What is the difference between a direct identifier and a quasi-identifier, and why are quasi-identifiers the real danger?

Direct identifiers single you out alone; quasi-identifiers look harmless individually but combine into a unique fingerprint.

• Direct identifiers uniquely identify a person on their own: full name, Social Security Number, email/physical address, biometric data. The obvious move is to remove these.
• Quasi-identifiers (QIDs) are "seemingly innocuous" attributes that become identifying in combination: gender + age, birthdate + ZIP, occupation + education, geographic location.

The danger lives in the combination. Research shows 87% of the U.S. population is uniquely identifiable from just three quasi-identifiers: ZIP code, birthdate, and gender. None of those is a name, yet together they pinpoint almost everyone. This is the reason "we deleted the names" is never enough.

Tip: Attacks don't target the name you removed — they target the fingerprint you left behind.