Skip to main content
Cookie Gate
Category: Tracking Technologies

Pseudonymous Identifier

Also known as: Pairwise Pseudonymous Identifier
Simply put

A pseudonymous identifier is a value used to refer to a person or account without directly revealing who they are in the real world. It typically replaces directly identifying information with a unique but meaningless code, so a party using it cannot infer personal details from the identifier itself. However, the person may still be re-identifiable if the identifier can be linked back to additional information.

Formal definition

A pseudonymous identifier is a unique value assigned to a subject that permits association or correlation of records relating to that subject while not, on its own, allowing a relying party to infer the subject's real-world identity. It is a product of pseudonymisation, the set of techniques that replace, remove, or transform directly identifying information within a data record. In identity-federation contexts, a pairwise pseudonymous identifier is a variant generated by an identity provider for use at a specific relying party, limiting cross-service correlation. Because a pseudonymous identifier can generally be re-linked to an individual using additional information, it is typically treated as pseudonymised rather than anonymised data; under the UK GDPR and GDPR, pseudonymised data that remains attributable to a person continues to constitute personal data. Whether a given identifier is truly non-attributable depends on facts (such as the availability of linking keys) not resolved by this definition alone.

Why it matters

Pseudonymous identifiers sit at the centre of a common misunderstanding in cookie and tracking compliance: the assumption that because an identifier is not a name or email address, the data attached to it falls outside data protection law. Under the GDPR and UK GDPR, pseudonymised data that remains attributable to an individual generally continues to constitute personal data. This means that cookie IDs, advertising identifiers, and similar values used to correlate a user's activity across sessions or services are typically still governed by data protection obligations, even though the identifier itself is a meaningless code. Treating such identifiers as if they were anonymous can lead organisations to skip consent, transparency, or record-keeping steps that may in fact be required.

The distinction matters because pseudonymisation reduces risk without eliminating legal responsibility. Replacing directly identifying fields with unique codes can limit exposure if data is breached and can support data-minimisation principles, but it does not by itself make data anonymous. Whether a particular identifier is genuinely non-attributable depends on facts such as whether linking keys or additional information are available to re-identify the person. Because these facts vary case by case, the compliance status of an identifier cannot be assumed from its form alone.

For teams designing consent and tracking systems, the practical consequence is that the placing of and access to these identifiers on a user's device is generally governed by the ePrivacy rules and their national implementations in the EU, while any subsequent processing of the personal data linked to them is governed by the GDPR. These are separate obligations, and clarity about which identifiers remain attributable helps determine which requirements apply.

Who it's relevant to

Privacy officers and data protection professionals
These readers need to assess whether identifiers used in tracking and analytics remain attributable to individuals and therefore constitute personal data under the GDPR or UK GDPR. Recognising that pseudonymised data generally remains personal data helps them avoid wrongly excluding cookie and advertising identifiers from consent, transparency, and record-keeping obligations. The attributability assessment depends on facts, such as who holds the linking information, that must be evaluated case by case.
Web developers and engineers
Developers implementing consent management and tracking systems work directly with pseudonymous identifiers when assigning cookie IDs or similar values. Understanding that these codes typically still permit correlation of a user's records helps them design systems that respect data-minimisation goals, for example by using pairwise identifiers to limit cross-service correlation, while recognising that such measures reduce rather than remove legal responsibility.
Legal counsel and compliance teams
Counsel advising on cookie and tracking practices must distinguish pseudonymised data, which generally remains within the scope of data protection law, from genuinely anonymised data, which may fall outside it. Because that distinction turns on unresolved facts about re-identifiability, legal judgement is required; the presence of a pseudonymous identifier does not by itself determine compliance status.

Inside Pseudonymous Identifier

Pseudonymous Value
A replacement identifier (such as a hashed value, randomly generated token, or cookie ID) that stands in for a directly identifying attribute, allowing a user or device to be recognized across sessions or contexts without exposing a name, email, or other direct identifier.
Separation of Additional Information
Under the GDPR, pseudonymization requires that the information capable of re-linking the identifier to a specific individual be kept separately and subject to technical and organizational measures. The pseudonymous identifier alone should not permit attribution without this additional information.
Re-identification Potential
A defining characteristic is that the identifier can still, in principle, be linked back to an individual using the separately held data. This distinguishes pseudonymous data from anonymized data, which cannot reasonably be re-associated with a person.
Personal Data Status
Because re-identification remains possible, pseudonymous identifiers are generally treated as personal data under the GDPR, and their processing therefore falls within the scope of that regime rather than being exempt from it.
Device-Level Context
In the cookie and tracking context, pseudonymous identifiers are frequently stored in or derived from cookies, local storage, mobile advertising IDs, or SDK-generated tokens, which ties their use to both the ePrivacy rules on device access and the GDPR rules on subsequent processing.

Common questions

Answers to the questions practitioners most commonly ask about Pseudonymous Identifier.

Does pseudonymising an identifier mean it is no longer personal data and falls outside the GDPR?
No. Under the GDPR, pseudonymisation is expressly treated as a security and data-protection measure, not as anonymisation. A pseudonymous identifier remains personal data because the underlying individual can still be re-identified, for example by combining it with additional information held separately. As a result, processing based on pseudonymous identifiers generally remains subject to the GDPR in full, including principles around lawful basis, transparency, and data subject rights. This differs from truly anonymised data, which is no longer attributable to an individual and is generally outside the GDPR's scope.
Because pseudonymous identifiers don't contain a name or email, can I set them without consent?
Not necessarily. The absence of a directly identifying detail such as a name or email does not by itself remove consent obligations. In the EU, the placing of or access to an identifier stored on a user's device is governed by the ePrivacy rules, which generally require prior consent unless the identifier is strictly necessary. Separately, any subsequent processing of the pseudonymous identifier as personal data must have a lawful basis under the GDPR. Whether consent is required therefore depends on the technology used and the purpose, not on whether the identifier looks anonymous. Requirements may differ in the UK and across US state regimes, which often rely on opt-out mechanisms.
How should a consent management platform (CMP) handle pseudonymous identifiers used for analytics or advertising?
A CMP typically governs whether identifiers tied to non-essential purposes, such as analytics or advertising, are set only after the required consent (in most EU jurisdictions) or after honouring an opt-out signal (in certain US states). In practice this means the CMP should suppress the creation or transmission of the identifier until the applicable condition is met, and should link the identifier's use to the relevant consent state. A CMP supports this control but does not by itself determine the correct legal basis; that remains a matter of legal judgment based on the specific purposes and jurisdictions involved.
What should we record when logging consent that relates to pseudonymous identifiers?
Consent record-keeping generally aims to demonstrate that valid consent was obtained where it was required. For pseudonymous identifiers, this typically involves associating the consent record with the same identifier or session context used to apply the user's choices, along with information such as the purposes consented to, the timestamp, and the version of the notice or configuration presented. Because the identifier is itself personal data, the log should be handled under the same data-protection principles, including data minimisation and retention limits. The precise fields expected can vary with regulator guidance and the framework in use.
How do opt-out signals such as Global Privacy Control interact with pseudonymous identifiers?
Where a framework recognises browser-based opt-out signals such as Global Privacy Control, receiving such a signal may require that pseudonymous identifiers used for purposes like targeted advertising or certain data sharing are not set, or are stopped, for that user. This model is associated with several US state privacy regimes that rely on opt-out rather than opt-in. In most EU jurisdictions, by contrast, the starting point is that consent is required before such identifiers are used. How a specific signal must be honoured depends on the applicable law and evolving regulatory expectations.
What steps help keep pseudonymous identifiers aligned with data minimisation and retention obligations?
Common measures include limiting the identifier to the specific purposes for which a lawful basis exists, keeping the additional information needed for re-identification separate and access-controlled, and setting defined retention periods after which the identifier and associated data are deleted or further reduced. Because the identifier remains personal data, it should also be covered by mechanisms for handling data subject or consumer rights requests. These are organisational and technical supports; whether a given approach is sufficient depends on the specific processing and the requirements of the relevant jurisdiction.

Common misconceptions

Pseudonymous identifiers are anonymous data and therefore fall outside the GDPR.
Pseudonymization is not the same as anonymization. Because a pseudonymous identifier can generally still be linked to an individual using separately held information, it is typically treated as personal data under the GDPR, and its processing remains subject to that regime. Only data that cannot reasonably be re-associated with a person is considered anonymous and outside GDPR scope.
Using pseudonymous identifiers removes the need for consent when placing them via cookies or similar technologies.
The consent question is governed principally by the ePrivacy Directive and its national implementations, which regulate placing or accessing information on a user's device regardless of whether that information is pseudonymous. In most EU jurisdictions, storing or reading a pseudonymous identifier for analytics or advertising generally requires prior consent, and pseudonymization of the value does not by itself create an exemption.
Pseudonymizing an identifier is a one-off technical step that permanently reduces compliance obligations.
Pseudonymization is treated as a risk-reducing safeguard rather than a compliance endpoint. It does not exempt the processing from data protection principles, data subject rights, or lawful basis requirements, and its effectiveness depends on the additional information being kept genuinely separate and protected. Whether a given approach qualifies can depend on facts not captured by the identifier alone.

Best practices

Keep the additional information needed to re-identify individuals logically and technically separate from the pseudonymous identifiers, and apply access controls and other safeguards to that separately held data.
Continue to treat pseudonymous identifiers as personal data for GDPR purposes, ensuring a lawful basis, transparency, and data subject rights handling are addressed rather than assuming the data is out of scope.
Assess cookie and device-access obligations independently under the applicable ePrivacy rules, recognizing that placing or reading a pseudonymous identifier via cookies, local storage, or SDKs generally requires prior consent in most EU jurisdictions for non-essential purposes.
Document the geographic and legal scope of your processing, since requirements differ between the EU, the UK, and individual US states, and pseudonymization is treated differently across these regimes.
Avoid describing pseudonymous data as anonymous in privacy notices or records, and reserve the anonymization label for data that cannot reasonably be re-associated with an individual.
Periodically review whether the pseudonymization measures remain effective as data holdings, linkage capabilities, and regulatory guidance evolve, and involve legal judgment rather than relying on the technical measure alone.