Synthetic Data Is Not Automatically Private

“Synthetic” sounds like a privacy guarantee. It is not. Synthetic data can be extremely useful. It can reduce the need to distribute real personal records for testing, analysis, or model development. But the generation method does not automatically determine whether the resulting dataset is anonymous. The question is not simply “Was this data generated?” The better question is “What can someone still learn or reconstruct about a person from this release?” The EDPB's 2026 clarification In July 2026, the European Data Protection Board adopted new guidelines on anonymisation. The Board's explanation emphasizes that anonymisation is about whether data still relates to an identified or identifiable person in the relevant context. The EDPB highlights three criteria in its framework: No record isolation: a person should not be isolatable from the dataset. No linkage: records should not be linkable to the same person or to other datasets in a way that identifies them. No inference: information should not allow meaningful personal facts to be inferred about an individual. If those conditions are not satisfied, more analysis is required. Source: EDPB — Anonymisation and pseudonymisation The guidelines are still open for public consultation through October 30, 2026. Why synthetic data can still leak information A generator trained on real records can learn relationships present in those records. Depending on the mechanism, output can potentially preserve unusual combinations or patterns that make people easier to distinguish. That does not mean every synthetic dataset is unsafe. It means the privacy property has to be demonstrated for the actual mechanism, dataset, release context, and threat model. A September 2026 position paper argues that privacy should be treated as an explicit, testable claim rather than an assumption attached to synthetic data simply because the records look artificial. Source: Zhao, Januszewicz & Jung — Privacy Is a Claim, Not a Property of Synthetic Data Synthetic data can still be the right choice The point is not to throw synthetic data away. The EDPB's 2026 web-scraping guidance explicitly discusses replacing some real data with synthetic data where feasible as one way to reduce exposure to personal information. That can be a sensible engineering choice even when the synthetic output is not legally equivalent to anonymous data. Source: EDPB — Guidelines 03/2026 on web scraping in the context of generative AI The distinction is important: “Synthetic” can be a data-minimisation technique without being an anonymisation certificate. What a responsible privacy claim should include If a company or researcher says a synthetic dataset is private, ask five questions. What is the threat model? Who is the attacker? What auxiliary datasets can they access? Are they trying to identify a particular person, determine whether someone was in the training set, or reconstruct records? What mechanism generated the data? “AI-generated” is not a privacy mechanism. The actual generator, training process, controls, and release procedure matter. What was tested? A useful evaluation should look beyond whether the synthetic records resemble the source distribution. Privacy testing can include linkage, membership inference, reconstruction, or other attacks appropriate to the release. Are rare records treated differently? Rare combinations can be more revealing than common ones. A dataset can look statistically harmless overall while still exposing unusual individuals or groups. What happens after release? Anonymity is contextual. A dataset that appears safe by itself may become identifying when combined with another public or commercial dataset. The practical takeaway Synthetic data is a tool, not a magic word. Used carefully, it can reduce how often real personal records need to move through development and testing environments. But a credible privacy claim needs a mechanism, a threat model, an evaluation, and a clear explanation of what remains possible after release. For privacy engineering, the useful mental model is simple: Synthetic data can reduce exposure. Anonymisation is a claim that must be demonstrated. Sources European Data Protection Board — Anonymisation and pseudonymisation European Data Protection Board — Guidelines 03/2026 on web scraping in the context of generative AI Zhao, Januszewicz & Jung — Privacy Is a Claim, Not a Property of Synthetic Data EDPB — July 2026 guidance announcement