Are Anonymous Surveys Really Anonymous? What Gets Recorded and What Gives People Away
A survey is anonymous only when the tool stores no technical details, the form asks no identifying questions and the link isn't personal. What an online response usually leaves behind, seven things that break anonymity even with the right tool, and how to build a truly anonymous survey.
An employee who opens an "anonymous satisfaction survey" first asks: will anyone really not know I wrote this? The honest answer is: it depends. A survey is anonymous only when three conditions hold together:
- the tool doesn't store the respondent's technical details (IP address, browser, device fingerprint);
- the form itself asks nothing that identifies the person, directly or in combination;
- the link isn't personal, that is, it isn't a personal invitation.
If any of the three is missing, the "anonymous" label is only a promise. This article unpacks all three, both for people who build surveys and for people deciding whether to trust one.
What does an online response usually leave behind?
Unless you change something, most form builders keep some technical data next to each response. The table below explains each item and what happens to it in Porsino's "anonymous survey" mode:
| Data | What it reveals | In Porsino's anonymous mode |
|---|---|---|
| IP address | The network the response came from; on an office network it can point to one computer. | Not stored |
| Browser and operating system | In a small team, it can single out "the only person with Safari". | Not stored |
| Referring page, screen size and time zone | Where the respondent came from and on what device. | Not stored |
| Device fingerprint | An identifier that links one device across different forms. | Not stored; if "one response per person" is on, only a hash specific to that form, which can't be linked to any other form |
| Location | Where the respondent is. | Not collected, even if enabled in the form settings |
| Partial responses | What someone typed but didn't submit. | Not stored |
| Device type (phone or computer) | Identifies no one on its own. | Kept for reports |
| Start time, submission time and duration | Needed for data quality. | Kept |
The "device" and "IP" columns are also left out of an anonymous survey's Excel export. At the top of the form, respondents are told that the survey is anonymous and that their IP address and device details are not stored, which is exactly what the server does. How to switch it on is in the anonymous survey guide.
Seven things that break anonymity, even with the right tool
1. Identifying questions
Name, national ID, mobile, email or employee ID. If the form asks for these, not storing the IP address makes no difference. Porsino warns about this in the form settings, but the decision stays with the creator.
2. Mobile verification and "one response per code"
Both are excellent for preventing duplicates, but they keep the verified number or code next to the response, so the response is no longer anonymous. For "one per person" in an anonymous survey, choose the "by browser" option.
3. Personal invitations
A single-use link sent to each person separately ties the response to that contact; that is how it can tell you who hasn't responded yet. For an anonymous survey, send one public link to everyone.
4. Small groups in reports
If a department has two people and you break the report down by department, their answers are effectively known. A rule of thumb: don't show a group with fewer than five responses on its own; merge it into a larger one.
5. Combinations of demographic questions
"Female, aged 45 to 50, finance department, over 15 years of service" is one person in many organisations. Ask demographic questions coarsely (age bands instead of year of birth) and only the ones you will actually analyse.
6. The text of open answers
"That Tuesday meeting where my manager told me…" identifies someone better than any IP address. Remind people above open questions not to include identifying details, and don't hand raw open answers to someone who knows the respondents.
7. Response times
Submission time is kept for data quality. If you send the link to people one at a time at different moments, the submission time can link a response to the people you sent it to. Send the link to everyone at once.
How to build a truly anonymous survey
- Turn on the "anonymous survey" switch in the form settings and publish the form again so the link picks it up.
- Ask no identifying questions, and keep demographic questions to a minimum with coarse bands.
- Send one public link to everyone, not personal invitations; if you need to prevent repeats, choose "one response per person, by browser".
- Before publishing, say precisely in the introduction what isn't recorded and how results will be reported; don't promise more than is true.
- In reports, don't show groups of fewer than five people separately.
The employee satisfaction and suggestions box templates are built for this; to build your own survey see the online survey maker, and for asking employees the right way read employee satisfaction surveys: how to get honest answers.
Anonymous or confidential?
They are not the same. In an anonymous survey nobody, not even the organiser, can link a response to a person. In a confidential survey the organiser knows who said what but promises not to disclose it, for example when detractors need a reply or reminders should go only to people who haven't responded. Both are legitimate, as long as respondents are told exactly which one it is. A confidential survey that calls itself "anonymous" destroys the trust you need for the next one. For "one per person" with a staff list, read one response per person.
Frequently asked questions
Can the creator of an anonymous survey find out who responded?
If anonymous mode is on, the form asks no identifying questions and the link is public, the tool keeps no data that links a response to a person. Very small groups, combinations of demographic questions and the text of open answers can still give someone away.
Is my IP address recorded in an anonymous survey?
Not in Porsino's "anonymous survey" mode. In other tools it depends on that tool's settings; read the note at the top of the form or the tool's privacy policy.
How can I tell whether a survey is really anonymous?
Check three things: was the same link sent to everyone, or one just for you? Does the form ask for your name, national ID, mobile or email? And does the form say exactly what isn't stored? A personal link or an identifying question means the response isn't anonymous.
Can a survey be anonymous and still allow only one response per person?
Yes, with the "by browser" limit: Porsino keeps only a hash specific to that form, which can't be linked to any other survey. Someone who switches browser or device may respond again; the stricter options (mobile verification, employee ID, invitations) remove anonymity.