How "Make it anonymous" uses AI decision-making to check a survey is really anonymous

New to anonymous surveys? Read how to make an anonymous survey in BlockSurvey first to see how to turn it on. This post explains how the check works behind the scenes.

A toggle is only as honest as the survey behind it

When a creator turns on Make it anonymous, they are promising respondents that nobody can tell who answered. That promise breaks the moment the survey asks "Please enter your full name". The toggle cannot just switch on. The survey has to be checked first.

The check has to answer one question: does anything in this survey ask the respondent for a personal identifier? We answer it in two steps, from the cheapest to the most careful.

Step 1: Question types that always identify someone

Some question types collect an identity by their nature: email, phone number, website, country, signature, payment, cart, contact form, and the wallet and social-login questions. If a survey has even one of these, it cannot be anonymous. No model is needed, because the type alone settles it.

The creator sees a plain reason: the survey contains PII questions. They remove the question and try again.

Step 2: Jev reads the open-ended questions

Types are not enough. A short text box or a comment box can ask for anything. "What could we do better?" is harmless. "Please enter your full name" is not, yet both are the same type. Only the wording tells them apart.

Jev is a decision model. We give it some text and a typed question about it, and it answers with a choice and a probability for each choice. It does not write text. For every open-ended question we ask Jev one thing: does this question ask the respondent for a personal identifier? It answers with a probability for identifier and for not_identifier.

Why Jev. This is a fixed two-label judgment, which is what Jev's Choice question is built for. It is also a judgment about meaning, not keywords. "Which neighborhood do you live in?" has no word like "name" or "address" in it, yet it points to a place more precise than a city.

What counts as an identifier. We wrote the description wide on purpose. It covers names, email, phone, street address, postal code, neighborhood, date of birth, government IDs, and reference numbers tied to a person or their purchase, such as an employee ID or an order number. It also covers usernames, IP addresses and biometrics. Opinions, ratings, job titles, company names, age ranges, birth year, and city, state or country are not identifiers.

Why the bar is low. Jev's probability decides, and we block a question at a deliberately low probability that it asks for an identifier. The two mistakes are not equal. A missed identifier breaks the promise to respondents. A question that gets flagged by mistake costs the creator a quick reword.

Types catch what always identifies. Jev catches what only the wording reveals.

Seven questions, one verdict

We ran these open-ended questions through the real check. Jev gave each one its own judgment.

One flagged question is enough to stop the toggle. The creator then sees a sentence that names the most likely question, for example The question "Please enter your full name" asks for a personal identifier, which could identify respondents. If more questions are flagged, it adds how many others may do the same. Remove or reword them, and the survey passes. A survey with only harmless questions turns anonymous.

One question, one judgment

A survey can have many open-ended questions, and the creator is waiting on the toggle. Each question still gets its own separate judgment, so one risky question cannot hide behind safe ones. To keep it fast, the questions go to Jev in a few grouped requests that run at the same time.

Only the wording of the survey's own questions is sent: the label and description, with any formatting removed. No respondent answers are involved, because the survey has not been answered yet.