When you take part in a data task, some of what you share is in your own words: searches you typed, pages you browsed, conversations you had with an AI assistant. Before any of that leaves Measure, we put it through a process we call scrubbing.
This page explains what scrubbing does, what it cannot do, and where we have drawn the lines.
The short version
- We remove the things in your data that could lead back to you. Not just your name, but combinations of details, and specific phrases that could be matched against records someone else holds.
- Removing your name is not enough, and we do not pretend it is. People can be identified without one.
- Where something cannot be cleaned up without destroying what makes it useful for research, it does not leave. It stays inside our secure environment, and only summaries, patterns or models come out.
- Scrubbed data is anonymous to the person receiving it. It is not anonymous to us. We still hold the key that links it to you, which is why you keep all your rights over it.
- None of this is used for advertising unless you separately opt in.
What is scrubbing?
Scrubbing means going through data before it is shared outside Measure and removing anything that forms a link back to a real person.
We look for what we call bridges. A bridge is anything in the data that could carry someone from the content back to you. Our job is to find every bridge and remove it, using the lightest change that works, so that the data is protected and the research still means something.
Why isn't removing my name enough?
Because people can be identified without a name.
Say a piece of text contains no name, no email and no account, but does say âas a 34-year-old nurse in Brighton with two kidsâŠâ. Nobody is named. That combination may still narrow to a very small number of real people, possibly one. It is identifying, and the law treats it that way.
So the test is not âdid we delete the obvious identifiersâ. It is three harder questions:
- Can someone be singled out? Is any record specific enough that only one person could match it?
- Can it be linked? Could this be joined to another record about the same person?
- Can something be inferred? Could someone work out who this is, or learn a new fact about an identified person?
If the answer to any of those is yes, the data still counts as personal and we have not finished.
We apply the standard the UK regulator expects. The question is not whether a determined expert with unlimited resources could do it. It is whether re-identification is reasonably likely for someone motivated to try, using records and tools realistically available to them.
What do you look for in my own words?
Four kinds of bridge, each handled differently.
- A direct identifier written into the text, such as a name, email address, phone number, handle or account number. We remove it. âHi, Iâm [name], do these tablets cause nausea?â becomes âdo these tablets cause nausea?â
- A combination of smaller details that together narrow to one person: age, plus job, plus town, plus family situation. We generalise it. âAs a 34-year-old nurse in Brighton with two kidsâŠâ becomes âas a healthcare worker and parentâŠâ The research point survives. The combination no longer points at anyone.
- A story specific enough to be a fingerprint. A detailed account of a real chain of events, with no name attached, but with enough true detail that someone who knew the situation would recognise it. We reduce it to its theme, or it does not leave. A long account of a particular workplace accident and the claim that followed becomes âa denied workplace-injury compensation claimâ. A person, not software, makes this call.
- An exact phrase that could be matched against someone elseâs records. This one is less obvious. A very specific string of text can act like a key. If the same words, at the same moment, also sit in a log another company holds against your identity, matching the two is easy. We rewrite and generalise so the exact match is broken. âBest price 2019 VW Tiguan SEL in BN1 3GHâ becomes âused mid-size SUV pricingâ.
(Examples are illustrative and fictionalised.)
After any change we run the checks again on the result. Something counts as scrubbed only when a fresh pass finds no bridges at all.
Is rare the same as identifying?
No. This is a common misunderstanding.
Roughly one in seven searches people type each day has never been typed before, and almost none of them identify anyone. A one-of-a-kind question about a firmware update on a pair of headphones is unique and completely anonymous.
So we do not judge your text by how unusual it is. We read it for whether it carries a bridge to a person. Rarity matters in one way only: an unusual exact phrase is easier to match against someone elseâs records. We handle that as the fourth kind of bridge above.
What happens to something that can't be cleaned up?
Sometimes what makes text valuable for research is the same thing that makes it identifying. Generalising it away would leave nothing to study.
When that happens we do not force it out the door. The material stays inside our secure research environment. What can leave is aggregate findings, patterns across many people, or a trained model, never the underlying text. We would rather hold something back than release a weakened version and call it anonymous.
What about journeys?
A journey is a time-ordered sequence of your activity: what you did, in what order, and when.
Journeys need extra care, because a sequence of timestamped events is close to a fingerprint. A handful of points in time and place can be enough to pick one person out of a very large crowd. Cleaning up the words in a journey does not fix this, because the pattern itself is what identifies.
So for journeys:
- We scrub identifiers and references as described above.
- Journeys contain no location data.
- We share them only with research recipients who do not hold a dataset the sequence could be matched against, so the pattern has nothing to match to. Those recipients use the detail to find broad behavioural patterns, not to look at individuals.
- Detailed individual journeys are not made available for advertising on this basis. If your journey data is ever used for advertising, that happens only through the separate opt-in described in the Privacy Notice, and it runs on consent rather than on an anonymity argument.
What about my age, location and other profile details?
Free text and structured details need different tools, and both have to pass.
For structured fields such as age band, region or demographics, we use established statistical measures:
- No small groups. Any combination of details we release has to be shared by at least five people, so nobody stands alone in a category of one. This is the same threshold the NHS uses for health data.
- No uniform groups. Within any such group, sensitive attributes have to vary. A group of five people who all share one health condition would reveal that condition about every one of them, even though no individual was singled out.
- A tested ceiling on leftover risk. We simulate attempts to single out, link and infer, and require the estimated residual risk to stay under a set limit.
A release has to clear the statistical checks and the free-text checks. Passing the numbers does not help if an identifying story survived in the text.
So is scrubbed data âanonymousâ?
The answer has two parts.
To the recipient: yes. Once the bridges are gone, someone receiving the scrubbed output has no route back to you. That is what scrubbing is for, and it is what lets us share research findings safely.
To us: no. We still hold the key that links your data to your account. Everything we hold about you therefore remains your personal data, you keep every right over it, and we remain fully responsible for it. We do not use scrubbing to sidestep that.
Two further points:
- Anonymity depends on who holds the data. The same output can be safely anonymous with one recipient and not with another, depending on what else they already hold. So we assess each release against its actual recipient rather than stamping a dataset âanonymousâ permanently.
- Anonymity is a moment in time. If new matching datasets appear, an assessment can stop holding. We re-check when the recipient, the data, or the available matching data changes.
Sensitive information
Some sources you can share, such as search history, browsing history and AI-assistant conversations, come to us in full and sometimes contain sensitive information. Most often that is health: questions about symptoms, medications or treatments. Occasionally it touches on beliefs or other sensitive areas.
What counts as sensitive information:
- Health: symptoms, diagnoses, medicines, treatments or conditions
- Race or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic or biometric information
- Sex life or sexual orientation
Asking a general question about a topic is not the same as telling us something about yourself. Searching for what a medicine does says nothing about your own health. Writing that you are taking it does.
We ask before we keep it. We do not ask you to share sensitive information, and our research never depends on any one person's. Because it can turn up in free text without either of us planning it, we ask you separately before we keep any of it.
If you consent, we keep it and use it only for research. Where that is the case:
- We do not use it to make decisions about you as an individual.
- It is never used for advertising or marketing, and never made available through our data marketplace. There are no exceptions to this.
- It leaves Measure only after scrubbing, and where scrubbing would destroy it, it does not leave at all.
If you do not consent, we do not keep it. We run automated checks to find and remove sensitive information from what you have shared. Because this is free text written by people rather than tidy fields, those checks are not perfect, and we cannot promise that every instance is caught. That is why we ask you not to include this kind of detail unless you have consented to it.
You can withdraw your consent at any time in Settings. It does not affect your participation, and it does not affect anything else you have shared.
Who decides, and does a person actually check?
Both software and people.
Automated tools do the bulk work: finding identifiers, flagging combinations, spotting candidates that need a closer look. They are good at volume and consistency.
The final decision on a release is a written human judgement rather than a score. Someone defines what is being released and to whom, tries to break it along all three routes above, judges whether the remaining risk is remote, writes that down and signs it. Anything involving a self-disclosing story gets human review before it can leave. That category cannot be handled safely by software alone.
We keep those assessments as our record. The law expects us to be able to demonstrate that data is anonymous, not merely to assert it.
What we don't claim
- We do not claim scrubbing makes data anonymous to us. It does not, and it is not meant to.
- We do not claim automated detection is perfect. That is why the protection is not detection alone: verbatim free text does not leave through high-risk channels in the first place, so a missed item cannot escape that way.
- We do not claim an anonymity decision is permanent. It is a judgement about a specific recipient at a specific time, and we revisit it.
- We do not use âitâs anonymisedâ as a reason to do things with your data you have not agreed to.
Is any of this used for advertising?
Not unless you specifically opt in.
Research use and advertising use are separate. Advertising requires its own explicit opt-in, which you can give or withdraw on its own. If you do not opt in, your data is never used for advertising. Sensitive information is excluded from advertising use whether you opt in or not.
See the âAdvertising and ad-targeting use of dataâ section of the Privacy Notice for the detail.
What if I change my mind?
You can stop at any time. Use the Stop Sharing control, remove the Browser Extension, uninstall the app, or contact us. Stopping takes effect immediately for any further collection.
For data already collected, you can ask us to delete it. Where you withdraw from research collection, we stop processing and sever your behavioural data from the details that identify you, so it no longer points to you.
Your full rights, including access, correction, erasure, objection, restriction, portability and withdrawal of consent, are set out in the âYour legal rightsâ section of the Privacy Notice.
How we use research data
We use the profile answers, survey responses and Retro data you give us for two things: producing research outputs, and working out which tasks to offer you.
We do build profiles, for research. We group people by behaviour or interests so that patterns can be analysed and so we can match you to relevant tasks. Two limits on that. It is not used for advertising: research profiling and the optional advertising use are separate things, and one does not feed the other. And it does not make decisions about you that matter legally, so nothing here affects your credit, your insurance or your employment.
Ratings for quality and eligibility work the same way. They decide which tasks you are offered, not anything outside Measure, and you can ask us to review a rating you disagree with.
Aggregate findings leave Measure freely, as do research outputs such as models and taxonomies. Data about individual people, including anything in your own words and any sequence of your activity, is scrubbed of identifiers and references first, as described above.
What aggregated means
The Privacy Notice uses two terms for data at different stages, and the difference decides what we can do with it.
- Individual Level Data is data that still relates to an identifiable person. Even with your name removed, if it is still connected to you through a code we hold, it is Individual Level Data. It is personal data, you keep every right over it, and the retention limits in the Notice apply.
- Aggregated Data has been combined to the level of a group, so that it is no longer about any one person. â38% of participants in this category shopped online weeklyâ is aggregated. There is no version of that sentence that is about you specifically. It is no longer personal data, which is why it can be kept without the same time limits.
Aggregating is not the same as scrubbing, and this is the distinction people most often get wrong. Aggregating combines many peopleâs data into a figure about a group, so what is left is not about an individual at all. Scrubbing takes one personâs data and removes what could lead back to them, so what is left is still that personâs data, and to us it is still personal data, because we hold the key. It is anonymous to the person receiving it, not in absolute terms.
Neither is a way of quietly turning your data into something you have no rights over. Where we still hold the key, you keep your rights.
One thing worth being straight about: making something general is not the same as making it anonymous. A search that mentions a common medicine is still about you if it is still attached to something that identifies you. What removes that link is aggregating to a group, or scrubbing the connections. Not the fact that the content itself is unremarkable.
Your optional sharing choices
Most of what Measure does with your data is market research, and that is the basis on which you joined. The Privacy Notice also covers two things that are not that. Both are optional, both need a separate opt-in from you, and neither happens unless you choose it.
- Advertising through data marketplaces. Your data is made available to advertising buyers through marketplace platforms. If you opt in, those buyers match your data to their own records so they can recognise and target you as an individual. That matching is the point of it, and it is what you would be agreeing to.
- Sharing directly with a company we name. A defined set of your details is shared once, with a single company we name to you before you decide, for a specific purpose we tell you at the time. This is not advertising. It is usually a company wanting to check which of the details it already holds are genuinely yours.
They are separate decisions and neither is a gateway to the other. Opting into one does not opt you into the other. You can withdraw either one on its own, and doing so does not affect the other or your research participation. Every instance of direct sharing is its own request: a different company, or a different purpose, is always a fresh consent, never added to something you agreed to before.
What is true of both: sensitive information is never included, meaning no health, political, religious or sexual-orientation data and nothing worked out from it; neither is available to anyone under 16; and neither affects your research participation. Saying no, or changing your mind later, leaves everything else exactly as it was.
One thing works differently. For data collected through the Browser Extension or Passive Tracking, an advertising opt-in sits on top of your existing research consent for that channel and cannot exist without it. If you withdraw the research consent, the advertising consent goes with it. It does not work the other way round: withdrawing advertising consent leaves your research participation untouched.
Both can be withdrawn at any time from your account settings. For marketplace sharing we stop including your data in any new export straight away, and tell the marketplace to stop using it and delete it. For direct sharing we stop sharing and tell the company to delete its copy.
There is a limit here we would rather state than gloss over. Where a set of details has already been sent to someone, withdrawal gets it deleted because they are obliged to delete it, not because we can reach into their systems and remove it. That is one of the reasons we keep what we send to the minimum.
Questions
Email privacy@measureprotocol.com. If you are not satisfied with how we have handled something, you can complain to the Information Commissionerâs Office at ico.org.uk, though we would appreciate the chance to sort it out first.