When teams need to work with sensitive data, the first instinct is usually anonymization: strip the names, mask the IDs, remove the email addresses. The resulting dataset feels safe. It does not look personal. It passes a visual inspection. And yet a substantial body of research on re-identification attacks shows that anonymized datasets, especially those derived from real records, can frequently be linked back to specific individuals using combinations of non-obvious quasi-identifiers.
Synthetic data is a different category of solution. It is not anonymized data. It is not derived data. It is generated data, produced from a statistical model trained on real records, where the output records have no correspondence to any real individual. This distinction is not just a technical nicety. It has concrete consequences for re-identification risk, regulatory classification, and what you can do with the resulting data.
What Anonymization Actually Does
Anonymization techniques fall into a few families. Suppression removes specific fields (names, SSNs, direct identifiers). Generalization coarsens specific values to ranges (exact age becomes age bracket, precise zip code becomes region). Pseudonymization replaces direct identifiers with tokens or hashes, maintaining a mapping that can theoretically be reversed. Data masking substitutes realistic-looking fake values for real ones, often consistently (the same real name always maps to the same fake name within a dataset).
All of these operations share a structural feature: each row in the output corresponds to a specific real row in the input. The anonymized record is derived from a real individual's record. The values in most columns, including the columns that were not directly anonymized, are the real values from that individual's record.
This is why re-identification is possible. If an attacker has access to an external dataset that contains some of the same individuals, they can attempt to match records across datasets using the non-anonymized columns as quasi-identifiers. The classic Latanya Sweeney work showed that a combination of zip code, birth date, and sex could uniquely identify a high fraction of the US population in datasets from the 1990s. The problem is more tractable today with larger background knowledge databases, not less.
k-anonymity is a formal guarantee designed to limit this risk: in a k-anonymous dataset, every record is indistinguishable from at least k-1 other records with respect to the quasi-identifier columns. Achieving k-anonymity at k=5 or k=10 requires coarsening or suppressing enough quasi-identifier values that the dataset may be significantly less useful for ML training. And k-anonymity itself has known weaknesses: l-diversity and t-closeness are extensions that address scenarios where a k-anonymous dataset still leaks sensitive attribute values through lack of diversity within the anonymity groups.
What Synthesis Actually Does
A generative synthesis process works differently at the foundational level. It fits a statistical model to the real data, learning the joint distribution of values across all columns. Then it generates new records by sampling from that learned distribution. The output records are not transformations of real records. They are sampled instances from a probability distribution that was estimated from real records.
No synthetic record corresponds to any real individual. There is no row in the real dataset that the synthetic record is derived from. The values in each column are sampled values, not obfuscated versions of real values. If someone tries to re-identify a synthetic record by matching it against an external dataset, they will not find a match, because there is no real person whose record the synthetic row came from.
This means the re-identification attack surface is categorically different. The relevant privacy question for synthetic data is not "can an attacker link this record to a real individual" but "does the synthesis process preserve enough information about individual training records that an attacker could make inferences about those individuals." This is the membership inference problem, and it is a real risk that needs to be addressed during synthesis, not ignored.
But it is a different risk from record-level re-identification, and it is addressable through differential privacy mechanisms that add calibrated noise to the synthesis process. A synthesis pipeline with differential privacy guarantees provides a formal bound on how much any individual training record influences the outputs, which limits membership inference advantage. No anonymization technique provides an analogous formal bound on re-identification risk from quasi-identifier linkage attacks.
The Regulatory Picture
Under GDPR, "anonymous data" is defined in Recital 26 as information that does not relate to an identified or identifiable natural person. The Recital explicitly notes that "all the means reasonably likely to be used" for re-identification must be taken into account. This creates a dynamic definition: as re-identification techniques improve, data that was considered anonymous at the time of release may no longer qualify. Regulators and data protection authorities have consistently taken the view that truly anonymous data is difficult to achieve in practice and that many "anonymized" datasets retain enough information to re-identify individuals given sufficient background knowledge.
Synthetic data has a stronger theoretical claim to qualifying as anonymous data under this framework, because it was not derived from any real individual's record in the first place. The argument is not ironclad: a synthesis model with poor privacy controls that memorizes training examples may produce outputs that do contain information about real individuals. But a synthesis pipeline with rigorous differential privacy guarantees and a documented membership inference audit provides a more defensible claim to anonymity than a suppression or generalization based anonymization of the same dataset.
Under HIPAA, the situation is similar. Safe Harbor de-identification removes the 18 specified identifiers but leaves the underlying values in all other columns, which remain real patient values. Expert determination provides more flexibility but requires a qualified statistician's certification. Synthetic data generated from a HIPAA-covered dataset without any of the 18 identifiers being carried into the output, and with documented evidence that the synthesis process does not leak individual PHI, is a different kind of de-identification, and one that does not rely on the assumption that removing the 18 identifiers is sufficient.
Where Anonymization Still Makes Sense
We are not saying anonymization is useless or that synthesis is always the right choice. Anonymization is well-understood, has an established legal track record, and is appropriate for many use cases where the re-identification risk is low and the data minimization requirements are modest. If you are working with data that has few quasi-identifiers, a small population of interest, and a use case where coarsening values does not significantly degrade utility, anonymization may be sufficient.
The cases where synthesis provides a clear advantage are: datasets with many quasi-identifiers that make k-anonymization expensive, use cases where field value coarsening would materially harm model performance, contexts where a formal privacy guarantee rather than a best-effort heuristic is required, and situations where the data needs to be shared with parties outside the organization, increasing the re-identification risk surface.
The practical distinction: anonymized data is still a transformed version of real records, with all the re-identification risk that implies. Synthetic data is a statistically representative sample with no real individuals in it. The choice between them is not about which technique is philosophically superior. It is about which technique's risk profile is appropriate for your specific data, use case, and regulatory context.
Building a Synthesis Pipeline That Earns the Privacy Claim
Simply generating data from a statistical model is not sufficient to claim strong privacy guarantees. The synthesis pipeline needs to be designed to minimize individual record memorization. This means using training procedures with differential privacy mechanisms (such as DP-SGD for neural synthesis models, or noise-injected parameter fitting for simpler statistical models), setting privacy budget parameters at levels that provide meaningful protection rather than negligible epsilon values, and validating the outputs with membership inference audits before release.
The difference between "we generated synthetic data" and "we generated synthetic data with documented privacy guarantees" is the difference between a claim and a defensible position. We built the audit steps into our default pipeline because we think the second category is the only one worth offering. A synthetic dataset that carries meaningful re-identification risk through membership inference is not a materially better solution than anonymization. The point is to genuinely eliminate the personal data, not just to change how it is formatted.