>Every comment attached to that post gets an anonymous number/tag (this already exists). In GDPR parlance, that's called "de-identification", not anonymization

>Every comment attached to that post gets an anonymous number/tag (this already exists). In GDPR parlance, that's called "de-identification", not anonymization. Basically, if there's a risk you could piece together someone's identity from abstract IDs, even by combining various abstract IDs and doing some deduction, it's "de-identification". Recent GDPR decisions basically treat de-identified data as a form of personal information and subject it to many/most of the same requirements, including the prohibition on transfers to the US. (I'm not saying this approach is wise from a policy or technical perspective, but that's the way it is.)