ZIP Codes and Privacy: What Your Code Reveals

## What Your ZIP Code Says About You

A 5-digit number might seem harmless, but your ZIP code is one of the most information-dense identifiers in common use. Combined with other data points, it can reveal intimate details about your life.

## What Can Be Inferred

| Data Point | How It's Inferred |
|-----------|-------------------|
| Income bracket | Census median household income |
| Race/ethnicity | Census demographic composition |
| Education level | Census educational attainment |
| Political leaning | Precinct-level voting data |
| Home value | Zillow/Census median values |
| Crime exposure | FBI/local crime statistics |
| Health risks | CDC health outcome data by ZIP |
| Consumer habits | Commercial segmentation data |

## The Re-Identification Problem

Researchers have shown that a combination of **ZIP code + date of birth + sex** uniquely identifies 87% of Americans. This was demonstrated by Latanya Sweeney at Harvard in a landmark 2000 study.

This means "anonymized" datasets that include ZIP codes may not be truly anonymous.

## ZIP Codes at Checkout

Many retailers ask for your ZIP code at checkout. Depending on the state, this may be:

- **Legal** — ZIP code is not considered "personal identification information" in most states
- **Prohibited** — California banned ZIP code collection at credit card terminals (Song-Beverly Act)
- **Restricted** — Massachusetts and other states have similar restrictions

Retailers use collected ZIPs to:

- Match transactions to customer profiles
- Build customer address databases
- Analyze store trade areas
- Target direct mail campaigns

## Data Broker Industry

Data brokers like Acxiom, Oracle Data Cloud, and LexisNexis aggregate ZIP-level data with individual records to build detailed consumer profiles. Your ZIP code is often the linking key that connects your identity across datasets.

## Legislative Response

Growing awareness of ZIP code privacy has led to:

- **HIPAA** — Restricts use of ZIP codes in health data (3-digit prefix allowed, 5-digit restricted)
- **CCPA/CPRA** — California consumers can opt out of ZIP-based profiling
- **GDPR** — EU considers postcodes personal data when combinable with other info
- **Academic ethics** — IRBs now review ZIP code use in research datasets

## Protecting Yourself

- Decline to provide your ZIP at retail checkouts (if your state allows the request, you can still refuse)
- Be aware that "anonymized" data with ZIPs may be re-identifiable
- Use privacy-focused services that minimize geographic data collection