Key Takeaways
- Anonymity belongs to a configuration, not to a product. The EU's top court held in September 2025 that the same records can be personal data for the organisation holding the key and not for a recipient who cannot re-identify anyone.
- A link labelled anonymous can still log an IP address. The University of Iowa's human-subjects guidance states that the anonymous survey link collects respondent IP and location data by default.
- Sign-in requirements leak identity before the first question. Quiz mode, file-upload questions and a one-response-per-person limit each force a Google account login.
- Your own questions re-identify people faster than metadata does. One free-text box and a team of six is enough for a manager to guess who wrote what, which is why reporting thresholds exist.
- Claim it last, test it first. A submission from a logged-out browser shows what the response record really holds, and the privacy notice should match what you find.
People search for anonymous forms expecting a setting. What they get is a question with two moving parts: what your form collects, and who ends up holding it. No form builder answers that on your behalf, because the same tool produces an anonymous survey in one configuration and a fully attributable one in the next.
European regulators have taken the same view. The European Data Protection Board's draft guidelines on anonymisation treat anonymity as a question of likelihood rather than a yes or no property, and say the answer can differ depending on which entity holds the data. Public consultation on that draft closes on 30 October 2026. If you run employee feedback, customer research or an intake form that promises discretion, the four checks below decide whether your promise survives contact with the response file.
Anonymous, confidential and pseudonymous are three different promises
Three words get used interchangeably in form tools, and the gaps between them are where trust breaks down.
| Promise | What it means for the person answering |
|---|---|
Anonymous | Nobody, including the form owner and the platform, can connect an answer to a person. |
PromiseAnonymous What it means for the person answeringNobody, including the form owner and the platform, can connect an answer to a person. | |
Confidential | Someone can connect answers to people, and has agreed not to. Access is a policy, not a technical limit. |
PromiseConfidential What it means for the person answeringSomeone can connect answers to people, and has agreed not to. Access is a policy, not a technical limit. | |
Pseudonymous | Identifiers are replaced with a code. The link back exists somewhere, so the data is still personal data. |
PromisePseudonymous What it means for the person answeringIdentifiers are replaced with a code. The link back exists somewhere, so the data is still personal data. | |
The Article 29 Working Party's Opinion 05/2014 on anonymisation techniques remains the adopted European text on that last row, and it is blunt: removing identifiers does not anonymise a dataset. It assesses any technique against three risks, namely singling out a record, linking two records to the same person, and inferring an attribute about someone. A survey that strips names but keeps a department, a tenure band and a timestamp fails the inference test without anyone touching an IP log.
What changed recently is the emphasis on who holds the file. In Case C-413/23 P, decided on 4 September 2025, the Court of Justice rejected the argument that pseudonymised data is always personal data for everyone who touches it: the records were personal data for the authority that could still identify people, and not for the recipient with no means to. Your HR team, your survey vendor and your IT administrators hold three different sets of means, and the answer can legitimately differ for each.
A plain-language version of that test already exists. The UK regulator's guidance on how to ensure anonymisation is effective asks you to run a motivated intruder test: assume someone reasonably determined, with the resources an attacker would have, and ask whether they could put a name to a record.
Four checks that decide whether a form is anonymous
Check 1: Can someone answer without signing in?
An account requirement is the fastest route from anonymous to attributable, and it usually arrives as a side effect of a feature you wanted for another reason.
In Google Forms, email collection defaults to off, and the Verified option requires respondents to be signed in to a Google account. The traps are indirect: quiz mode, a file-upload question, and the limit-to-one-response-per-person setting each force a login, so the de-duplication you added to stop ballot stuffing is also what put an identity next to every row (Google's Forms documentation, checked 30 October 2026).
Microsoft Forms splits the same decision by audience. The Record name option only appears when the form is restricted to people inside your organisation, and the Anyone can respond audience returns submissions without names attached. Forms created from a personal Microsoft account have no Record name option at all (Microsoft's Forms support documentation, checked 30 October 2026).
So decide between a public link and an internal-audience link before you write a single question. If you want anonymity plus one-response-per-person, one mechanism cannot deliver both, and you have to pick.
Check 2: Do your questions identify people on their own?
This is the check teams skip, and it does more damage than any metadata field. A form with no name, no email and no IP logging still identifies people if the questions narrow the population far enough.
- Demographic combinations. Department, tenure band, location and role, stacked in one response, often leave a single candidate in a mid-sized company.
- Free-text boxes. People describe the incident they want fixed, and the description names them. That is why the open-ended survey question examples worth using ask about a process rather than an episode.
- Small groups. Employee-feedback platforms converge on a reporting threshold of around five responses per group and suppress results below it, because filters rather than raw data do the re-identifying.
- The filter trap. Someone with report access who filters a 40-person result down to a 4-person team has re-identified that team without breaking a rule.
Treat the question set as part of the anonymity design. If a question is only useful for slicing results, and the slice would fall below your threshold, cut the question.
Check 3: What does the platform keep that you never asked for?
One finding should change how you read a vendor's anonymity label. The University of Iowa's guidance on survey-based research explains that a Qualtrics anonymous link carries that name because it does not ask for identifying information, then states that by default the same link collects the respondent's IP address and location data. A separate Anonymize Responses setting, under Survey options and then Security, removes them. The word anonymous in that interface described the question set, not the record.
Campbell University's IRB guidance on internet survey platforms turns the same point into an instruction: switch location collection off, because identifiers including IP address and latitude and longitude are otherwise collected. It also tells investigators the IRB will not accept new protocol submissions proposing SurveyMonkey or Wufoo as the platform.
Metadata worth asking about explicitly:
- IP address, and whether it is stored, truncated or discarded
- Approximate location derived from that address
- Timestamps precise enough to match a building access log or a shift rota
- Device and browser fingerprint data, cookies or local storage used to block repeat submissions
- Hidden fields and URL parameters carrying an identifier from the invitation into the response
Truncation is the usual middle ground: vendors zero the final octet of an IPv4 address or the last 80 bits of an IPv6 address, so the record no longer points at one machine. Better than full retention, and not the same as collecting nothing.
Check 4: Who can open the raw responses?
Anonymity that depends on a reporting layer is a policy, not a property. Settle three questions in writing before launch. Which roles can read individual submissions rather than aggregates? Does a raw export carry the fields the dashboard hides, and does it suppress small groups the way the screen does? Can your own IT team reach the underlying database?
If that last answer is yes, the form is confidential with respect to that team, whatever the product page says. Defensible for most customer research. Not defensible for a whistleblowing channel, and the difference belongs in what you tell respondents.
How to audit a form you already have
- Open the settings and write down what is on. Email collection, sign-in requirements, response limits, IP and location logging, hidden fields. One pass, one list. Most teams find at least one setting they did not know was enabled.
- Submit a test response from a logged-out browser. A private window, ideally on a different network. This step separates what the marketing page implies from what the record contains.
- Open that test response as an administrator. Read every column, not the summary view, and export it too, because exports routinely carry fields the dashboard suppresses.
- Run the motivated intruder test on the result. Ask whether someone with your org chart and your calendar could name the author of the response you just created. If the form asks for department and tenure, try it on a real small team.
- Rewrite the promise to match the finding. If IP addresses are retained, say confidential rather than anonymous. A smaller precise promise holds response rates better over time than a broad one that leaks.
Repeat step 2 after any change. Adding a file-upload question months later can quietly reintroduce a sign-in requirement that was never there at launch.
What to ask a form vendor, including this one
Three questions settle most of it: what metadata is stored per submission, which roles can read individual responses, and the retention period for both. Get the answers from the data processing agreement or the record of processing rather than a sales call, because that is the version you can rely on later.
Take meetergo as the worked example, since it is this site's own tool and the checks apply to it the same way. The Cologne-built platform spans scheduling, forms, CRM, video and e-signatures across sales, consulting, recruiting and healthcare intake, and running the four checks against it produces a mixed answer rather than a blanket claim.
On the account question, meetergo's free poll and survey tool needs no registration to create a poll or respond to one, and the documentation states that participants normally enter a name so the organiser can see who voted. Fully anonymous voting is a separate setting, enabled from a meetergo account. Polls created without an account expire after 90 days of inactivity, which is a retention answer rather than a marketing line. Data sits on servers in Germany and a data processing agreement is available (meetergo product pages, checked 30 October 2026).
The contrast inside one product is the part worth borrowing. meetergo's routing forms carry e-signature flows that deliberately store a verified email address, an IP address, a timestamp and a SHA-256 document hash per signature, because an eIDAS-grade audit trail is the opposite of an anonymous submission. Same vendor, same account, opposite privacy properties, decided by which flow you picked.
Two honest limits. meetergo's published documentation does not state whether ordinary form and survey submissions retain respondent IP addresses, nor the exact scope of the anonymous voting setting, so get both answered in writing before you migrate. The plan matters too: the free tier is €0 forever, while multi-step forms and routing arrive with Suite at €29.90 per user per month (checked 30 October 2026). The security posture and privacy documentation are where that conversation starts, and the data sovereignty question covers why the holder's jurisdiction belongs in the same assessment.
Start free with meetergo and test a survey against the four checks on the free tier. No credit card required.
When an anonymous form is the wrong tool
Skip anonymity deliberately in three cases. Consent and contract forms need the opposite: an identifiable signer and a record that holds up in a dispute. Safeguarding and serious-incident reports often need a route back to the reporter, since an anonymous allegation can be impossible to investigate. Operational intake, where you book an appointment or qualify a lead, needs contact details by definition, which is why an online form creator built for intake optimises for routing rather than privacy.
Choosing confidential over anonymous is the more honest commitment whenever a human will need to act on a specific response.
Mistakes that break anonymity after launch
- Promising anonymity in the form header before testing the settings. The sentence costs nothing to write and everything to retract. Write it after step 2 of the audit.
- Letting one person request an unfiltered extract. A senior leader asking to just read the comments is how most anonymity promises actually die. Agree the rule before the request arrives, because refusing in the moment is far harder.
- Keeping responses forever. A dataset that was hard to re-identify in 2026 gets easier as other data accumulates around it. Set a retention period and a deletion date when you build the form, the way a client feedback survey programme should.
- Treating a low response rate as a comms problem. When people suspect a form is not anonymous, they stop answering honestly before they stop answering at all. Thin, bland results on a sensitive topic are a trust signal worth reading.
Booking + video conferencing in one tool.
Booking + video conferencing in one tool.
FAQs
Are Google Forms anonymous?
They can be. Email collection is off by default, so a plain form in a personal account takes no identity from the respondent. Quiz mode, file-upload questions and the one-response-per-person limit each require a sign-in, and the Verified email option records the account address (Google's Forms documentation, checked 30 October 2026).
Does an anonymous survey link still record my IP address?
Often yes. The University of Iowa's human-subjects guidance documents that a Qualtrics anonymous link collects IP address and location data by default, and that a separate security setting strips them. Treat the label as a description of the questions, not the record.
Is an anonymous form still covered by GDPR?
Genuinely anonymous data falls outside the regulation, and getting there is harder than it looks. Opinion 05/2014 treats pseudonymised data as personal data, and an IP address held by someone who could obtain subscriber details is personal data too. Most working forms are pseudonymous and stay in scope.
How many responses do I need before results are safe to share?
Feedback platforms commonly suppress any group below about five responses, with a higher bar for open-text comments. Apply that threshold to every filter you let managers use, not only the headline view.
Can my employer see who wrote an anonymous comment?
It depends on the configuration and who holds the file. Ask which roles can read individual submissions, whether raw exports exist, and whether IP addresses are retained. If any answer is yes, the channel is confidential, and you are entitled to be told which one you are using.
Does an anonymous form work for research or market studies?
Yes, and the discipline from academic review boards transfers well: disable location collection, use a reusable anonymous link rather than personalised ones, and state in the consent text whether the study is anonymous or confidential. That groundwork makes customer research surveys more trustworthy, and an online survey tool comparison is the next step once the requirements are written down.
