Anonymisation of images is harder than of tables

Usually less than it sounds: on an image dataset, "anonymised" tends to mean the filename or account link was removed, while the identifying detail stays in the pixels themselves. The word was built for spreadsheets, where removing the name and address columns can work, and photographs do not have columns.

What the claim usually means in practice

Most of the time, "anonymised" on an image dataset means one of a short list of things: the filename was replaced with a random string, the account that uploaded the photo was disconnected from the stored file, or a face-detection step blurred or cropped anything that looked like a face. Each of those is a real step and each removes a real linkage. None of them removes identifying information from the image content itself, because the image content is not where the removed information lived.

The distinction matters because the two kinds of identifier behave differently. A filename or an account ID is metadata: strip it and it is gone. A birthmark, a tattoo, a scar, a bed frame, a wall poster, a distinctive piece of furniture: these are in the pixels, and no metadata operation touches them.

Linkage and uniqueness are the real problem

The technical term for what makes anonymisation hard is re-identification through linkage: a record that looks anonymous on its own can still be matched back to a person if it shares enough detail with something else that is not anonymous. For tabular data, researchers have shown repeatedly that a handful of quasi-identifiers - date of birth, postcode, gender - is often enough to re-identify most rows in a supposedly anonymised dataset, because the combination is close to unique. Rocher, Hendrickx and de Montjoye (2019) estimated that "99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes." The UK regulator frames the test the same way: the ICO's anonymisation guidance asks what means are "reasonably likely to be used by someone motivated to identify people," and treats linkability across records as a core risk.

Photographs carry the same risk at a higher resolution. A body photo that also appears, uncropped, on a public profile somewhere is now linked to that profile regardless of what the training pipeline calls it. A photo with a background detail that also shows up in another photo you posted somewhere is linked the same way. Uniqueness does the linking, not any single piece of metadata, which is why removing metadata alone does not deliver what "anonymised" implies.

What would make the claim closer to true

A dataset gets meaningfully closer to anonymous when the images themselves are altered in ways that remove distinguishing detail, not just the record around them - aggressive cropping to the region actually needed for the task, generated stand-in images instead of real uploads, or synthetic augmentation that never touches a real photo at all. The privacy trade of training on generated images instead is a real approach and worth reading if this is the part of the pipeline you care about. Differential privacy, a mathematical guarantee about how much any single training example can influence the final model, is the closest thing to a rigorous answer, and it is rarely mentioned in a consumer-facing privacy policy because it is expensive and constraining to implement.

None of this means every claim is false. It means the word is doing more work than it can support unless the policy says specifically what was removed and how, and a claim without that detail is a claim you cannot verify. Whether a body photo without a face still counts as personal data is the question underneath all of this, and it does not go away just because a dataset was labelled anonymous.

Where to read the pieces this touches

Measure My Cock's data practices are a useful comparison point, since a measurement-focused tool handles a different kind of dataset with its own disclosure questions. On the labelling side, a review by a person is a separate exposure from anything a dataset claim covers, and Rate Penis writes up what a human-reviewed judgment actually involves. Rate Cock is one of the tools whose privacy policy is worth reading against this list rather than taking on trust, and the same test applies to any service that stores what you send it. A hash is sometimes offered as the anonymising step in place of the image, and that substitution deserves its own scrutiny - the property that makes a hash useful for recognising a repeat upload is close to the property that makes it not anonymous. Reading an "anonymised" claim against a tool's actual behaviour, rather than taking the word at face value, is the same habit Penis Rater's rundown of how to evaluate a scoring tool walks through for the rest of a privacy policy.