What is T-closeness?
T-closeness is a privacy criterion for anonymised datasets that limits how different the distribution of a sensitive attribute inside any group of similar records can be from its distribution in the whole dataset. It helps reduce the risk that an attacker can infer a person’s sensitive value from a released dataset.
T-closeness builds on earlier ideas like k-anonymity and l-diversity. Data publishers first group records into equivalence classes (records made identical on identifying fields such as age range or postal area). A class satisfies t-closeness if the distribution of a sensitive attribute (for example: diagnosis, income bracket, or political preference) within that class is no more than distance t away from the attribute’s distribution across the entire dataset. A small t means class distributions must closely mirror the overall distribution, so knowing which class a person belongs to gives little additional information about their sensitive attribute. The distance is usually measured with a statistical metric (commonly the Earth Mover’s Distance for ordered or numeric attributes).
Usage example
You want to publish survey responses that include a sensitive field for ‘health condition’. After generalising quasi-identifiers (e.g., replacing exact age with 10-year bands), you check each group of identical quasi-identifier values. If the proportion of each health condition in every group differs from the overall proportions by no more than t, the dataset meets t-closeness — reducing the chance someone could deduce a respondent’s condition just from their group.
Practical application
T-closeness is useful when releasing microdata (de-identified individual-level records) for research or transparency. It specifically protects against attribute disclosure attacks that k-anonymity and l-diversity can miss — for example, when an equivalence class is small or when an attacker has background knowledge that skews likely values. In practice, applying t-closeness requires generalising or suppressing data until each equivalence class matches the global distribution closely enough, which reduces the risk of revealing sensitive attributes but also decreases data precision. Organisations should balance t (privacy level) against the analytical usefulness of the data, and consider combining t-closeness with other approaches (differential privacy, aggregation) for stronger guarantees.
FAQ
How do you pick the right value of t?
There’s no universal t — it depends on your risk tolerance and the sensitivity of the data. Smaller t gives stronger protection but lowers data utility. Choose t based on a threat assessment (how likely and damaging attribute disclosure would be) and test the impact on the analyses you need to run.
Does t-closeness prevent re-identification completely?
No. T-closeness reduces the risk of learning a sensitive attribute from knowing which equivalence class someone belongs to, but it is not a cryptographic guarantee like differential privacy. It should be one tool in a broader de-identification strategy, combined with careful removal of identifiers, access controls, and possibly noise-based methods.
How is the 'distance' between distributions measured?
Several metrics can be used; a common choice is Earth Mover’s Distance (EMD), which intuitively measures how much probability mass would need to be moved to turn one distribution into another. For categorical attributes without an order, other divergence measures can be used, but EMD works well when attribute values have a natural ordering.
Is t-closeness enough for regulatory compliance (for example, GDPR)?
T-closeness helps reduce disclosure risk and supports responsible data release, but compliance depends on the full context — including identifiability risk, purpose of processing, and organisational safeguards. Regulators often expect a documented risk assessment and multiple protective measures, so t-closeness is advisable but usually not the only step.