Direct identifiers single you out alone; quasi-identifiers look harmless individually but combine into a unique fingerprint.

• Direct identifiers uniquely identify a person on their own: full name, Social Security Number, email/physical address, biometric data. The obvious move is to remove these.
• Quasi-identifiers (QIDs) are "seemingly innocuous" attributes that become identifying in combination: gender + age, birthdate + ZIP, occupation + education, geographic location.

The danger lives in the combination. Research shows 87% of the U.S. population is uniquely identifiable from just three quasi-identifiers: ZIP code, birthdate, and gender. None of those is a name, yet together they pinpoint almost everyone. This is the reason "we deleted the names" is never enough.

Tip: Attacks don't target the name you removed — they target the fingerprint you left behind.

k-anonymity makes each record indistinguishable from at least k-1 others on its quasi-identifiers — hiding everyone in a crowd — via generalization and suppression.

* Generalization turning records into 2-anonymous groups. — HTriedman (WMF), CC BY-SA 4.0, via Wikimedia Commons. *

The promise: if k=5, your record looks identical to 4 others on the QIDs, so an attacker who matches you faces 5 indistinguishable candidates and can't single you out. It delivers three things: group protection, prevents isolation (no unique standouts), and privacy through ambiguity (attackers can't tell group members apart).

Two operations build the equivalence classes:

• Generalization — replace a specific value with a broader category (Age 27 → 20–30; ZIP 94301 → 943**; salary 87,500 → 80k–90k band).
• Suppression — remove or mask outlier values entirely (rare occupations → *, extreme ages dropped, unique combinations eliminated).

Tip: Generalization blurs values; suppression deletes them. Both shrink the number of distinct QID combinations until each group reaches size k.