I was recently working with a client whose engineering team was confident they had solved their privacy problem. They do not collect a person's name, email, or any obvious identifier in their analytics pipeline. Instead, every visitor is assigned a unique identifier, a GUID generated on first visit, and a small behavioural profile is built up against that GUID over time. No name, no direct contact information, nothing that reads as "personal" in the traditional sense.
The trouble is that this same GUID, or the identifiers sitting alongside it, was also being passed into a LinkedIn Insight Tag and into TikTok's advertising pixel. And that is where the assumption fell apart.
Two words that are not interchangeable
In everyday conversation, "de-identified" and "anonymized" get used as if they mean the same thing. Under Quebec's Law 25, and under the broader logic that runs through PIPEDA as well, they do not.
De-identified information is information that no longer directly identifies someone. You have stripped out the name, replaced it with a token or a GUID, and on its own that token tells you nothing about who the person is. This is functionally the same concept as pseudonymization under the GDPR. It is still personal information. Law 25 says so explicitly.
Anonymized information is a much higher bar. Under Law 25, information is only anonymized if it is, at all times, reasonably foreseeable that it can never again, directly or indirectly, be used to identify the person, and that this is irreversible. Not just difficult. Not just unlikely for your organisation specifically. Irreversible, in the circumstances, considering who else might have access to related data.
This is the part that catches technical teams out. The question is not whether you, the company holding the GUID, can identify the person from it. The question is whether identification is reasonably foreseeable by anyone in the chain, including third parties the data is shared with.
Why the advertising tags change everything
Back to my client. Their GUID, in isolation, could not identify anyone. But that same signal, once it touches a LinkedIn Insight Tag or a TikTok advertising tag, sits inside platforms that are very good at correlating device and behavioural signals back to real identities. LinkedIn and TikTok may hold, or have access to, the very information needed to re-identify that individual, even if my client never does. This is not a quirk of those two. The same applies to Meta's advertising pixels, Google Analytics, and most other widely used analytics and advertising platforms. The names change, the problem does not. That is enough to keep the data squarely inside the definition of personal information under both PIPEDA and Law 25. It also means the data is, at best, de-identified or pseudonymized rather than anonymized, and privacy obligations still apply in full.
What this means practically
If your organisation is assuming that a lack of a name or email address takes your analytics or marketing data out of scope for privacy law, it is worth revisiting that assumption. This applies well beyond GUIDs. IP addresses, click IDs, UTM parameters, share IDs, device fingerprints, and a long list of identifiers you might not think twice about can all carry the same risk if they touch a platform capable of re-identification.
The starting point is always the same: know what data you are collecting, why you are collecting it, and honestly assess whether it is de-identified or genuinely anonymized. Do not assume the second based on a feeling about the first. If you are unsure where your data sits on that spectrum, or you want a second set of eyes on your analytics and advertising tag setup before a regulator asks the same questions, reach out through rossgsaunders.com. I also work with teams directly, so if this is a conversation your engineering or marketing group needs to hear in person, I am happy to come and walk through it with them.