Companies have treated anonymization as a legal safe harbor and commercial baseline since the adoption of data privacy laws. Strip direct identifiers such as names, email addresses, or phone numbers from a dataset, and the resulting information was widely considered to be lower risk and safer to share, analyze, monetize, and store. Companies often viewed this de-identified data as presenting materially lower regulatory risk and, in some jurisdictions, as falling outside certain legal obligations.