Should you redact dates of birth before sharing a document?

What the rules keep

Federal Rule of Civil Procedure 5.2 and Criminal Rule 49.1: a filing containing a birth date "may include only" the year of the individual's birth. HIPAA Safe Harbor removes "all elements of dates (except year) for dates directly related to an individual, including birth date" and aggregates ages over 89 into a single category of 90 or older.

Ontario's privacy commissioner lists "date of birth or age" and event dates among quasi-identifiers. NIST SP 800-188 describes the same top-coding technique HIPAA uses for ages over 89.

Why the day and month matter

NIST's NISTIR 8053 summarizes Latanya Sweeney's finding that "up to 87% of the U.S. population could be uniquely identified by their 5-digit ZIP code, date of birth, and sex" in the 1990 census, and a later recomputation of 62% on the 2000 census. Take the full date away and that combination stops working.

When the task needs age

Immigration, family and benefits work often turns on age: whether a child is a minor, whether someone ages out, age-based points. Give the AI the age or the year, not the date:

• Replace the date with a token and add the age in words where it matters ("a 16-year-old dependant")
• Keep other dates that are not about the person, such as filing deadlines, if the task needs them
• Treat event dates tied to one person (admission, arrest, marriage) as quasi-identifiers too