The transactions are pseudonymous - a public key of each participant is recorded, and world readable. The public key doesn't have to be connected to a real world identity. An attacker could analyse the transaction history to infer the identity controlling a given key, depending on how it was reused/managed.
But this can actually be pretty difficult to manage correctly.
While "best practice" is to generate a new btc address for each transaction, there are still ways to attempt to profile users even if they use that rule. For instance, if someone knows you like an esoteric thing, and they know you have a lot of bitcoin, they can look at people buying things from public addresses (most shops or established bodies have permanent addresses for receiving) that are associated with esoteric thing, and say it's likely that you were purchasing at least some of that. They can do other filtration and process-of-elimination things to find out who is using what, or where something comes from.
Additionally, if the wallet of one who you've traded with in the past is compromised, even if they were using single-transaction addresses, the attacker may be able to fill in some missing links in the chain, especially if the wallet's owner has recorded anywhere a translation from btc address to useful memo/accounting data. Imagine if UBL used btc and the Feds got his wallet; everyone downstream would be hunted with some serious prejudice.
I should clarify that in bitcoin, the entire transaction chain from the time the block is generated until the last time it is used is recorded forever. Once you send from an address to another address, that transaction is ingrained in btc for the remainder of its existence, and every coin you receive has a long history that shows all of that. While the names are long hashes and not things like "TERRORIST KINGPIN -> INNOCENT BUT NOW SUSPECT GUY", there are some ways to put something like that together, and they're not all obvious.
