How to run an anonymous survey people actually trust

Anonymous means no link exists between a response and a person, so no amount of effort afterwards could rebuild one. If someone demanded to know who wrote a particular comment, you could not tell them.

Confidential means you know, or could work out, who said what, and you commit to not using or disclosing it. That is a respectable choice and often the more useful one: it lets you follow up, remove duplicates, and compare this year's answers with last year's for the same person. Qualtrics, for one, renamed its employee-survey anonymity settings to confidentiality settings.

The damage comes from saying one and doing the other. Tell people which you are running, in one plain sentence, in the invitation and at the top of the form. "We are not collecting your name and cannot see who submitted what" is a different promise from "Your answers are confidential and only the HR team will see them," and respondents calibrate what they say to the promise you give them.

By default, yes, from the form owner's point of view. Google's help centre says respondents' usernames are not recorded unless you turn on the setting that collects email addresses, and the response sheet shows a timestamp and the answers, nothing else.

Three settings change that quietly. Collect email addresses (either Verified, which takes the address from the Google Account, or Responder input, which asks people to type it) attaches an email to every response. Limit to 1 response requires respondents to sign in, because Google needs an account to know who already answered; it does not show you their address, but respondents see a sign-in wall and many will assume they are identified. A file upload question also forces a Google sign-in.

Also: a pre-filled link carrying a name or ID saves that value as an answer. And "anonymous" describes what you can see, not what Google's own infrastructure logs, so word your consent text that way.

It depends on the account and the audience setting. On a work or school account, a form set to Only people in my organization can respond records each respondent's name unless you untick Record name. Switch to Anyone can respond and names are not recorded at all. On a personal Microsoft account the Record name option does not exist and responses are always collected without names.

Microsoft's own help page adds a caveat worth repeating to anyone running an internal survey: even with names off, people may be identifiable from a question that asks for personal details, from a small pool of recipients, or from when a response was submitted.

Re-identification rarely needs a name. In a widely cited study, Latanya Sweeney estimated that 87% of the US population was likely unique on just three fields: five-digit ZIP code, gender and date of birth. A workplace survey asking for team, tenure and role band is doing the same thing on a much smaller population.

The standard defence is a minimum reporting group, sometimes called an anonymity or confidentiality threshold. Qualtrics' employee-experience product defaults to 5 for both data points and comments, and Culture Amp's support guide describes its reporting group minimum as usually 5. Below the threshold, results for that group are hidden, not shown with a warning.

Illustration: take a 12-person team and slice it by three departments and three tenure bands. That is nine cells for twelve people, and most cells hold one or two. With a threshold of five, almost none of those breakdowns can be reported.

So the rule runs backwards: do not ask a demographic question whose groups you do not expect to clear the threshold. A breakdown you cannot report costs trust and gives you nothing usable. Our sample size calculator can tell you how many responses a subgroup needs before its numbers mean anything statistically, which is usually well above five.

Not reliably, and it's worth being straight about why. Every mechanism that stops one person submitting twice is a way of recognising them: one-time links identify the recipient, logins identify the account, and IP-based checks identify a network and block colleagues who share one.

In a genuinely anonymous survey you usually accept the duplicate risk, keep the collection window short, and watch for implausible spikes, such as twenty near-identical responses in five minutes. If duplicates would ruin the data, you probably need a confidential survey with a clear promise instead.

Zunoform has an Anonymous responses setting on every plan, including Free. With it on, the IP address, user agent, referring page, approximate location, browser language and screen size are not written with any response, and they are stripped from part-finished responses too. Answers, timing and quiz scoring still work. That lets your consent text say something simple and true: this form does not record who submitted it.

Two honest limits. Hidden fields you put in the share link are still stored, because you chose to add them, so keep identifiers out of the URL. And the setting cannot fix survey design: a demographic question that narrows a team to one person identifies them whatever the tool stores. If you need an employee survey platform with automatic threshold suppression across dashboards, a dedicated tool such as Qualtrics or Culture Amp does that and Zunoform does not. Zunoform Free also caps you at 500 responses a month, while Google Forms has no response cap.