Can a Skeleton Still Reveal Identity?

It helps to name the kinds of identifying information a few seconds of video carries, because they are removed by different steps and they do not weigh the same.

Every stage of a privacy pipeline removes some of these and keeps others. The question is never "is identity gone" but "which layers remain, and what would it take to use them".

Blurring or masking the face is the first thing most systems do, and it should be: it removes the most recognisable region before anything is stored. It is also the step most often mistaken for the whole job.

Look at what remains. The clothing is intact, and clothing is stable for a day. The build and proportions are intact, and they are stable for years. The walk is intact. In a small population — a ward, an office, a school — appearance and build alone narrow a person down to a handful, and the third Foundation's privacy figure showed exactly this: after face redaction the identity indicator barely moved.

A silhouette discards texture and colour: no face, no clothing detail, no hair. What it keeps is the outline — shape and its movement over time. A skeleton discards even the outline, keeping a dozen joints and how they move.

This is where the diagram's argument is weakest, because these are the representations gait recognition was built on. Silhouette-based methods have identified people from outlines for two decades; model-based methods do it from skeletons and joint angles. The surveys in the evidence below collect hundreds of such results across clothing changes, carried objects and viewing angles. That research is what makes movement measurement possible at all — and it is also a demonstration that a skeleton is not an anonymised person.

Reduce further and only movement remains: the paths a few joints trace, or the path a person takes through a room. This is the leanest representation a movement system can work from, and it is genuinely far from an image. A single trajectory, alone, identifies almost no one.

The word doing the work in that sentence is alone. Trajectories are recorded at a time, in a place. Keep them for a week and the same route at the same hour becomes a pattern. Join them to a door-access log, a rota, a room booking, and the pattern acquires a name. Match today's rhythm against yesterday's and a system that never stored a face is re-identifying a person by their walk — which is, once again, precisely the capability the recognition literature describes.

Put the argument together and identity does not disappear at a stage; it is reduced by a set of decisions, each of which can be undone by another. Six of them decide the outcome.

• Representation. What survives the transformation: a skeleton keeps less than a silhouette, a trajectory less than a skeleton. Necessary, never sufficient.
• Storage. Whether the reduced data is kept at all, for how long, and whether the original frames are kept alongside it. A skeleton next to its source video is a video.
• Combination. What the data can be joined to: identity logs, timetables, other cameras, other sensors. Linkage is how anonymous data stops being anonymous.
• Persistence. Whether observations of the same walk can be matched across days. A pattern that recurs is a signature.
• Purpose. What the model is asked to do. A system built to count people in a corridor and a system built to recognise them can consume the same skeletons.
• Deployment. Who operates it, who can query it, and what the people being observed have been told. Architecture sets the ceiling; governance decides where under it a system sits.

Representation is the one an engineering team controls most directly, which is why it is the one that gets drawn. The other five are where most real privacy failures happen.

None of this argues against privacy engineering. It argues for doing all of it, and for describing it accurately.

• Minimise at the edge, and mean it. Transform before storage, not after. If the raw frames are never kept, four of the five layers never enter the system.
• Do not keep what the purpose does not need. A counting system needs no trajectories from last week. Expiry is a privacy control.
• Do not link by default. Movement data joined to identity data is identity data. Linkage should be a deliberate, disclosed decision.
• Say what remains. "We process skeletons" is a description of the representation. "Skeletons can carry gait identity; here is what we do about that" is a description of the privacy.
• Treat re-identification as a capability the system has, not one it lacks. The literature says it does. Govern accordingly.

The third Foundation called this privacy by architecture: sensing and identification as separable stages, separated on purpose. This story adds the caveat that keeps the phrase honest. The separation is not a place in the pipeline where identity is gone. It is a set of decisions that keep identity from being reassembled — and every one of them has to hold.