privacy law, the debate has moved to the states. Nineteen states now have comprehensive privacy statutes, with California’s latest rules taking effect in January 2026 and requiring risk assessments for certain high-risk processing activities, including some uses of automated decision-making technology. Indiana, Kentucky, and Rhode Island brought broad privacy laws into effect on the same day, while Texas has moved aggressively through its Responsible Artificial Intelligence Governance Act and privacy enforcement actions. Texas’ Attorney General secured a 1.375-billion-dollar settlement with Google over data privacy and filed the first enforcement action under a state comprehensive privacy law, targeting the collection and sale of driving data from tens of millions of people.

The question facing regulators is whether existing standards for anonymity still hold when the “means reasonably likely to be used” now include AI systems capable of inferring identities from information that was previously considered too diffuse to exploit.

There is no simple technical fix for AI-enabled re-identification, and even the researchers studying these attacks are cautious about promising easy solutions. The challenge is that many of the privacy techniques organizations rely on today were designed for a different era. They were built primarily around structured datasets with clear fields and identifiers, while many modern inference attacks operate on the messy, contextual signals embedded in ordinary human language.

Several established privacy techniques remain important, but their limitations become clearer in this new environment:

1. Differential privacy: Helps organizations share useful information about groups while limiting what can be learned about any individual. It remains one of the strongest mathematical privacy frameworks available, particularly for statistical analysis, but it is not designed to eliminate every risk associated with inference from rich, unstructured text.

2. K-anonymity: Privacy technique that attempts to make individuals harder to distinguish within a dataset by ensuring that each person’s information resembles that of a larger group. It can be useful in certain settings, but it becomes less effective when outside information, writing patterns, or new AI capabilities allow additional clues to be combined.

3. Homomorphic encryption: Often discussed as a possible long-term solution because it allows computation on encrypted data without exposing the underlying information. However, it is not currently a standalone answer for large-scale AI systems. It remains far slower than ordinary computation, difficult to apply to the sheer volume of operations modern AI models require, and it protects data only while it is being processed, leaving risks like inference and metadata exposure largely untouched.

While there is no single technology that can solve a problem created by the ability to infer identity from context, the response needs to combine technical safeguards with stronger operational practices.

Organizations can reduce their exposure by taking several practical steps:

1. Treat pseudonymized free text as personal data: Unless an organization can demonstrate that the information cannot reasonably be linked back to an individual, it should be handled with the same care as other personal information.

2. Test before release: Before sharing or archiving user-generated text, evaluate whether current AI systems can identify the people behind it. If internal testing can uncover identities, external actors may be able to do the same.

3. Limit bulk access and data exports: Restricting large-scale access reduces the ability to aggregate information into detailed profiles.

4. Watch for automated scraping: Many inference attacks depend on collecting large volumes of publicly available information. Detecting unusual collection patterns can reduce exposure.

5. Reevaluate privacy continuously: A dataset that appeared anonymous in the past may not remain anonymous as AI capabilities improve. Privacy assessments need to evolve alongside the technologies that challenge them.

The good news is that organizations do not need to build entirely new governance systems from the ground up. Many already conduct privacy reviews and AI risk assessments. California’s emerging privacy requirements and the AI governance framework in ISO/IEC 42001 provide useful foundations. The gap is that most of these assessments were not designed to measure AI-enabled re-identification risk.

Something similar is true of security frameworks. Traditional standards such as ISO/IEC 27001 are built to prevent unauthorized access through controls like encryption, authentication, and access management. While essential, they do not address what happens when AI infers identities from data that was already public.

Key takeaway: An organization can have strong security controls
and still expose identities through inference.

In the AI era, protecting data is only half the task. The other half is understanding what that data reveals when combined with everything else already in the open.

For individuals, the uncomfortable reality is that accumulation creates risk. The more information someone shares over time under a consistent identity, the easier it becomes to connect those pieces together. Avoiding explicit identifiers may no longer be enough because identity can emerge from patterns, context, and the collective footprint of everything a person has written.

Privacy, data security, and cryptography are often treated as separate disciplines, but they share a common foundation: each assumes that certain attacks remain too difficult, too expensive, or too time-consuming to carry out in practice. Privacy law relies on the idea that re-identifying individuals is not reasonably feasible. Information security relies on technical and organizational controls to prevent unauthorized access. Cryptography protects data by making it computationally impractical to decrypt without the proper key.

Key takeaway: Privacy, data security, and cryptography (in different ways)
depended on the cost of attack remaining high—and that is no longer true.

The shift is already visible in the way cryptographers assess risk. In 2019, Google researcher Craig Gidney and his co-author estimated that breaking a standard 2048-bit RSA encryption key would require a quantum computer with roughly 20 million noisy qubits. By 2025, using improved algorithms and advances in error correction, Gidney revised that estimate to fewer than one million. The hardware did not suddenly become twenty times more capable in six years. Instead, understanding of the computational challenge changed as new techniques became available.

That distinction matters because security decisions are made years before attacks become possible. An adversary does not need a quantum computer today if the information will still be valuable tomorrow. They only need to collect encrypted data now and wait for the technology to catch up, a strategy known as “harvest now, decrypt later.” Intelligence records, medical histories, trade secrets, and other long-lived data become vulnerable the moment they are captured, long before they can actually be decrypted.

The institutions with the most at stake are already acting on that premise. In August 2024, the U.S. National Institute of Standards and Technology finalized its first post-quantum cryptography standards, introducing algorithms designed to withstand attacks from future quantum computers.

In June 2026, a U.S. executive order went further by setting binding migration deadlines, requiring federal agencies to transition high-value systems to post-quantum key establishment by the end of 2030 and post-quantum digital signatures by the end of 2031. The previous federal target had been 2035. Accelerating a costly transition away from encryption that has not been broken reflects a strategic decision based on the expectation that the economics of breaking current systems will continue to change.

No cryptographically relevant quantum computer exists today, and experts continue to debate when one will. That uncertainty has not prevented governments from acting because the central question is how long the assumptions behind today’s security protections will continue to hold.

Now consider these two trends together, with one caveat: What follows is a risk analysis, not a prediction.

Encrypted data is already being collected and stored in anticipation of future decryption capabilities, while AI systems are steadily reducing the cost and effort required to profile individuals and infer identities from information that was previously difficult to connect. These developments do not need to become a single combined attack to create a serious privacy challenge. They can compound over time because each lowers a barrier that the other has traditionally relied upon.

If encrypted archives are eventually unlocked, they will enter a world where AI tools can rapidly analyze, connect, and extract meaning from enormous volumes of information. The concern is not that AI and quantum computing necessarily merge into one advanced threat, but that they may operate on the same data at different points in its lifecycle, weakening protections that were built around assumptions that may no longer hold.

The regulatory and standards work already underway points in the right direction, though it does not yet provide a complete solution. Privacy can no longer be treated as a status achieved once and assumed to endure. It must be evaluated continuously against the capabilities of the tools available to identify, link, and infer information. As computing power increases, datasets expand, and analytical techniques improve, the boundary between anonymous and identifiable continues to shift.

Key takeaway: Anonymity was never a permanent property of data
but has always depended on the capabilities and resources
available to those attempting to identify the information.

The question we are left with is not whether data was anonymous when it was collected or released, but whether it remains anonymous in the face of today’s capabilities and those still to come.

To learn more about AI safety, privacy, and security risks, making policy progress, and raising awareness about humanity’s most pressing challenges, please consider joining Torchbearer Community.