Industry Reference
Cross-vertical comparison and patterns for anonymization engagements. Each vertical has its own reference page — start here to orient, then jump to the vertical you need.
Abbreviations used in tables: SDP = Sensitive Data Protection; HMAC = keyed-hash message authentication code; FPE = format-preserving encryption; DDM = dynamic data masking; CDR = Call Detail Record; MSISDN = subscriber phone number.
For the narrative treatment, see the industry deep dives in the learning path.
| Vertical | Key challenge | Reference |
|---|---|---|
| Telco | Mobility sequence uniqueness — 4 spatio-temporal points identify 95% of individuals | Telco reference |
| Retail / e-commerce | Multi-domain identity + purchase sequence uniqueness | Retail reference |
| Financial services | Regulation prohibits anonymization of operational data | Financial services reference |
| Energy / utilities | NILM inference from smart meter temporal patterns | Energy reference |
Cross-vertical comparison
| Dimension | Telco | Retail | Financial services | Energy |
|---|---|---|---|---|
| Zone 0 retention | Days (ePrivacy: traffic/location data) | Days to weeks | Years (AML/MiFID mandates) | Days (operational metering) |
| Zone 1 anchor identifier | MSISDN | Resolved canonical customer ID | Account number | Meter ID / customer ID |
| Zone 1 primary technique | HMAC; FPE if format needed | Deterministic encryption (cross-domain joins) | Tokenization (PCI for payment); HMAC for accounts | HMAC for meter ID |
| Zone 2 approach | k-anonymity on CDR attributes (k ≥ 50) | k-anonymity on customer profiles; sequence aggregation | k-anonymity on transaction summaries | Temporal aggregation + location generalization |
| Zone 3 primary use | Mobility analytics, network planning, data monetization | Marketing analytics, partner sharing, benchmarking | Risk modeling, market research, regulatory reporting | Grid planning, demand forecasting, carbon accounting |
| Hardest problem | Mobility sequence uniqueness | Cross-domain identity + purchase sequence uniqueness | AML retention preventing anonymization | NILM inference from temporal patterns |
| Key re-ID stat | 4 spatio-temporal points → 95% unique | 4 transaction points → 90% unique; 3 with price | Operational data cannot be anonymized | 5 half-hourly readings → 90%+ households |
| Sector-specific regulation | ePrivacy Directive | PCI-DSS v4.0.1 | AMLD/AMLR, MiFID II, PSD2, DORA | Electricity Directive, national metering law |
Recurring data types across verticals
These five data types appear in every vertical with consistent anonymization characteristics:
| Data type | Where it appears | Re-ID risk | Standard treatment |
|---|---|---|---|
| Location data | Telco (cell ID), retail (store/IP), finance (ATM/branch), energy (meter/charger) | Very high — small number of spatio-temporal points uniquely identifies most individuals | Generalization to area/cluster + temporal bucketing; DP for aggregates |
| Transaction sequences | CDR sequences, purchase history, transaction history, consumption profiles | High — behavioral fingerprints from 3–4 events | Sequence-level aggregation or DP; per-event generalization insufficient |
| Device identifiers | IMEI/IMSI, cookie/device fingerprint, device binding, meter ID/EV ID | Medium–high — persistent cross-session linkage | HMAC or FPE per domain; suppress when cross-session linking not needed |
| Temporal patterns | Timestamps on every event type across all verticals | Medium — temporal regularity enables re-ID | Bucketing (15min → hourly → daily); precision depends on use case |
| Account/subscriber profiles | Slowly changing dimension linking events to individuals | High — direct + quasi-identifiers combined | Direct ID pseudonymization; QI generalization; access-controlled zones |
Transferable architecture decisions
These decisions have the same shape in every vertical — swap the anchor identifier and the logic is identical:
| Decision | Options | What determines the choice |
|---|---|---|
| Pipeline-integrated vs. query-time | Pipeline: SDP in Dataflow. Query-time: BigQuery DDM. Most use both. | If most consumers need pseudonymized data → pipeline. If different teams need different masking → DDM. |
| Key architecture | HMAC (irreversible), FPE (format-preserving, reversible), deterministic encryption (joinable), vaulted tokenization (random, reversible) | Re-identification needed (customer support, regulatory requests)? Format compatibility required? Cross-system joins needed? Erasure strategy is a separate decision — HMAC records can be deleted directly; crypto-shredding (per-subject DEKs) handles distributed erasure without requiring reversible pseudonyms. |
| DP budget allocation | Sequential composition, parallel composition, Rényi DP for tighter accounting | Split by analytical use: telco → mobility; retail → conversion/basket; finance → risk reporting; energy → demand forecasting |
Vertical quick reference
Use this when scoping a new engagement to quickly identify the vertical-specific considerations:
| Question | Telco | Retail | Financial services | Energy |
|---|---|---|---|---|
| Can all data be anonymized? | Yes (with ePrivacy retention limits) | Yes (with PCI scope reduction) | No — operational data must stay identifiable | Yes (with temporal aggregation) |
| What's the first technique to implement? | HMAC for MSISDN | Identity resolution + deterministic encryption | Classification scheme (anonymizable vs. retained) | Temporal aggregation |
| What regulation gates the architecture? | ePrivacy (consent for location) | PCI-DSS v4.0.1 (payment tokenization) | AMLD/AMLR (retention mandates) | National metering law (consent for granular data) |
| First regulatory question to ask | "Do you have consent tracking per subscriber for location processing?" | "How are payment card numbers stored and protected?" | "Which datasets are under AML retention mandates?" | "What temporal resolution does the analytics use case actually need?" |
| All applicable regulations | GDPR + ePrivacy | GDPR + PCI-DSS v4.0.1 + ePrivacy (cookies) | GDPR + AMLD/AMLR + MiFID II + DORA + (Swiss: FADP + Banking Secrecy) | GDPR + national metering law + EU Electricity Directive |
| What's the strongest presales argument? | "4 points identify 95% — your lookup table isn't enough" | "Your identity silos are a liability — unify and control" | "You can unlock analytical value without touching AML data" | "NILM reveals household behavior — aggregation is essential" |
| Where is the quick win? | Replace unsalted hash with HMAC | Add BigQuery policy tags to PAN columns | Label datasets by retention status | Aggregate 15-min to hourly for analytics |