Websites release statistics on their user base all the time and it’s not considered a breach of privacy because their user bases are so large that it’s impossible to pick apart who thinks or watches what. Additionally when nations or states or counties release election results it is impossible to figure out who voted for what even if the county has a miniscule population.

To be clear if the population is 1 then the results are never anonymous, and the more people there are the harder it is to see who answered what. Assuming that we know everyone in the voting pool.

But let’s say a survey with 1000 yes or no questions is released to all the residents of a county and when the survey was over results were shown which were based on a system of 1 for yes answers and 0 for no answers giving you totals for each question.

Do the more detailed results make it easier to piece together who said yes or no to what?

And if so how many people would need to answer the survey before the results were completely anonymous? Or sufficiently anonymous?

  • 3
    Many years ago I worked for a very large computer company that did annual employee surveys, the feedback was always "anonymized". One particular year the result of the questions about our direct department manager came back as: 100% rated the manager the lowest possible rating. So much for anonymity! Feb 19, 2021 at 4:26
  • I wish Stack Overflow had options to react to and not just upvote that one ^^. You can't completely anonymize a system where users get to choose from the same set of options. Even with elections, political campaigns know that certain areas are definitely going to vote one way or the other.
    – Limit
    Feb 19, 2021 at 6:49
  • The security question would be does the system allow someone to know what somebody else answered? (whatever the number of received answers). The current one is only on statistics. If you only give the overall result for a population of size 1000, there is no problem. But if you give the results by town and if a (very) small town has less that 10 inhabitants then the statistical anonymity is no longer guaranteed. Only a comment because it is not IT security related... Feb 19, 2021 at 7:52

2 Answers 2


You're asking what is the number n of survey respondents such that n is higher than the threshold for anonymity. I feel like this is putting the cart before the horse. To answer questions about how many responses you would need for it to be anonymous requires knowledge of the population, which is the entire point of a survey. That leads us to...

A concept called k-anonymity. It's not strictly what you're asking for. But k-anonymity looks at the existing data and determines strategies for altering it to provide anonymity. In theory, this would work on whatever size data set you end with. The caveat being that the suppression and generalization operations required could render the data less useful.

  • What if you allow people to opt out of answering individual questions. So for example some questions would be like 635/1000 and others would be like 345/945. So 55 unknown people opted out of answering one question but not another, does that make the survey more anonymous or less?
    – Ethan
    Jul 17, 2021 at 11:01
  • To clarify something in that previous comment, The results displayed would not be shown as "635/1000" and "345/945", instead all you would see was "635" and "345". Or potentially you could have all results displayed as percentages. I feel like if you combined opt-out voting with percentage-based results you could make it much more anonymous. No one could tell whether only 5 out of 1000 people actually voted on something, and as a result, the released data would be close to indecipherable except for its desired purpose.
    – Ethan
    Jul 18, 2021 at 7:44

No number is high enough, if the questions are specific enough. For instance, in the US legal residents will have either a SSN or TIN, 90 questions would identifying all legal residents (first number 0?, 1?,2?, etc). You need to examine not the number of the surveyed, but the number of unique answers.

For instance, in a company, if a manager is identified in your questionnaire along with a 1-10 rating, the ability to identify which employee gave what rating is limited by the number of unique answers. An even distribution (employees a multiple of 10) and there’s a 1 in 10 probability just on that one question, everyone answers the same and there’s no anonymity at all on that specific question. Conversely, even if the rating was 1 in 1000 and the manager had more than a 1000 employees and one gave 1 rating while 999 gave 100, it probably wouldn’t be too hard to identify that employee.

Given a 1000 yes/no questions, that is 2^1000 different possible responses, to be truly anonymous, you’d need more than that many responders, and you’d also need a reasonable distribution of answers on all questions (have you ever been President of China is not going to get a lot of yes answers).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .