Influence of tracking duration on the privacy of individual mobility graphs

Abstract

Location graphs are a compact representation of individual mobility that can be used as a mobility profile to personalize location-based services. While location graphs are more privacy-preserving than raw tracking data, it was shown that there is still a considerable risk for users to be re-identified by their mobility graph topology. However, it is unclear how this risk depends on the tracking duration. Here, we consider a scenario where the attacker wants to match new tracking data of a user to a pool of previously recorded mobility profiles, and we analyze the dependence of the re-identification performance on the tracking duration. For our experiment, we use a one-year long tracking dataset of 137 users divided into subsets of varying durations (4, 8, 16, 20, 24, and 28 weeks). We find that the re- identification performance increases with growing pool- and test-user tracking duration, and even the smallest tested duration allows to match users significantly better than random. The provided evidence for a tracking duration dependency of user privacy has clear implications for the data collection and storage strategies. It is advised for data collectors to limit the tracking duration or to reset user IDs regularly when storing long-term tracking data.