Anonymized Phone Location Data Not So Anonymous, Researchers Find

Anonymized mobile phone location data produces a GPS fingerprint that can be easily used to identify a user based on little more than tracking the pings a phone makes to cell towers, a new study shows.

Analyzing 15 months of anonymized mobile phone data for about 1.5 million users, researchers at MIT and the Universite Catholique de Louvain in Belgium found that it took very few pieces of data to uniquely identify 95 percent of the users — that is, trace the activity to a specific anonymous individual.

Based on hourly updates of a user’s location, tracked by pings from their mobile phone to nearby cell towers as they moved about or made and received calls and text messages, the researchers could identify the individual from just four “data points.” With just two data points, they could identify about 50 percent of users.

“Mobility data is among the most sensitive data currently being collected,” the researchers write in their study, published in Scientific Reports.

“We show that the uniqueness of human mobility traces is high, thereby emphasizing the importance of the idiosyncrasy of human movements for individual privacy,” they explain. “Indeed, this uniqueness means that little outside information is needed to re-identify the trace of a targeted individual even in a sparse, large-scale, and coarse mobility dataset. Given the amount of information that can be inferred from mobility data, as well as the potentially large number of simply anonymized mobility datasets available, this is a growing concern.”

The data they studied involved users in an unidentified European country, possibly Belgium, and involved anonymized data collected by their carriers between 2006 and 2007.

The controversy over cell location data is growing. Apple and Google have acknowledged collecting and storing user location data.

Government requests for cellphone data have also grown. Last week, two bills were introduced in the House and Senate that would compel law enforcement agents to obtain a warrant before obtaining geolocation data from third-party service providers.

The Geolocational Privacy and Surveillance Act (H.R. 1312), introduced in the House by Rep. Jason Chaffetz (R-Utah) and in the Senate by lawmakers Ron Wyden (D-Oregon) and Mark Kirk (R-Illinois), has gained wide support from the American Civil Liberties Union and the Electronic Frontier Foundation.

“Police routinely get people’s location information with little judicial oversight because Congress has never defined the appropriate checks and balances,” said Chris Calabrese, legislative counsel in the ACLU’s Washington Legislative Office, in a statement when the bills were introduced. “Under the GPS Act, all that would change. Police would need to convince a judge that a person is likely engaging in criminal activity before accessing and monitoring someone’s location data. Innocent people shouldn’t have to sacrifice their privacy in order to have a cellphone.”

The researchers from MIT and Belgium said that the importance of location data will only increase in the future and “knowing the bounds of individual’s privacy will be crucial in the design of both future policies and information technologies.”