Consent Laundering or Privacy Win: Is Synthetic Data a Legitimate Way Around GDPR?

We have always wanted a way to use people’s data without the awkward business of asking them. Anonymisation was supposed to be that escape hatch: remove the names, and the obligations fall away with them. Synthetic data is the most elegant version of that wish yet — not real records with the identifiers scrubbed off, but a freshly manufactured population engineered to resemble the real one closely enough to be useful. The harder question is whether elegance and ethics are the same thing.

The Experiment That Undid the Promise

The study had a fitting name: Anonymisation Groundhog Day. Presented at USENIX Security in 2022, Stadler and colleagues took the synthetic-data approach at its own word and ran it through realistic privacy attacks. Synthetic Data Generation works by learning the statistical patterns of a real dataset, then producing artificial records that share them. The pitch is seductive: if no row belongs to a real person, no person is left to harm.

The results refused to cooperate. The generators tested — including ones built on Differential Privacy, the strongest formal privacy method available — either failed to stop inference attacks or degraded the data until it lost the utility that justified making it, according to Stadler and colleagues (USENIX Security 2022). Some did not even hold to their own mathematical guarantees in practice. And the people left most visible were the outliers, the records too distinctive to blur into the crowd.

That detail is the one worth sitting with. The system protected the people who were already safe — the average, the unremarkable — and exposed the people whose data was unusual enough to matter. Protection failed where it was needed most. That is not a bug you patch.

Why the Outliers Were Always Going to Leak

None of this was bad luck. To reproduce the shape of a real dataset, a generator has to learn that shape — and the more distinctive a record is, the more the model must memorise it specifically to reproduce anything like it. The rare cancer case, the unusual transaction, the person whose behaviour matches no one else’s: these are exactly the records a faithful generator cannot generalise away.

This is why a Membership Inference Attack works against synthetic data at all. In research presented at AISTATS in 2023, van Breugel and colleagues showed repeatable attacks that can infer whether a specific real person’s record — including sensitive health data — trained the generator. The artificial dataset becomes a window back onto the real one. Older ideas like K Anonymity promised each individual would hide in a crowd of similar people; Re-Identification research has spent two decades showing how thin those crowds are. Generating synthetic data from real personal records is itself a form of processing under GDPR, which means the moment of moral consequence arrives before a single artificial row exists. So the question is not whether the harm is possible. It is who carries it.

The People Who Vanish, and the People Who Profit

Follow the incentives and the picture sharpens. An organisation sitting on consumer data it never had clear permission to exploit has an obvious motive to find a door that does not require going back to ask. Synthetic data offers a tempting line: no real person is in this dataset, so no real person needs to agree to anything. Critics have a sharper name for that move — Consent Laundering, washing ethically questionable data use through a technical claim until it comes out looking clean.

The asymmetry is brutal. The benefit flows to the institution, which keeps using the data while shedding the obligation that came with it. The cost falls on the outliers — and the outliers, as the research keeps showing, are disproportionately the vulnerable: people with rare conditions, members of small minorities, anyone whose life does not average out. There is a second cost. A generator trained on biased source data does not cleanse that bias; it can entrench it, and Bias Amplification arrives wearing the respectable badge of privacy. The same method now builds Benchmark Datasets that quietly inherit the prejudices they were modelled on. Is synthetic data just consent laundering by another name? Not always — but the incentive to use it that way is structural, and structural incentives do not stay unused.

The Strongest Case for Saying Yes

It would be dishonest to stop here, because the case for synthetic data is real and deserves its best form, not a caricature. Sharing a synthetic dataset is genuinely safer than handing over the raw records — risk reduced is not nothing. There are domains, medical research chief among them, where gathering consent from every person in a dataset is not merely inconvenient but impossible, and where the alternative to synthetic data is not perfect consent but no research at all. Applied with discipline, differential privacy offers something rare here: a mathematical bound on how much any single individual can be exposed. The field is slowly building formal ways to test whether those bounds hold, a sign of a discipline maturing past marketing toward measurement.

And Stadler’s finding, for all its weight, is method- and dataset-dependent. Not every generator failed; some with strong formal guarantees did meaningfully better. So is synthetic data an ethical solution to privacy problems? Under the right conditions, honestly applied, it can be a real improvement. The trouble is the word doing the quiet work in that sentence.

The Word Doing All the Work

The defense holds right up to the moment it slides from reduces risk to anonymous, because those are not the same claim — and only one of them dissolves the obligation. The privacy principles behind GDPR, set out in Recital 26, treat data as anonymous only when re-identifying a person is not reasonably likely using the means realistically available (GDPR Recital 26). The older Article 29 Working Party framework made the bar harder still: genuine anonymity must defeat three attacks at once — singling an individual out, linking records across datasets, and inferring attributes about a person (WP29 Opinion 05/2014). Synthetic data, as the attacks show, can fail all three.

This is also a matter where the ground is still moving, and honesty requires saying so. The European Data Protection Board’s anonymisation guidelines were not finalised as of mid-2026, with a dedicated team tasked to complete them by that summer (EDPB). Whether a given synthetic dataset counts as truly anonymous is, today, genuinely unsettled — case by case, contested, and far from the clean yes the marketing implies. Synthetic does not automatically mean anonymous. And if it is not, the consent question we hoped to escape never actually left.

What Synthetic Data Does to Consent

Thesis: Synthetic data does not remove the consent question — it relocates it, from “may I use your record?” to “may I use your record to manufacture a population that statistically still contains you?”

That relocation is the whole game, and it is why the comfortable framing fails even when the technology works. The moral debt is not paid by the transformation; it is disguised by it. A person who never agreed to have their life turned into training material has the same grievance whether the output copies their record or merely echoes it — the difference is only that the echo is harder to point at. Regulation’s direction quietly concedes the point. The transparency obligations evolving around the EU AI Act — under the provisional Digital Omnibus agreement of May 2026, still not formally adopted — push toward marking synthetic content as synthetic. Labelling something admits it has consequences; we do not put warnings on things that are truly inert. The instinct to mark synthetic data is the regulator saying what the marketing will not: that Synthetic Data Ethics is not a solved problem but an open one, and that calling data artificial does not make the people inside it disappear.

Where I Could Be Wrong

This argument depends entirely on the gap between the promise and the present evidence, and that gap could close. If formal privacy methods mature to the point where the outlier leakage Stadler found becomes genuinely negligible, and if regulators set a clear, enforceable threshold that a generator can be shown to meet, then synthetic data stops being a laundering mechanism and becomes a real privacy gain — and this whole critique dissolves with it. I am not arguing that synthetic data is inherently a fraud. I am arguing that, for now, the confidence has outrun the proof.

The Question That Remains

Synthetic data lets us keep everything useful about people while quietly setting down the obligation we owed them — an old temptation in a new and unusually convincing disguise. When we have manufactured a flawless statistical echo of someone who never agreed to anything, have we finally protected them, or have we simply made their objection impossible to file?

Ethically, Alan.