Location and biometric privacy

"They anonymized the dataset by deleting the names. I re-identified 95% of the users from four timestamped GPS pings. The remaining 5% simply never left home."

A Re-Identifying AI Agent

Why location and biometrics are a special category

Ordinary sensor readings, a vibration spectrum from a pump or a temperature series from a warehouse, describe machines and spaces. Location and biometric data describe an individual and, decisively, they let you re-identify that individual across otherwise unrelated datasets. Three properties drive the special treatment.

First, uniqueness. Human mobility is astonishingly individual. A landmark study of fifteen months of anonymized mobile-phone records found that just four approximate space-time points were enough to uniquely single out 95% of people in a population of one and a half million. Biometrics are unique by construction: a face embedding, an iris code, or an ECG-derived template is designed to distinguish one person from everyone else. Second, immutability. A breached credential is rotated; a breached biometric is permanent. This inverts the usual security calculus, because the cost of a leak does not decay over time. Third, inference reach. Location implies religion (which building you enter on which day), health (which clinic you visit), and relationships (whose home you sleep at). Biometrics leak health directly: a photoplethysmography stream carries heart-rate variability and arrhythmia markers (Chapter 30), and gait or keystroke dynamics can flag neurological conditions the user never disclosed.

Regulators encode this. The EU GDPR names biometric data used for identification and data revealing precise location patterns as sensitive, demanding an explicit lawful basis and, often, a data-protection impact assessment. Illinois's Biometric Information Privacy Act attaches statutory damages per violation to collecting a faceprint or fingerprint without written consent, and it has produced nine-figure settlements. The regulatory detail is developed in Section 70.6; the engineering point is that these data classes carry legal liability that a bearing-temperature log does not.

Techniques that actually reduce the harm

Because deletion of labels fails, the engineering toolkit works on the signal itself. Four techniques, roughly in order of increasing protection, cover most systems.

Minimize and reduce on-device. The cheapest privacy is data you never store. A fall detector needs the event, not the trajectory; a step counter needs a count, not the raw accelerometer stream that also encodes gait biometrics. Extracting features at the edge (Chapter 59) and transmitting only the derived label collapses the attack surface. Coarsen resolution. Location harm scales with spatial and temporal precision, so snapping coordinates to a grid and timestamps to an interval (spatial and temporal cloaking) trades a small utility loss for a large privacy gain. Add calibrated noise. Differential privacy provides a formal guarantee: a randomized mechanism \(\mathcal{M}\) is \(\varepsilon\)-differentially private if for neighbouring datasets \(D, D'\) differing in one person's record, and any output set \(S\),

The parameter \(\varepsilon\) is a privacy budget: smaller means more noise and stronger protection. For a numeric query of sensitivity \(\Delta f\) (the most one person can change the answer), the Laplace mechanism adds noise drawn from \(\mathrm{Lap}(\Delta f / \varepsilon)\), which is why aggregate statistics over a cohort can be released while individual traces cannot. Template protection for biometrics. Never store a raw biometric or a reversible embedding; store a cancellable, salted transform so that a breach can be revoked by re-enrolling under a new salt, and so the stored value cannot be inverted back to the face or fingerprint.

Re-identification risk and a small measurement

Before releasing or even internally sharing a location dataset, measure how identifying it is rather than asserting it is safe. A practical proxy is trajectory uniqueness: given records coarsened to some spatial and temporal resolution, what fraction of users are singled out by a small number of their own points? If a handful of points uniquely picks out most users, no amount of name-stripping will save you, and you must coarsen further or switch to aggregate-only release.

import numpy as np

def uniqueness_fraction(traces, n_points=4, space_m=500, time_s=3600, rng=None):
    """Fraction of users uniquely identified by n_points space-time points,
    after snapping to a (space_m, time_s) grid. traces: dict user_id -> array
    of (x_m, y_m, t_s). Higher fraction => weaker anonymity."""
    rng = rng or np.random.default_rng(0)
    signatures = {}
    for uid, arr in traces.items():
        gx = np.round(arr[:, 0] / space_m).astype(int)
        gy = np.round(arr[:, 1] / space_m).astype(int)
        gt = np.round(arr[:, 2] / time_s).astype(int)
        cells = list({(x, y, t) for x, y, t in zip(gx, gy, gt)})
        if len(cells) < n_points:
            signatures[uid] = None            # too short to sample: skip
            continue
        idx = rng.choice(len(cells), n_points, replace=False)
        signatures[uid] = frozenset(cells[i] for i in idx)

    valid = {u: s for u, s in signatures.items() if s is not None}
    unique = sum(
        1 for u, s in valid.items()
        if not any(s == s2 for u2, s2 in valid.items() if u2 != u)
    )
    return unique / max(len(valid), 1)

The function above deliberately mirrors the "four points identify 95%" result: coarsen more (larger space_m, time_s) and the uniqueness fraction drops, quantifying the privacy-utility trade you are making. Use it as a gate in a data-release pipeline, not as a one-time audit.

What's Next

In Section 70.3, we turn from what the system reveals about a person to how well it works across different people. Location and biometric models often perform unevenly across skin tones, body types, ages, and environments; the next section develops fairness across users, bodies, and environments, and the measurement discipline needed to detect disparate performance before it reaches the field.