ITIN in privacy-first sandboxes
The ITIN exists so people ineligible for an SSN can still file taxes. That changes the privacy risk compared to the SSN: here the sensitive part is not just the number, but what it signals about the person.
A full profile, not just the number, is what actually exercises an international intake form without depending on real data.
No row in this dump points to a real person, even combining number and country, because both columns were generated together inside the sandbox.
Keeping the two pipelines physically separate is what stops a test value from ending up, by mistake, on a form actually submitted.
No. ITIN is for federal tax purposes and does not replace SSN for benefits or work authorization.
Never. The generator only produces a plausible format, with no IRS lookup, and submitting an invented number on a real W-7 is fraud.
Because the record tends to travel with fields that signal residency or immigration status, an attribute handled with more care than a purely tax-related field.
Nonresidents who must file US taxes, and dependents or spouses of a taxpayer who do not qualify for an SSN, exactly the population the IRS created the ITIN to serve.
Mask the field before any logging, always generate it in the browser, and clear the fixture from the staging database once the test finishes.
Generation happens locally in the browser. Analytics receives only action, status, type and format, never the generated ITIN.