Collecting Sensitive Data Anonymously

Some research involves people who would never participate if they had to provide an email address. Substance use, domestic violence, mental health crises, whistleblowing, experiences with the justice system — these are topics where the act of identifying yourself can feel dangerous, and where the data itself could cause real harm if linked to an identity.

Anonymous token access is how you run these surveys. Participants receive a single-use access code — a printed card, a QR code, a slip of paper — and enter it to access the survey. No email, no account, no name. The platform stores the response but has no way to determine who submitted it. Not even you, the researcher, can connect a response to a person.

This guide explains when to use anonymous tokens, how they work, how to set them up, and how they relate to Canadian privacy law.

When to use anonymous tokens

The standard authentication modes (email verification, participant groups) work well for most surveys. They provide identity, deduplication, and the ability to follow up. But they require the participant to provide an email address, which means:

The platform knows who participated
The researcher can potentially link responses to individuals
A breach could expose who said what

For many surveys, this is fine — even desirable. Employee engagement surveys, customer feedback, community needs assessments — these benefit from knowing who responded so you can track trends, send reminders, and follow up.

But there are surveys where collecting identity would be irresponsible:

Substance use and harm reduction — A survey of people accessing safe injection sites about barriers to recovery, quality of support services, or experiences with law enforcement. These participants are often criminalized. An email address in a database is a risk they will not accept.
Domestic violence — Surveying survivors about their experiences with shelters, court processes, or child protection services. A discoverable record of participation could be used against them.
Workplace harassment or whistleblowing — Employees reporting unsafe conditions, misconduct, or discrimination. Even "anonymous" surveys that require email leave participants wondering whether they can really be identified.
Mental health and suicide — Research on crisis experiences, self-harm, or treatment access where the stigma of participation is itself a barrier.
Youth and minors in sensitive contexts — Surveys about bullying, substance exposure, or sexual health among adolescents where parental disclosure could cause harm.

In these cases, the right question is not "how do we minimize the data we collect?" but "how do we collect no identifying data at all?"

How it works

The builder's perspective

Create an access code set — Navigate to Access Codes in the sidebar. Create a set and give it a name (e.g., "Harm Reduction Survey — April 2026").
Define metadata variables (optional) — If you need to segment responses without identifying individuals, define variables like site, cohort, or group. These are attached to tokens, not to people. For example, if you're distributing at three clinics, you can tag tokens with site=clinic-A, site=clinic-B, site=clinic-C and later analyze responses by site without knowing who any individual respondent is.
Generate tokens — Specify how many you need. Each token is a unique 8-character code formatted as XXXX-XXXX (e.g., AXKF-7M2P). Ambiguous characters (O/0, I/1, L) are excluded to prevent entry errors.
Export and distribute — Download the tokens as a CSV (for your records) or as printable PDF cards with QR codes. The PDF comes in three layouts: 4 cards per page (large, for posting), 8 per page (hand-out size, the default), or 16 per page (high volume). Each card has the QR code, the alphanumeric code as fallback, and optionally the survey name and a custom message like "Your participation is anonymous."
Link the pool to a survey — In the survey's eligibility settings, select Anonymous Tokens and choose your token pool.
Distribute physically — Hand out cards at the point of contact. In a safe injection site, a harm reduction worker hands a card to each visitor. In a shelter, cards are left in a private space. In a workplace, sealed envelopes are placed in mailboxes. The distribution method matters — it should make participants feel safe and in control.

The participant's perspective

They receive a card (or scan a QR code)
They enter the access code or scan the QR
The survey loads — no email prompt, no login, no identification step
They complete the survey and submit
The code is consumed — it cannot be used again

That's it. From the participant's perspective, it's the simplest possible experience: code → survey → done.

What the platform stores

For anonymous token submissions, the platform stores:

The survey responses (answers to questions)
A hash of the access code (for deduplication — to confirm the code was consumed)
The metadata variables attached to the token (e.g., site, cohort)
A timestamp

The platform does not store:

Any email address (not even transiently)
The participant's IP address
The participant's browser or device information
Any data that could link the response to a person

Even in the event of a database breach, there is no path from a response back to a human being. The access code hash is a one-way function — knowing the hash doesn't reveal the code, and the code was never linked to a person's identity in the first place.

Metadata variables: segmentation without identification

One of the challenges of anonymous research is analysis. If you can't identify anyone, how do you compare groups?

Token metadata solves this. When you generate tokens, you assign metadata values — site, cohort, group, distribution channel — that travel with the token into the submission. You can then filter and compare responses by these variables in your analysis.

Example: You're surveying people at three harm reduction sites about barriers to accessing treatment. You generate 100 tokens for each site, tagged with site=site-A, site=site-B, site=site-C. After collection, you can compare responses by site — "Site A participants reported longer wait times" — without knowing who any individual respondent is.

You can define up to 5 metadata variables per pool. Variables are set at token generation time, not by the participant — the participant never sees them and cannot change them.

Law 25 and the proportionality test

If you operate in Quebec, anonymous tokens are not just a good idea for sensitive surveys — they may be a legal requirement.

Quebec's Law 25 (Sections 5, 9) establishes a proportionality test for personal information collection. The test has three parts:

Rational connection — Is there a logical link between the data collected and the stated purpose?
Least intrusive alternative — Is there a less intrusive method that achieves the same purpose?
Proportionate impact — Do the benefits outweigh the consequences for the individual?

For a survey about substance use at a safe injection site, collecting email addresses fails the second test. The survey's purpose — understanding barriers to recovery — does not require knowing who the respondent is. Anonymous tokens achieve the same research goal (authenticated, deduplicated, one-per-participant responses) without collecting any personal information.

The Commission d'accès à l'information (CAI) presumes data is non-necessary when doubt exists (Section 9). For sensitive surveys, the burden is on the researcher to justify why email collection is needed. If it isn't, anonymous tokens are the proportionate choice.

This isn't theoretical. Law 25 is actively enforced — 444 incidents were reported to the CAI in 2023-24 alone, with penalties up to $25 million or 4% of global turnover.

Privacy Impact Assessments

If your application is at Law 25 compliance, the platform includes a Privacy Impact Assessment (PIA) workflow. For surveys using anonymous tokens, the PIA is straightforward — most of the high-risk categories (data linkability, re-identification risk, breach impact) score low because there is no personal information to protect.

The PIA still serves a purpose: it documents that you considered the alternatives, chose the least intrusive method, and can demonstrate this to the CAI if asked. Documentation is evidence. Evidence is your defence.

Practical considerations

How many tokens to generate

Generate more tokens than you expect to use. A token that goes unused costs nothing. A site that runs out of tokens has to stop collecting data until you generate and distribute more.

A reasonable approach: estimate your expected participation, add 50%, and round up. For a week-long survey at a site that sees 30 visitors per day, that's roughly 210 expected × 1.5 = 315 tokens. Generate 350.

Distribution logistics

Anonymous tokens require physical distribution. This is a deliberate design choice — it's what makes them truly anonymous. But it means you need to plan the logistics:

Who distributes? Site staff, harm reduction workers, research assistants. They need to understand that each card is single-use and should go to a different person.
Where are cards kept? In a secure but accessible location. Not in a locked cabinet that requires asking staff (which creates a social barrier), but not in an open pile that someone could take a handful of.
What happens to unused cards? At the end of the collection period, collect and securely destroy unused cards. A code is only useful while the survey is open, but good practice is good practice.
Can participants take cards home? Yes. The QR code and alphanumeric code work from any device. Some participants may prefer to complete the survey privately, later, on their own phone. This is fine and should be encouraged if it makes them more comfortable.

Consent without identity

Anonymous token surveys still present a consent notice. The participant sees what data the survey collects, why, and how long it's retained — they just don't provide their name or email to agree. Their act of completing and submitting the survey, using the token, constitutes their consent.

The consent record is stored with the submission but contains no identifying information. It documents that consent was presented and accepted, by someone, at a specific time — sufficient for audit purposes.

Communication with participants

You cannot follow up with anonymous participants. There is no email to send a reminder to, no way to say "you started but didn't finish." This is the tradeoff, and it's the right one for this context.

If you need to communicate general updates about the research (e.g., "results are published at this URL"), consider posting notices at the distribution sites or including a URL on the token card itself.

Setting it up: step by step

Create your survey as usual, with all questions, consent configuration, and settings
Navigate to Access Codes in the sidebar and click Create Access Code Set
Name the pool and optionally define metadata variables
Generate tokens — choose the quantity and assign metadata values if applicable
Export as PDF — choose a card layout and print the cards
In your survey's Eligibility settings, select Anonymous Tokens and choose the pool
Publish the survey
Distribute cards at the point of contact
Monitor the token pool stats to see consumption progress by site, cohort, or group

Summary

Anonymous token access exists for a specific and important purpose: collecting data from people who cannot or should not be identified. It is not the default, and it shouldn't be — most surveys benefit from knowing who responded. But when the subject matter is sensitive, the population is vulnerable, and the privacy risk of identification outweighs the research benefit of knowing who participated, anonymous tokens are the correct tool.

They are designed to leave no trace. That's the point.