I hope you won't close the question. Even though there are no computers involved, it is still about information and security, and I think that security experts are the ones who will be able to help best.

I want to do some user research. I need people to fill out a questionnaire, and then fill out another questionnaire two months later. I need to guarantee them anonymity, but it will still be very good if I can match the answers from a person from round A to answers from the same person from round B.

Even if this is done online, I don't think that I can let a computer system find out something about them so it can do the matching for me. In theory, I could ask them for a name and store its md5 hash. In practice, if I tell the participants they will be anonymous and then ask them for a name, I will lose their trust. And the beginning of a questionnaire is not a good place to educate random people about what md5 is. But to make this even harder, I think that I will do my next survey using pen and paper, for logistical reasons.

If I started giving people tokens, I think they will lose them during the two months. So the best solution I can think of is some sort of manual hash. For example, I could ask them "please fill the second and fifth letter of your surname and the day of month you were born". So my question is, how do I come up with a good function of this kind?

  • which data points about a person can be used? They must be guaranteed to exist (my above example breaks down if the person has a four-letter surname), highly individual (but not 100% unique), and the person must know them without having to look them up somewhere.
  • Is there some convenient way to calculate how many digits/letters I need to ask for to ensure a collision chance below X% in a group of Y people?
  • Are some of the possible data more problematic than others? For example, could it be that people would be more reluctant to write down the first letter of their surname than the second, because they think it would be easy for someone to try to look them up in a "brute force attack" and find out who they are?
  • How do I find out the highest level of complexity beyond which people either don't play along or start making mistakes?

2 Answers 2


There was a study done, to which unfortunately I do not have a link, using which they found out that even when user's data did not contain personally identifiable information, they could track individuals from other attributes so long as they had rough idea of their location. Now this may or may not be as much applicable to dense areas as to sparse areas, but if someone promises anonymity, it can be a concern.

With the approach that you are suggesting, how do you guarantee that they will get to the same code both times, and not make a slightest mistake to arrive at a different code? Remember, they have no way to verify it.

Since your question is open ended, there're a few different kinds of approaches that you can take:

1) When you are distributing them the questionnaires, can you just give both upfront? For example, have them fill out one immediately, and then have the other in a sealed envelope that they open up two months later and then fill up? If that's possible, of course, you can have same ID on both surveys. There is of course the possibility of them losing the survey, but I think you will have to assume in your sample that some folks who are surveyed the first time will not be providing surveys the second time. It is probably a little less likely that they will lose surveys vs a code that you had provided.

2) Perhaps you can have them use an online CRC32 or MD5 hash function using their last four digits of their phone, two digits of their address, etc. or some simple combination like that. They will still not be giving too much personally identifiable information, and they can verify that the site they're getting the hash from is not related to you, if they have concerns. This is not as user friendly, but definitely more friendly than they calculating their own hash, using the scheme you specified in your question. (for example, see here: http://www.fileformat.info/tool/hash.htm -- you can also search for "calculate hash online" or something similar. I am sure there will be some phone apps too.)

As for the code approach that you have, keep in mind that any time you use any variable that's in a database somewhere, the users will be trackable. For example, my doctor's office has my social security, my date of birth, my name -- no matter how you ask me to put it on the survey, someone can easily run an automated tool to find out what the codes will be calculated for each of those records and find the survey. Of course, it boils down to how important is it to be anonymous and what you're promising and the impact if someone were to trace the survey to an individual.

FYI. The hash approach in #2 is also vulnerable to the same approach, although a little more effort is required depending on the hash used.

Sorry, that's the best I can think of as of now, hopefully, it will help you go towards a solution. IMO, if you can go with #1 approach above (give both surveys upfront), that's the best way to approach it and ensure high level of anonymity.

  • When you are distributing them the questionnaires, can you just give both upfront? -- simplicity itself. I'm upvoting this one :-)
    – LSerni
    Commented Jun 7, 2014 at 20:50
  • 1
    The original study (Sweeney 2000) found 87% of people are identifiable by zip code + gender + year/month/date of birth and a followup study found 63% identifiable by those criteria.
    – dr jimbob
    Commented Jun 8, 2014 at 1:04

You could ask the last three digits of their cellphone number.

Just be clear about why you are doing so, and explain why they won't be traceable this way. Otherwise, they'll tell you numbers (or letters, or anything) at random, and the purpose will be defeated.

As for the probability, supposing the distribution is flat and the "token" can assume N values (in this example, that would be 998 - I think "000" might not be a valid ending in some countries), and you are asking M persons, then the probability of having a collision is 1 - (998/998)(997/998)(996/998)...((998-M)/998).

With 200 people, you have a maximum likelihood of having around 18-19 collisions, and it is very unlikely you'd get less than 10 collisions, or more than 30. Which means that you'll "recognize" 170 people out of 200.

With four digits and 200 people, you can expect 1-2 collisions; chances are negligible of getting more than 8-9 collisions.

With 500 people and four digits (or anything else that can assume around ten thousand randomly distributed values - you can get one digit from the car's license plate, one from the last number of streed address, one from last digit of year of birth, and so on) you can expect 12-13 collisions and again no real chance of getting less than 2 collisions, or more than 22.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .