Glossary/Privacy and identity/Pseudonymization
What is pseudonymization and how is it different from anonymization?
What pseudonymization means under GDPR, how it differs from anonymization, the common techniques, and why it matters when publishers use reader data for advertising.
Written by Samhub with the help of AI·Updated 13 Oct 2026·3 min readPseudonymization is processing personal data so it can no longer be linked to a specific person without additional information, which is kept separately and protected. It is defined in the GDPR, article 4(5).
Pseudonymization vs anonymization
| Pseudonymized data | Anonymized data | |
|---|---|---|
| Can be linked back to a person | Yes, with the separate key or information | No, not by any reasonable means |
| Personal data under GDPR | Yes | No |
| Useful for advertising | Yes, profiles and audiences still work | Mostly for statistics |
| Example | A reader ID instead of an email address | A count of readers per region |
The key point: pseudonymized data is still personal data. GDPR still applies, but pseudonymization is recognized as a safeguard that lowers the risk.
Common techniques
Hashing with a salt
An email is turned into a fixed code. The salt, a secret value, makes it hard to reverse by guessing.
Tokenization
An identifier is replaced by a random token, and the link is stored in a separate, protected table.
Encryption
Data is encrypted, and only those with the key can read it.
16 pages for publishers, with a checklist for data, programmatic and direct sales.
Why it matters for publishers
Audience data does not need names or email addresses to be valuable. Pseudonymized reader IDs let you build profiles and audiences while keeping direct identifiers out of the advertising systems. Combined with consent and EU-based processing, it lowers the risk when audiences are shared with partners.
Addressability at Stampen Media after moving its reader data into one layer with Samhub.
Frequently asked questions
Yes. As long as it can be linked back to a person with additional information, it is personal data under GDPR.
No. A hashed email can be matched with the same hash elsewhere, so it is pseudonymized, not anonymized.
You need a legal basis, as for any personal data. For advertising profiles this is usually consent.
It lowers the risk if data leaks, supports security requirements and makes it easier to share audiences without exposing who the readers are.
Related terms
Any information that relates to an identifiable person.
An email address turned into a fixed code that cannot be read back.
The GDPR contract between a controller and a processor.
The industry standard for passing consent to ad tech vendors.
One EU-based platform to collect, unify and enrich your first-party data, installed with one script.
- A walkthrough with your own data
- Built for publishers and media houses
- 30 minutes, no commitment
Turn your audience data into more revenue
Get the Media Monetization Playbook: how media houses turn first-party data into higher CPMs, data deals and direct sales. With checklists for every step.
