How to make an anonymous survey (that's actually anonymous)

Anonymous vs confidential: what's the difference?

An anonymous survey collects no information that can link a response to a person — not a name, not an email, not a respondent ID tied to the invitation. A confidential survey does collect identity (often to send reminders or link to HR data) but restricts who can see it. Both are legitimate; the cardinal sin is calling a survey anonymous when it isn't. One discovered tracking link destroys trust in every survey you run afterward.

Anonymous means you couldn't identify the respondent even if you wanted to. If you merely promise not to look, that's confidentiality — say so.

When should a survey be anonymous?

• Employee engagement, culture, and manager-feedback surveys — fear of consequences mutes honest answers
• Sensitive topics: compensation fairness, harassment, ethics, health, politics
• Exit-adjacent feedback where respondents worry about references or relationships
• Honest product criticism from communities where members know each other

Skip anonymity when you need to follow up individually (support escalations, customer-success saves) or link answers to account data. In those cases, run a confidential survey and say clearly who can see what.

Step 1: Turn off identity collection in your tool

Check four places, not just the obvious one:

1. 1Remove all name, email, and phone fields from the survey itself.
2. 2Disable any "collect respondent email/account" or "identified responses" setting. In Formkii, choose anonymous responses when configuring the survey — no sign-in is required to answer, so respondents aren't linked to accounts.
3. 3Use one shared link for everyone rather than per-person tracked invitation links. Unique links are pseudonymous by design.
4. 4Confirm the tool isn't storing identifying metadata you'd report on, like precise timestamps you could match against calendar data in a tiny team.

Step 2: Design questions that can't re-identify people

Demographics are the classic leak. "Which department?" plus "How many years at the company?" plus "What is your role level?" can uniquely identify someone in a 40-person company even with no name attached.

• Use broad buckets: tenure as 0–2 / 3–5 / 6+ years rather than exact years
• Merge small departments into larger groups, or drop the question entirely
• Make every demographic question optional with Prefer not to say
• Warn in open-text questions: "Please avoid including names or details that identify you"
• Only ask demographics you will actually use to slice results

Step 3: Communicate the promise precisely

In the survey introduction, state in plain words: what is collected, what is not, who sees raw responses, and how results will be reported. Vague reassurance ("your responses are private") reads as evasive. Specific beats soothing: "We do not collect your name, email, or any ID. Results are reported only for groups of 5 or more."

Step 4: Report results without unmasking anyone

Anonymity can be broken at the reporting stage even when collection was clean. Adopt a minimum group size — many teams use five — below which you don't report a segment at all. Be careful with verbatim quotes: writing style, named projects, or specific complaints can identify an author. Paraphrase or generalize quotes from small groups.

Anonymous survey setup checklist

• No name, email, or phone fields anywhere in the survey
• Tool's identity/email collection setting disabled; anonymous mode on
• One shared link, not per-person tracked links
• Demographics bucketed broadly, all optional, with Prefer not to say
• Intro states exactly what is and isn't collected
• Minimum reporting group size decided (e.g. 5) and announced
• Open-text answers reviewed before quoting; identifying details removed
• The word "anonymous" used only if all of the above are true

What about legal requirements?

Truly anonymous data generally falls outside personal-data regulations like GDPR, because no individual is identifiable. But the bar is high: if you or anyone could reasonably re-link responses to people — via tracked links, IP logs, or unique demographic combinations — the data is personal data and the usual rules apply. When in doubt, treat it as confidential and follow your privacy obligations.

Frequently asked questions