Anonymous employee feedback and k-anonymity explained
People only tell the truth about work when they can't be identified. This guide explains what k-anonymity is, why small groups are dangerous, and how to run anonymous feedback that is genuinely safe.
k-anonymity is a privacy property: any released figure is indistinguishable among at least k people, so no one can be singled out. Applied to employee feedback, it means you never show a group's result unless at least k distinct people contributed - a minimum group size, commonly k≥5. It is what turns "anonymous" from a promise into a guarantee.
Why anonymous feedback matters
Honest feedback is the cheapest early-warning system a company has. But people self-censor the moment they fear a comment could be traced back to them - so the feedback that reaches leaders is quietly filtered towards the safe and the positive. True anonymity removes that fear, and with it the filter.
The hidden trap: anonymous is not automatically safe
Removing names is not enough. People can be re-identified in two everyday ways:
- Small groups. If only three people in a team responded, a manager who knows the team can often guess who said what - especially if one score is low.
- Combining attributes. Filtering a survey by team, then tenure, then role can narrow "anonymous" results down to a single person, even in a large company.
This is the exact problem k-anonymity was designed to solve.
What k-anonymity actually means
k-anonymity is a formal privacy model: a released record must be indistinguishable from at least k−1 others. The k is the minimum group size. If k = 5, any figure you show must reflect at least five people, so it can never be pinned to one.
- Pick a minimum group size (k), often 5.
- If a team or segment has fewer than k responses, show nothing - to anyone.
- Don't let filters combine to shrink a group below k.
Worked example: shown vs withheld
| Team | Distinct responses | Result shown? |
|---|---|---|
| Engineering | 9 | Yes - 9 ≥ 5 |
| Support | 5 | Yes - exactly at the threshold |
| Design | 3 | No - below k, withheld |
The Design result is not blurred or "manager-only" - it simply is not produced. Below the threshold, there is nothing to leak.
How to run anonymous feedback safely
- Store it with no author link. The safest anonymous data has no author or user column at all - there is structurally nothing to trace.
- Aggregate, never itemise. Report group trends, not individual submissions.
- Enforce a minimum group size. Apply k-anonymity to every result a manager can see.
- Guard against filter-stacking. Recompute the group size after every filter and suppress if it drops below k.
- Warn about free text. Remind people not to include names or identifying detail in comments.
- Separate serious concerns. Provide a dedicated confidential channel for grievances - anonymity for trends, confidentiality for cases.
- Enforce in code, not policy. A rule a person could override is a rule that eventually gets overridden. Build the threshold into the system.
An honest caveat
Anonymity is a tool, not a culture. It works best alongside attributed, everyday feedback - like good 1:1s - and clear communication about what is anonymous, what is confidential, and what leaders will actually do with what they hear.
How CoDash builds this in
CoDash treats privacy as architecture. Anonymous suggestions and feedback are stored in tables with no author column and no user foreign key, so there is nothing to subpoena or "just quickly check". Every manager-facing aggregate - mood, eNPS, survey results - passes a k-anonymity gate with a minimum group size before it is ever shown, and the gate is enforced in code, not left to a settings page. Read the full privacy and security model, see it in engagement and voice, or pair it with our eNPS guide.
Frequently asked questions
What is k-anonymity?
A privacy property where any released figure is indistinguishable among at least k people. For feedback, a group result is only shown when at least k distinct people (a minimum group size, often 5) contributed.
Why does minimum group size matter?
Results from a tiny group can identify people even without names. Suppressing anything below the minimum group size prevents re-identification.
Is anonymous feedback really anonymous?
Only if it is designed to be: no author link, aggregates only, a minimum group size, and no filtering down to tiny segments. Free-text comments can still self-identify, so remind people not to include identifying detail.
How do you make it safe?
Store without an author column, report only aggregates, enforce k-anonymity, prevent filter-stacking below k, and offer a separate confidential channel for serious concerns - ideally enforced in code.
Keep reading: All 66 HR guides · 30 free templates · 24 calculators
Privacy people can verify
CoDash stores anonymous feedback with no author column and gates every aggregate behind k-anonymity - enforced in code, not policy. Try to break it in the demo.
Explore a live, safe sandbox