Unique in the Crowd: The privacy bounds of human mobility

When two postal-code locations (e.g., day and night, home and work) are sufficient to specifically identify 90% of the population, and with Android devices being infested with location-tracking capabilities (above and beyond GPS), creating a pseudonymous account != hiding your identity from Google (or whomever else it shares data with, intentionally/willingly or otherwise). As I've noted previously (<https://news.ycombinator.com/item?id=30953159>), I recall but cannot find the 2-ZIP-code example, though a paper describing four location points IDing 95% of the population uniquely is here: <https://www.nature.com/articles/srep01376> ZIP + gender + date of birth is another…

If you were expecting anything more than Google trying to k-anonymize your datasets, you will be disappointed. “K-anonymity was born out of a desire both to quantify the re-identifiability of a dataset, and to balance the usefulness of de-identified people data and the privacy of the people whose data is being used.” Researchers have also shown recently that many high-dimensional datasets (mobile phone metadata, online ratings, etc.) cannot be de-identified without loosing all their utility [1, 2, 3]. In that case, there is no distinction between quasi-identifiers and sensitive data. All the information in the dataset can be used to identify an individual.…

A fairly classical example of readily de-anonimisable data is location, at postal-code resolution. With nothing more than two postal codes (ZIP codes in the US), representing home and work, it's possible to individually identify about 90% of the population. That information is available via, say, geocoded location using mobile phone or tracking cookie data.[1] In the case of device or vehicle tracking such as with drones, it's highly likely that a given device would be used within a particular jurisdiction or activity region. If you can pinpoint specific locations and times within those (e.g., police activity around an address + drone activity, activity following specific…

This is not quite incorrect. Some of the NYC taxi re-id demonstrations relied on reversing the hash for medallions, but most have not. In particular, the celebrity tracking did not require the medallion, since each record contains an origin and a destination. The identity of the driver across trips is irrelevant, since it is the passenger who is being tracked. The way this attack worked was to match an origin in the trip dataset to the timestamp on the celebrity photo. This revealed the destination of the trip. In other cases, no photo is necessary (trips originating or ending at a residential address, linked to another sensitive location such as an abortion…