Privacy starts with the data you do not collect
Design an experiment with minimal records and deliberate retention.
- Distinguish redaction from anonymization
- Minimize collected fields
- Separate debugging from raw-content logging
Reduce exposure at collection time
Before collecting a field, explain what decision it supports and how long it is needed. A lesson recommendation experiment may need topic choices and completion counts, but not a learner’s private messages. Reducing fields simplifies both the system and its risk.
A hash is not automatic anonymization. Predictable identifiers such as email addresses can be guessed and hashed again. Combining several harmless-looking attributes may also identify someone. Use precise terms such as pseudonymized when re-identification remains possible.
Redaction is one layer
Pattern matching can remove obvious identifiers from logs, but misses unusual formatting and context-dependent personal information. Treat it as a convenience layer, not proof that text is safe to publish.
Prefer structured diagnostic events: operation name, duration, status, and a request ID. Restrict log access and choose a retention window. Apply the same care to prompts, retrieved passages, generated outputs, and evaluation datasets.
A small experiment you can run.
The email is invented. The regular expression demonstrates a narrow pattern and should not be presented as comprehensive anonymization.
import re
text = "Contact learner@example.test about lesson 3."
redacted = re.sub(r"[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}", "[email removed]", text)
event = {"operation": "lesson_search", "status": "ok", "duration_ms": 12}
print(redacted)
print(event)
Save the file, open your terminal in that folder, and run python privacy-and-data-minimization.py. Use python3 or py if required by your installation. Setup guide
The example email is replaced, while the structured event contains no message text.
Create a minimal analytics event.
- List five fields you might collect.
- Remove fields that are not required to answer a concrete product question.
- Choose a retention period and explain who needs access.
Compare with a suggested solution
For a completion counter, lesson ID and a coarse date may be sufficient. A raw prompt, email address, and full IP address are not automatically necessary. Requirements vary, so document the purpose rather than collecting everything by default.
One idea to take with you.
Make it part of your progress.
Finish the practice and answer the knowledge check to mark this lesson complete.
Go deeper with primary documentation
Optional references for further study. This lesson and its examples were written for Artificials.
NIST AI Risk Management Framework