How to use the k-anonymity and l-diversity checker
- Paste your table as CSV with a header row, and choose the separator if it is not a comma.
- Type the names of the quasi-identifier columns, which are the columns that could single someone out when combined, such as age, zip and sex.
- Optionally name a sensitive column, such as a diagnosis, to get the l-diversity count, and set the target k.
- Read the smallest group, the rows below your target and the unique rows, then download the groups as a CSV.
Formula
group = rows that share the same values in every quasi-identifier column
k = size of the smallest group
rows below target = rows in groups with fewer than k_target rows
l = smallest number of distinct sensitive values in any group
A table is k-anonymous when k is at least the target. A group with l = 1 shows the sensitive value to anyone who knows the person is in that group.
Six rows
The table has six rows with age, zip, sex and diagnosis. Grouping by age, zip and sex gives three groups: 20-29, 8001, F with 3 rows, 30-39, 8002, M with 2 rows and 40-49, 8003, F with 1 row.
The smallest group has 1 row, so k = 1 and the table does not meet a target of 2. One row is unique. For the diagnosis, the first group has 2 different values, the second has 1 (cold, cold) and the third has 1, so l = 1.
What k and l tell you
Removing names is not enough to make data anonymous. A combination of age, postal code and sex can pick out a single person in a small area. K-anonymity counts how many rows share each combination, so a group of at least k rows means a person cannot be told apart from k - 1 others by those columns alone.
It does not protect the sensitive value. If every row in a group has the same diagnosis, an outsider who knows a person is in that group learns it. The l-diversity count measures that, since it needs at least l different sensitive values in each group.
How people raise k
The usual steps are to make the columns coarser, for example age bands instead of exact ages or the first digits of a postal code, and to suppress or remove the few rows that are still in small groups. Rerun this check after each change to see the smallest group grow.
Passing a k check does not make a data set safe to release. Other data sets can be linked to it, and an attacker may know more than the columns you chose. Treat this as one simple test and ask a privacy specialist for any real release.
Assumptions and limits
- Columns are matched by name, ignoring case. Blank cells count as their own value.
- Quasi-identifiers are chosen by you. The tool cannot tell which columns could identify a person.
- The first record is the header, and up to 200,000 characters are read.
- Nothing is uploaded. The table stays in your browser.
Frequently asked questions
What target k should I use?
There is no single answer. Small values such as 5 or 10 are common in practice, but the right value depends on the data, the people and the rules that apply to you.
What is a quasi-identifier?
A column that is not a name or an ID but can identify someone when combined with others, such as birth date, postal code, sex, job title or a rare diagnosis.
Does passing the check make the data anonymous?
No. It shows the group sizes in this one table. Linking to other data and knowledge about a person can still reveal them.
What does l-diversity add?
It counts how many different sensitive values each group holds. A group that is large but has one sensitive value still reveals it.