The Right to Be Anonymous

What is broken

Anonymity is treated as an exception that has to be earned. Services ask for a phone number to create an account, a legal name to receive a parcel, a selfie to prove an age, an identity document to open a wallet. Each request has a reason, and the reasons are individually plausible. Together they make an unmarked life impractical.

The usual argument is abuse. If people can act without a name, the argument goes, they will defraud, harass and evade. So the honest user is asked to pay the anonymity tax: hand over an identifier, accept the terms, and trust that the identifier will only be used for the stated purpose. The tax is paid up front, by everyone, for a risk that is often modest and always unevenly distributed.

The infrastructure makes it worse. A phone number is a universal key that links accounts across services. Device fingerprints and metadata re-identify people who never gave a name. Logs keep the address that the product promised not to need. A pseudonym is allowed at the front door and quietly resolved at the back.

This is not only a privacy failure. It excludes people who cannot or will not produce documents: the undocumented, the estranged, the person fleeing a household, the researcher, the teenager asking a question they cannot ask under their own name. An unmarked life is not a loophole for them. It is the only way to participate.

What the requirement would take to build

Anonymity has to be a supported mode, designed rather than tolerated. The first separation is between authentication and identification: proving that a returning account is the same account is not the same as knowing who the person is. Where the law allows, those two things should be different systems.

The technical route is credentials that do not carry a name. Blind signatures, unlinkable tokens and zero-knowledge proofs can let a service verify a property — paid, old enough, invited, not a bot — without receiving the underlying identity. The proof is checked; the person is not resolved.

Abuse handling has to work without a central identity. Rate limits, per-account quotas, reputation attached to a pseudonym, delayed posting and moderation are all possible without a legal name. They are less convenient than a phone number, which is why they are the requirement.

Data minimisation is the daily discipline: collect what the task needs, keep it for the time the task needs, and do not build a resolution path for later. Logs, analytics and fraud tools are part of the surface, not exceptions to it.

The mode also needs an honest threat model. Anonymity protects the person from the service, not from everything; a local adversary with the device is a different problem. Saying so is part of the design.

The test is whether a person can complete an ordinary task — read, ask, buy, complain — without becoming a record. If every path ends in an identity check, anonymity is a marketing word.