Pseudonymized data is not completely anonymous. For example, your name, address, date of birth, and other identifiable information are likely available in public datasets like property tax records or voter registration data. There are also mostly-legal datasets available for purchase with more complete demographic and personal information. If your birthday, gender, and zipcode are present in the pseudonymized dataset, I have an ~87% chance succeeding in a linkage attack matching you in of those public datasets.

By definition in any modern privacy specification, the only difference between anonymous and pseudonymous is that you can recover the true identity.

I believe a decade plus ago Pseudonymized meant simply making something less identifiable, but not any more.

https://csrc.nist.gov/glossary/term/pseudonymization

See section about the new definition under GDPR.

Like I said, modern privacy standards. The US is still quite far behind: I've had to do HIPAA training and it shows.

I'd advise you to set your bar a lot higher than your national standards if you ever plan to do international products: nobody in the US will complain if you use stricter definitions but you'll instantly be rejected in Europe if you call that pseudonymization.

I’m familiar with GDPR, we work with EU companies, and all the ones we work with use original definition. NIST link aside, these terms are hardly standards anyway. They are nearly colloquial vocabulary, which unfortunately in this space I expect to remain imprecise and vague. This why we generally only use it in marketing and comms, while in the actual product we drill down into specifications for direct and indirect identifiers, distortion, and risk.

There are a bunch of regulatory box-checking exercises like this that don't actually provide anonymization if the attacker is sophisticated.