This article raises awareness about the potential pitfalls of anonymous Google Forms and offers guidance for both organisations and individuals to navigate these challenges effectively while maintaining trust and confidentiality.
Unveiling An Anonymous Google Form Filler
From time to time, organisations may well want to know how their employees feel about the workplace in order to improve. To encourage honest feedback, they typically send out a survey that can be completed anonymously. But when organisations create Google Forms with the ‘anonymous’ option selected, it appears as though there are means to unveil who filled in the form.
I don’t want to cause widespread panic. I’m sure that honourable organisations wouldn’t think twice about doing unveiling form fillers no matter the content of the feedback.
But what about those organisations that are deeply concerned about the feedback? How could they identified who filled in an anonymous form?
If a survey is immediately followed by demographic information then this certainly narrows who could have filled in the form. But how else can form fillers be unveiled?
It has long been known that anonymous datasets look innocuous enough. But coupling datasets together can result in re-identification, or at least a best guess as to whom data belongs.
Every form completion is timestamped:
And guess what? Every Google Login is also timestamped and viewable by any of your organisation’s GSuite Administrators.
If you sign in late at night when no-one else is likely to be online and then complete the form, then it seems to me that the form can be linked to you with 100% accuracy.
All someone needs to do is cross reference a login timestamp with when a form was completed, and, bingo, you can discover exactly who completed a form.
I don’t have a GSuite Admin account so I borrowed this image from https://i.ytimg.com/vi/7ZmJjJnsVH0/maxresdefault.jpg
And although more complicated, if you fill out the form in a workplace then it becomes possible to link web requests to Google Forms from your computer to the time that a form was completed.
With this in mind, how can you build trust with your employees when using ‘anonymous’ forms, and how can employees avoid being unveiled?
How to build trust when using anonymous Google Forms
- Set the following options when creating a form. Collect Email Addresses: Do not collect. Turn off ‘restrict users’. This reduces the ability to link logins to form completions and increases employee confidence that forms are genuinely anonymous. The drawback is that the form could be hijacked and completed by anyone.
- If collecting demographic information then collect this on a separate form. This will increase employee confidence that such information will not be used to narrow down who might have completed a separate feedback form.
- Never attempt to unveil users unless it is considered beyond ethical reproach. It seriously erodes trust if there is any whiff of dishonesty.
- Consider using an alternative means to collect feedback.
- Consider whether an annual survey is actually effective. Employee mood can change quickly from day to day. See: https://www.youtube.com/watch?v=FOhnjqy_MQU
How to avoid the chances of being unveiled
If you are paranoid, these are some steps that might help:
- Complete the form during work time when lots of other people are likely to be signed in at the same time. This makes it significantly harder to link any one response to a single person via sign in logs. Better still, sign in, wait for an hour or two, and then complete the form. This is probably your best chance of remaining anonymous.
- Insist that any form sent to you does not require you to login when you complete it. Make sure you are totally logged out of all services. Wait a few hours, and then complete the form.
- Don’t fill in the form.
