De-identified data in North America: California, US states and Québec

Masking a document does not make it “deidentified” in North America. In California and Virginia, the business holding the data must also promise publicly not to re-identify it and bind its recipients by contract. In Québec, removing direct identifiers such as names only makes information “de-identified”, which is still personal information.

This guide is for European teams who exchange documents with the United States or Québec. It is dated October 2026, and it is information, not legal advice.

What does “deidentified” mean under California’s CCPA?

The California Consumer Privacy Act (CCPA) defines “deidentified” in Civil Code section 1798.140(m). The text published by the California Privacy Protection Agency, in the version effective 1 January 2026, opens like this:

“Deidentified” means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:

• takes reasonable measures so the information cannot be tied to a consumer or household;
• publicly commits not to re-identify it, except to test its own process;
• contractually obligates every recipient to follow the same rules.

So the test looks at the holder, not only at the file. Say Claire Exemple, a paralegal in Lyon, sends a perfectly masked contract to a client in San Diego. If that client has made no public promise not to re-identify the data, the file is not deidentified. If all three conditions are met, subdivision (v)(3) takes it out of “personal information”.

Subdivision (aa) defines “pseudonymize”: data that cannot be tied to a consumer without extra information kept separately. The law does not exclude it from personal information. Names replaced by codes, with the key stored elsewhere, are pseudonymized, not deidentified.

Do other US state privacy laws use the same test?

Virginia’s Consumer Data Protection Act follows the same model. Its section 59.1-575 defines “de-identified data” as data that cannot reasonably be linked to an identified or identifiable person. Section 59.1-581 gives the holder three similar duties. It adds a fourth: whoever discloses such data must check that recipients keep their contract promises.

Both laws have thresholds on revenue or data volume, so a small partner may fall outside them. We checked only these two states, and wording varies. So read the law that covers your partner. US health records follow a separate federal rule, HIPAA, covered in its own article.

How does Québec’s Law 25 define anonymized information?

“Law 25” is the short name of the Act to modernize legislative provisions as regards the protection of personal information (2021, chapter 25). It amended Québec’s Act respecting the protection of personal information in the private sector (chapter P-39.1). Since 22 September 2023, section 23 of that Act says:

information concerning a natural person is anonymized if it is, at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows the person to be identified directly or indirectly.

Section 12 sets a lower level, “de-identified”: information that no longer identifies the person directly. It stays personal information, and the business must limit the risk of re-identification. Québec’s privacy authority, the Commission d’accès à l’information (CAI), gives examples: removing names, addresses and social insurance numbers.

What does the anonymization regulation require?

The « Règlement sur l’anonymisation des renseignements personnels » (Regulation respecting the anonymization of personal information) was published on 15 May 2024. It took effect fifteen days later, on 30 May 2024, and its register duty on 1 January 2025. A business that anonymizes personal information must:

1. set the purposes first (section 3);
2. work under a competent supervisor (section 4);
3. remove direct identifiers, then analyse re-identification risks (section 5);
4. apply recognized techniques and security measures (section 6);
5. show that the remaining risk is very low, though not necessarily zero (section 7);
6. reassess regularly as technology advances (section 8);
7. record all of this in a register (section 9).

The analysis looks in particular at three criteria: individualization (singling a person out), correlation (linking data sets about one person) and inference (deducing personal information from other data). According to France’s CNIL, European data protection authorities use the same three criteria.

What does federal Canadian law say?

Canada’s federal private-sector law, the Personal Information Protection and Electronic Documents Act (PIPEDA), never defines anonymization. Clause 4.5.3 of its Schedule 1 just says that information no longer needed should be destroyed, erased or made anonymous. The version current to 21 September 2026 still says so. Careful: its French text says « dépersonnaliser » here, while Québec uses « dépersonnalisé » for mere de-identification.

Reform is slow. The Privacy Commissioner of Canada reports that Bill C-27 died with the prorogation of Parliament in January 2025. Bill C-36, introduced on 15 June 2026, would define anonymizing as an irreversible change with no reasonably foreseeable risk of identification. As the Library of Parliament noted in July 2026, it has no force until passed.

How do these rules compare side by side?

What should an EU business do before sending a document?

The GDPR still applies to you when you send the file. The European Commission recognizes Canada for commercial organizations, and the United States only for companies in the EU-US Data Privacy Framework.

1. Send only what the recipient needs.
2. Mask direct identifiers: names, emails, phone numbers, Social Security or social insurance numbers, account numbers, signatures.
3. Check what the recipient can combine: a job title, a date and a small town can point to one person.
4. When a US partner sends you deidentified data, expect to promise by contract not to re-identify it.
5. Before sending you personal information, a Québec business must run a privacy impact assessment and sign a written agreement (section 17 of P-39.1, as the CAI explains).

On an American document, ONYRI Sanitize uses its US formats. It finds Social Security numbers (never-issued ranges are skipped), EINs, ZIP codes, US phone numbers and street addresses. It also finds passport and bank routing numbers, and driver’s license and account numbers only next to their label. Canada is not among its countries, so mask a Social Insurance Number by hand. No tool makes the commitments or signs the contracts for you.

These rules move. Check the current text before relying on one. Then ask your data protection officer, a lawyer in your partner’s state or province, or the CAI.

Frequently asked questions

Sources & references