Digital Traces and Privacy: Why Anonymisation Fails

The intuition behind anonymisation is that identity lives in identifiers, so removing identifiers removes identity. For behavioural data this is simply false. A sequence of locations, purchases or interactions is close to unique to an individual well before it becomes long enough to be interesting.

The uniqueness results

The empirical work is consistent across domains and the numbers are small. In mobility data recorded at the resolution of mobile network cells, a handful of approximate location-and-time points is enough to single out the great majority of individuals in a large population. Credit card transaction records behave the same way: a few purchases with rough dates and amounts identify most people in a dataset of millions. Browsing histories, app usage patterns and even typing rhythms show comparable uniqueness.

The reason is combinatorial rather than incidental. Each additional data point multiplies the space of possible individuals, and behavioural data is high-dimensional. Coarsening the resolution helps far less than expected, because uniqueness survives substantial blurring of both time and place.

Linkage is the actual attack

Re-identification rarely works from the anonymised dataset alone. It works by linking it to something else. A public dataset with location traces plus any independent source that places a known person at a known place and time - a social media post, a published photograph, a court record - collapses the anonymity of that trace. The published taxi-trip datasets that were successfully de-anonymised were compromised this way, not by breaking the pseudonymisation but by matching against photographs with timestamps.

This means the security of an anonymised release depends on auxiliary information that the releaser does not control and cannot inventory. Guarantees of the form "this cannot be re-identified" are therefore not statements anyone is in a position to make.

What actually helps

• Formal privacy guarantees. Differential privacy provides a mathematical bound on how much any individual's presence can affect published output, and the bound holds regardless of what auxiliary information an attacker has. That last property is what distinguishes it from every heuristic approach. The cost is accuracy, and at strong privacy settings the cost is substantial for fine-grained queries.
• Not releasing the data. Secure enclaves where researchers run code against data they never see, and federated approaches where computation is distributed and only aggregates return, shift the problem from anonymising a release to controlling access. This is now the standard arrangement for sensitive administrative data.
• Synthetic data, with care. Generated data preserving the statistical structure of the original is useful for developing and debugging analysis. It is not a substitute for the real thing for inference, since it can only reproduce relationships the generator was built to capture.

Consent does not scale

Individual consent works when the use is specific and comprehensible at the point of agreement. Research uses of behavioural data are usually neither: they are decided after collection and their implications are not assessable by the person consenting. Nor is the harm purely individual. Inferences drawn from a sample apply to everyone who resembles the sample, including people who never consented to anything - a group harm that individual consent frameworks are structurally unable to address.

What this means for research

Platform data enabled a large body of work on social networks and media effects that no survey could have produced. It also created a dependency: the data is controlled by the organisations being studied, access can be withdrawn, and what is available is shaped by commercial rather than scientific priorities. Research built on that foundation carries a structural conflict of interest that is worth naming in the methods section rather than the acknowledgements. The evidentiary consequences run through big data and public policy.