What is aggregate data?
Definition
Aggregate data is information combined from many people or records into totals, averages or groups, so it describes a population rather than any single person, such as 'about 40% of customers are under 30'.
- Category
- Data
- Also called
- aggregated data, aggregated information
- Last updated
NIST's glossary describes aggregated information, in NIST SP 800-122, as information collected about a number of individuals, usually to compare them or spot patterns. Instead of a row per person, you get a summary: a total, an average, a percentage or a count.
Examples
A city publishes how many people used a bus route each day. A website reports that 60% of its visitors use a phone. An app company says its average user opens it four times a day. None of these tells you what one named person did.
Aggregate data and privacy
Companies often say they only share aggregate data, as if that settles it. It helps, but it isn't a guarantee. Whether aggregated data still counts as personal data depends on whether someone could still identify a person from it, and the law differs by country. Small groups are the weak point: "one customer in this postcode bought this product" points at a single household. NIST's glossary also warns that data aggregation, meaning the compiling of data into a fuller picture, can increase risk, including enabling someone to work out who the data is about.
Aggregate vs. related terms
- Anonymized data has had identifying details removed from individual records.
- Aggregate data summarizes many records so individuals disappear into the totals.
- Personal data is about an identifiable person.
- Data aggregation is also what data brokers do in a different sense: pulling many records about one person into a single profile. That's the opposite of the privacy-friendly meaning above.
Why it matters to you
When a company says your data is only used in aggregate, ask how small the groups are. And remember that the broker version of aggregation, with your name and address in one profile, is the one that affects you directly.
How to protect yourself
- 1
Read what 'aggregate' really means in a policy
Look for whether a company says the data is aggregated and de-identified, and whether it commits not to re-identify it.
- 2
Opt out of data sharing where you can
Use the privacy or 'do not sell or share' settings in apps and accounts. In California, the CCPA gives you the right to opt out of sale and sharing.
- 3
Keep your name out of broker profiles
The profile-building kind of aggregation is done by data brokers. Serus finds where your address and phone number are listed on data brokers and people-search sites and removes them for you.
- 4
Be careful in small datasets
When a survey or form asks for your postcode, age and job together, those few details can single you out. Give fewer.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What does aggregate data mean?
Data combined from many individuals into summary figures like totals and averages, so it describes a group and not a single person.
Is aggregate data personal data?
Usually not, but it can be if a person can still be identified from it, for example in a very small group. It depends on the law where you live.
What is the difference between aggregate and anonymized data?
Anonymized data keeps individual records but removes identifying details. Aggregate data summarizes many records into group figures.
Can aggregate data be traced back to me?
Sometimes, particularly when groups are small or the data is combined with other datasets.
Sources
Something wrong or out of date? Tell us and we'll re-check it.