Personal Data and Anonymization — Erase the Name, and the Person Remains

Location Records Without Names

While using calls, texts, and the internet, a mobile phone connects to nearby cell towers, and the telecommunications network may leave a record of that connection. Those records contain information on which cell tower you were near at what time. If those records have numbers attached to them instead of names, it might seem like nobody knows whose record it is.

When looking into 15 months of movement records for 1.5 million people, the situation was different. In data where locations were recorded on an hourly basis and at the scale of a single cell tower's coverage area, knowing just four points of time and place meant there was only a single person matching those four points in 95% of cases (DOI: 10.1038/srep01376). This means that if someone knows four instances of where you were and at what time on a given day, they can single out your record from a pile of unnamed records.

Even when the records were crudely blurred, the situation did not improve significantly. As times and places were made broader, the rate at which people were narrowed down to a single individual decreased, but it decreased very slowly. The researchers concluded that even coarse data has little power to hide people (DOI: 10.1038/srep01376).

This article follows three questions. How do records with names removed point to people again? What methods have emerged to prevent this? What prices do those methods pay?

Information Flows Even Without a Thief

One of the properties that security protects is confidentiality, the property of ensuring that only authorized people can see that information ("Security" in the other part of this series). It is the work of locking a door to keep unauthorized people out. The earlier location history story does not feature someone breaking through a door. The records were already inside the door, and the question was how far those records flow and to whom they connect.

Privacy is the state in which you can decide to some extent who knows information about you, how far it reaches, and how it is used. If locking the door is the business of security, how far the information brought inside the door goes is the business of privacy. People worry that their right and power to govern information about themselves in the marketplace are being infringed. Yet they also seem to readily give that information away (DOI: 10.1111/j.1745-6606.2006.00070.x). Information flows not only when thieves steal it, but also when we give it away ourselves.

Personal information is information that, by itself or combined with other information, makes a specific person identifiable. The European Union's General Data Protection Regulation (GDPR) also classifies information about a person who is already identified or identifiable as personal information, and uses this boundary to determine whether the regulation applies (DOI: 10.1093/idpl/ipac013). This means that even if a name is not attached, if a person can be recognized, it is personal information.

The paths through which information flows are open in everyday life. Online social network operators are increasingly sharing potentially sensitive information about users and their relationships with advertisers, app developers, and data analysis researchers. Privacy is then usually protected by methods such as erasing names and addresses (DOI: 10.1109/sp.2009.22, 2009). What must be erased for it to be sufficient then remains the question.

What Remains After Erasing Names

The party exporting the data often removes names, addresses, and phone numbers, or replaces them with codes. Identifiers are pieces of information like a name, address, or phone number that point to a specific person on their own. Removing identifiers does not guarantee anonymity. Among the remaining items, things like race, date of birth, gender, and postal code link with other public information to pinpoint that person again and infer information that was not meant to be exported (DOI: 10.1109/69.971193).

Quasi-identifiers are pieces of information like date of birth, gender, and neighborhood that do not reveal identity on their own, but can point to a single person when several are combined. Postal codes and dates of birth are cited as representative examples (DOI: 10.1145/1401890.1401904). Even if you take down the nameplate, you can still find the house. You just need to know which alley it is, which house number, and what color the front gate is. Each piece of information is common on its own, but only one house matches all three combined.

How much does the field narrow as pieces are added? When modeling the probability that a specific person is correctly re-identified in data stripped of names, if someone knows 15 demographic items for that person, it is estimated that 99.98% of Americans will be correctly re-identified in any dataset (DOI: 10.1038/s41467-019-10933-3). This figure is a model estimate and is not a value derived from an actual attack. The authors believe that even datasets with heavily reduced samples struggle to meet the anonymization standards established by the GDPR.

Demographics are not the only thing like this. In 1.37 million app usage records from a city's mobile network, 88% of people who installed more than 10 apps were narrowed down to a single individual using just any 4 of those apps (DOI: 10.1145/3264948). Which apps someone has installed is already nearly unique to each person.

There are also branches in the methods of erasing names. Pseudonymization is a process that replaces identifiers like names with other values, making it impossible to recognize who a person is without separately stored additional information. The party holding that additional information can link the records back to the person. Anonymization is a process aimed at making it impossible to ever figure out whose records they are. In pseudonymized records, the person is obscured, not erased.

Values where identifiers have been swapped also serve as clues. A technique that links records of the same person scattered across multiple datasets while hiding their identity replaces information like names with other values and matches those values against each other. By weaving together the patterns of how those swapped values repeat across multiple patient records with demographic information passed along with them—such as the first three digits of a postal code—the swapped values could be distinguished from one another. By matching these against named data like a voter registry, they could be linked to real people (PMID 41105504). The risk increased the larger the dataset, the more swapped values were attached to a person, and the more demographic information was passed along. In commonly used methods, this risk was less than 1% in datasets under 1 million people, and 10 to 20% at a scale of 250 million people. The authors noted that while such risks are common in many widely used implementations and grow significantly with today's larger datasets, they can be avoided. They stated that choosing better values or having a third party perform the matching without passing along demographic information practically eliminates this risk (PMID 41105504).

Even in records where names have been erased, the remaining pieces can point to a single person again where they overlap.

Putting Different Datasets Side by Side

Even social networks stripped of names and left with only connection webs revealed people. When the network from a photo-sharing site was used as a dataset to match against, based solely on the shape of who was linked to whom, one-third of users confirmed to have accounts on both a microblog and a photo-sharing site were found again in the name-stripped microblog network, with an error rate of 12% (DOI: 10.1109/sp.2009.22). "Who is connected to whom" is metadata—in other words, information surrounding the content, such as who exchanged what with whom and when, rather than the content itself (see "Encryption" in another part of this series). This is an example of how a person can be found again using metadata alone.

Re-identification is the act of reconnecting records whose ownership has been erased back to a specific person. That path is usually cross-matching. A linkage attack is a method of finding the owner of a record by matching a dataset stripped of names with another dataset that has names attached, using items present in both. The birth dates, genders, and ZIP codes in the previous section are precisely those matching items (DOI: 10.1109/69.971193). Examples of matching datasets that an attacker could realistically obtain include voter registries and social media posts (PMID 33448306).

How often re-identification succeeds varies greatly depending on the dataset and conditions. Looking at 14 re-identification attacks known up to 2011 through a systematic literature review—which gathers scattered studies following a set procedure and re-analyzes them—roughly one-quarter of the records were found again on average, and the uncertainty of the estimate was large (DOI: 10.1371/journal.pone.0028071). However, most of this evidence came from small-scale studies and attacked datasets that had not been stripped of identities according to standard criteria. Only 2 of the 14 cases attacked datasets processed according to standards, and among them, the success rate for 1 case targeting health data was 0.00013. The authors noted that while the known evidence shows high re-identification rates, most studies were small and used datasets not processed according to standards, so no conclusion could be drawn about the effectiveness of identity removal methods (DOI: 10.1371/journal.pone.0028071, 2011).

What the attacker holds also changes the risk. When evaluated using data from over 1 million patients at a university hospital in the U.S., assuming the worst-case scenario where the attacker knows all items, the median re-identification risk—the middle value when lined up in order—was 0.987 (with 1 being the most risky) (PMID 33448306). Assuming the attacker actually uses a voter registry, the risk decreased by a median of 90.1%, and assuming they use social media posts, the risk decreased by a median of 100%. This means the risk disappeared for more than half of the people, but it does not mean everyone's risk became 0. The authors conclude that re-identification risk varies depending on the context, and if the risk is properly assessed, data can be shared more broadly than now.

Anonymization cannot make re-identification risk 0, but when done properly, it helps protect privacy (DOI: 10.3233/978-1-61499-858-7-80). Re-identification risk is neither 0 nor certain, and it changes depending on what data is matched by whom against what.

Following You as You Move Between Sites

When you first enter a website, a window often pops up asking whether it is okay to save something. A cookie is a small record that a website leaves in your browser and uses to recognize it when the same browser returns later. What that window is asking is whether it is okay to leave this record. Cookies are not left only by the specific site you entered. Looking at 1 million popular websites, more than 6 out of 10 planted cookies from other companies, and nearly 9 out of 10 leaked user data to places users would not expect (DOI: 10.48550/arxiv.1511.00619, preprint, 2015 measurement).

Tracking is the act of gathering and connecting the traces you leave while moving across multiple sites as belonging to the same single person. If two web pages contain the same tracking company and that company has attached a unique cookie to your browser, the visits to both pages can be linked as coming from the same browser. This remains true even if your internet address changes (DOI: 10.1145/2736277.2741679). Around 2015, if a snooping party intercepting unencrypted communications used these cookies, they could reconstruct 62 to 73% of a typical user's browsing history in simulations (DOI: 10.1145/2736277.2741679). Once communications are encrypted, snooping parties cannot read cookies.

Regulations have also changed things. After the European Union's data protection regulation took effect in May 2018, 62.1% of European websites began displaying cookie consent notices (DOI: 10.14722/ndss.2019.23378). The authors conclude that while the web has become more transparent, properly functioning and easy-to-use mechanisms that let users consent to or reject personal data processing are still lacking. Another study examining 2,000 highly visited websites finds that the regulations changed the behavior of non-European sites as well, and that third-party opt-out services reduced tracking. Even so, tracking was still everywhere. Cookies capable of recognizing users were found when visiting over 90% of sites, and many sites displayed misleading notices (DOI: 10.1145/3321705.3329806). Earlier research has also shown that websites do not always respect what users choose in consent windows (DOI: 10.1145/3442381.3450056).

Websites have also increasingly used methods that recognize the same user through traits of the browser itself instead of cookies (as of 2015). One study proposing a technique to block this method concluded that the real problem is not that there is only a single such trait, but rather that multiple visits can be linked as the same one, and thus presented a method that changes the traits slightly each time to break the connection (DOI: 10.1145/2736277.2741090). Whether through cookies or browser traits, tracking is the act of stitching scattered visits into one.

$k$ Houses of the Same Shape

The first way to block this is to blur quasi-identifiers before releasing the data. $k$-Anonymity is a standard that ensures that no single person's record in released data can be distinguished from at least $k-1$ other records by their quasi-identifiers. It is a standard created so that hospitals or banks can hand over individual-level data to researchers while making it useful without its owner being re-identified (DOI: 10.1142/s0218488502001648). If $k$ is 5, anyone's record is hidden among at least five records of the same shape. On an alley lined with at least five houses of the same shape, you cannot pick which house is which without a nameplate. The way to adjust this is to change values to less specific ones, or not release them at all (DOI: 10.1142/s021848850200165x). It is like writing age as "30s".

There are loopholes in this standard. If all five hidden people suffer from the same disease, that disease is exposed even if you don't know who is who. When an attacker holds background knowledge, $k$-anonymity also fails to guarantee privacy (DOI: 10.1145/1217299.1217302). Conversely, it can blur things excessively. Simulating with three large data sets, in one re-identification scenario $k$-anonymity consistently blurred data more than necessary, and the correspondingly distorted data was less useful for subsequent analyses (DOI: 10.1197/jamia.m2716). The authors jointly propose another method that keeps risks low while reducing information loss.

Deliberately Mixing Noise into Results

Even if you export only totals, such as "how many people have this disease" instead of personal records, information leaks if you export many overlapping totals accurately. There is an attack that roughly reconstructs the sensitive traits of everyone in the data from the totals, and an attack that figures out whether a particular person's data is included in it (DOI: 10.1146/annurev-statistics-060116-054123). Therefore, institutions that export totals face the same problem.

Through internal research, the U.S. Census Bureau confirmed that the public protection mechanisms used in the 2000 and 2010 censuses had serious vulnerabilities. These were vulnerabilities exposed by a mathematical result called the "Database Reconstruction Theorem" (DOI: 10.1145/3219819.3226070, a 1-page presentation abstract by the Census Bureau). This theorem is a 2003 result showing that if you give too many answers with too little noise, almost all of the data can be reconstructed, which is the same story as the reconstruction attack in the previous paragraph. Considering that external data and computing power now far exceed those of statistical agencies, existing protection methods were deemed too fragile, and a new framework was introduced for the 2020 census (DOI: 10.1146/annurev-statistics-010422-034226).

Differential privacy is a method of deliberately mixing noise into results so that whether any one person's data is included or excluded, the exported result hardly changes. In the census, it is used by adding noise to tabulated tables (DOI: 10.1126/sciadv.abk3283). If the result is almost the same whether a person is present or not, that person is hardly revealed any more in the result just because they were included in the data. However, guessing that person through the group trends shown by the result cannot be prevented, because it works the same even if that person is omitted from the data. In data mixed with noise, the overall shape can be read, but it is difficult to extract an individual's data (PMID 34909703). Differential privacy is a mathematically rigorous definition of this type of protection. Almost all methods covered in a monograph introducing this field maintain this property even in front of an attacker with infinite computing power. Still, fundamental limitations remain, and those limitations apply not only to differential privacy but to any method that tries to prevent privacy from completely collapsing (DOI: 10.1561/0400000042).

Noise can also be mixed at the collection stage. If software on user devices randomly mixes answers before sending reports, statistics can be collected so that, in the developers' expression, you can look at the forest but not see individual trees (DOI: 10.1145/2660267.2660348).

The Trade-off Between Utility and Protection

When you add noise to population counts, the mortality rates that use those counts as denominators also fluctuate. The 2020 U.S. Census population counts came to hold such noise, and when checked against actual COVID-19 death curves, using the noisy population counts as denominators distorted mortality rates significantly, with some calculations even coming out to over 100% (DOI: 10.1177/2378023121994014). The distortion was especially large in groups of under 1,000 people, and such groups accounted for 40% of county-level age-and-gender brackets and 60% of race brackets. The authors wrote that the Census Bureau should consider opting for weaker protection, while data users should consider aggregating data.

Problems also surfaced in the application of redrawing legislative districts. At the time of the study (2021), the Census Bureau's experimental system systematically undercounted populations in racially and politically mixed areas, producing unpredictable biases. Meanwhile, it failed to prevent people's races from being accurately inferred from published statistics (DOI: 10.1126/sciadv.abk3283). As we saw earlier, inferring individuals from neighborhood statistics is not something differential privacy promises to prevent, even though that person can be left out of the data. The authors wrote that striking a balance between accuracy and respondent privacy is difficult.

In other applications, the results differed. When examining neighborhood-level premature mortality inequalities in Massachusetts and Georgia using three demonstration data sets released in advance by the Census Bureau, the overall shapes of inequalities by racial group and level of economic deprivation were not broken by this method. The issue where the mortality rate error for the Black population was larger than that for non-Hispanic whites in the early version of Massachusetts was also reduced in the new version (PMID 37595037, PMID 2023).

Setting the strength of protection itself is also difficult. The challenges the Census Bureau encountered in actually adopting differential privacy included choosing the value that determines the strength of protection, anticipating all uses of confidential data, and lacking the tools and personnel to verify that the implementation is correct (DOI: 10.1145/3267323.3268949).

Processes that blur data or add noise introduce bias and fluctuation into results, and so weighing is required between the utility of release and the worry of exposure (DOI: 10.1146/annurev-statistics-033121-112921). The stronger the protection, the lower the utility, and where to stand in between is a matter of choice.

Collecting Less from the Start

A practical guideline for sharing health data places its starting point in one principle. Data minimization is the principle of collecting and keeping only the information necessary for the purpose, at the level of detail required. Information that is not collected cannot leak. Following this principle, the guideline advises avoiding unnecessarily detailed values and items that can point back to a person when combined with other data (PMID 40986522). As methods, it lists rounding numbers, using ranges instead of exact values, adding slight noise to numbers, grouping and aggregating, handling dates, and separating sensitive items from identity items. The guideline also notes that there is no universally accepted standard for these treatments.

There are also designs that do not send information outside of my device at all. In a field experiment on smartphone targeted advertising, an app that kept user information inside the phone without sending it to the company's servers while still providing targeted messages reduced the feeling that my information crossed a line it should not have crossed. Users saved messages more frequently only in that app (DOI: 10.25300/misq/2013/37.4.07, 2013).

There are also data for which lowering the level of detail is not enough. For the location records in the first section, even when time and place were roughly blurred, the proportion of being identified as a single person decreased very slowly (DOI: 10.1038/srep01376).

A Phone on the Commute Home

You turn on your phone screen on the subway ride home. During those few minutes of using the internet, three kinds of records can be created. On the telecommunication network side, what time you connected to which base station can remain. In the network's app usage history, what apps this phone uses can remain. If you open a news site, and if a tracking company is embedded in that page, that company can attach a cookie to your browser.

All three records may not have a name. Even so, each becomes a clue to single out one person. If someone knows four times when and where you were, 95% were singled out as a single person in location records written in one-hour units and base station ranges. If you know 4 apps someone installed, 88% of people who installed more than 10 apps were singled out. Cookies from the same tracking company link visits to different sites to a single browser. The three results were measured separately from different datasets.

If you export these records for research, you can apply the tools seen earlier one by one. Intentionally blurring locations had a small effect on this type of data. Instead of per-person records, you can also export only totals like "how many people near this station at 6 PM," but if you export totals in large numbers and accurately, there is a tracing attack, so noise is mixed in. A scoping review examining health research pointed out the problem that accuracy drops in small data (PMID 34333623), and in the census, the mortality rate of groups under 1,000 people was calculated to be distorted particularly largely (DOI: 10.1177/2378023121994014). Records not left at all cannot leak. If you do not leave location records from the start, nothing leaks from there, but the analysis you intended to do with those records also disappears. Leaving them only roughly had a small effect on this type of data.

If it is a record left and exported, no tool makes the risk zero, and each tool receives part of its usefulness as a price. A 2011 literature review noted that it could not conclude how often data stripped of identity according to criteria is actually breached by attacks, and subsequent studies showed that the risk varies greatly depending on what data, who, and what it is matched against.

Where to Look Next

The story that metadata remains even when encryption hides the contents is covered by another piece in this series, "Encryption". The network of relationships seen in this article is an example.

The problem of once-collected records lingering for a long time is covered by The Right to Be Forgotten — The Internet Never Forgets (/articles/right-to-be-forgotten).

Faces are also clues that point to people. The issues when the state uses faces to find people are in Facial Recognition — What the Law Has Not Decided (/articles/facial-recognition-surveillance).

Another path to confirming only what is needed while giving away less is covered by Zero-Knowledge Proofs: Proving the Truth Without Revealing the Data (/articles/zero-knowledge-proofs-basics).

Source Papers

• "Unique in the Crowd: The privacy bounds of human mobility" (2013) — DOI: 10.1038/srep01376 — 1.5 million people, 15 months of movement logs. At hourly intervals and cell tower resolution, four points make 95% of individuals unique. Uniqueness decreases only by the square root of about one-tenth of the resolution, meaning even coarse data retains low anonymity.
• "The Privacy Paradox: Personal Information Disclosure Intentions versus Behaviors" (2007) — DOI: 10.1111/j.1745-6606.2006.00070.x — Consumers appear worried about infringements on their rights and ability to control personal information, yet readily hand it over. Explores the relationship between disclosure intentions and actual behavior.
• "From knowing by name to targeting: the meaning of identification under the GDPR" (2022) — DOI: 10.1093/idpl/ipac013 — Under the GDPR, identification is the boundary concept separating personal data (information relating to an identified or identifiable natural person) from non-personal data. Proposes targeting as a new type of identification.
• "De-anonymizing Social Networks" (2009) — DOI: 10.1109/sp.2009.22 — Social network operators share information with advertisers and others through anonymization that strips names and addresses. Connection structure alone re-identifies one-third of users common to two services with a 12% error rate.
• "Protecting respondents identities in microdata release" (2001) — DOI: 10.1109/69.971193 — Anonymity is not guaranteed even by deleting or encrypting names, addresses, and phone numbers. Race, date of birth, gender, and postal code link with public data to re-identify individuals. Defines k-anonymity.
• "The cost of privacy" (2008) — DOI: 10.1145/1401890.1401904 — Evaluates methods relying on generalization and suppression of quasi-identifiers like postal codes and dates of birth as a privacy-utility trade-off.
• "Estimating the success of re-identifications in incomplete datasets using generative models" (2019) — DOI: 10.1038/s41467-019-10933-3 — Generative model estimation shows 15 demographic attributes re-identify 99.98% of Americans. Sampled anonymous data also struggles to meet GDPR anonymity standards.
• "Your Apps Give You Away" (2018) — DOI: 10.1145/3264948 — App usage logs of 1.37 million people in a single city. 88% of users who installed more than 10 apps are uniquely re-identified by 4 random apps.
• "Re-identification risk for common privacy preserving patient matching strategies when shared with de-identified demographics." (2026) — PMID 41105504 — Re-identification through repetition of encoded values and public demographic information. Under 1 million people: under 1%; 250 million people: 10–20%. Can be avoided with better tokens and third-party matching.
• "A Systematic Review of Re-Identification Attacks on Health Data" (2011) — DOI: 10.1371/journal.pone.0028071 — 14 attacks, roughly one-quarter re-identified on average (high uncertainty). Attacks on data processed according to standards: 2 cases, 1 health data case with a success rate of 0.00013. Evidence focuses mainly on small-scale, non-standard-compliant data, preventing conclusions on effectiveness.
• "Enabling realistic health data re-identification risk assessment through adversarial modeling." (2021) — PMID 33448306 — Patient data from over 1 million people. Median worst-case risk 0.987, decreases by 90.1% assuming voter lists and 100% assuming social media posts. Risk is context-dependent.
• "Effectiveness of Anonymization Methods in Preserving Patients' Privacy: A Systematic Literature Review" (2018) — DOI: 10.3233/978-1-61499-858-7-80 — Anonymization cannot reduce re-identification risk to zero, but helps preserve privacy when done properly.
• "Exposing the Hidden Web: An Analysis of Third-Party HTTP Requests on 1 Million Websites" (2015, public server edition) — DOI: 10.48550/arxiv.1511.00619 — Roughly 90% of 1 million websites leak data to places users are unaware of, and over 60% create third-party cookies.
• "Cookies That Give You Away" (2015) — DOI: 10.1145/2736277.2741679 — Unique cookies from the same tracker link visits to different pages to the same browser (even if the IP changes). In simulations, eavesdroppers reconstruct 62–73% of visit histories.
• "We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy" (2019) — DOI: 10.14722/ndss.2019.23378 — 62.1% of European websites display cookie consent notices. The web has become more transparent, but usable consent and opt-out tools remain lacking.
• "Can I Opt Out Yet?" (2019) — DOI: 10.1145/3321705.3329806 — 2,000 sites. While the GDPR changed behavior globally and third-party opt-out services reduced tracking, over 90% of sites feature tracking cookies and many misleading notices.
• "PriVaricator" (2015) — DOI: 10.1145/2736277.2741090 — Browser fingerprint collection increases as an alternative to third-party cookies. The core of the problem is not uniqueness, but the linkability between visits.
• "k-ANONYMITY: A MODEL FOR PROTECTING PRIVACY" (2002) — DOI: 10.1142/s0218488502001648 — A model where holders like hospitals and banks release data usefully without individuals being re-identified. Each person is indistinguishable from at least $k-1$ others.
• "ACHIEVING k-ANONYMITY PRIVACY PROTECTION USING GENERALIZATION AND SUPPRESSION" (2002) — DOI: 10.1142/s021848850200165x — Achieving k-anonymity through generalization (replacing with less specific values) and suppression (not exporting).
• "L -diversity" (2007) — DOI: 10.1145/1217299.1217302 — When the diversity of sensitive attributes is low or attackers possess background knowledge, k-anonymous data fails to guarantee privacy.
• "Protecting Privacy Using k-Anonymity" (2008) — DOI: 10.1197/jamia.m2716 — Large dataset simulation. In one re-identification scenario, k-anonymity increases information loss through over-anonymization. Hypothesis testing approaches are better.
• "Exposed! A Survey of Attacks on Private Data" (2017) — DOI: 10.1146/annurev-statistics-060116-054123 — Reconstruction and tracking attacks on aggregated data. Re-identification attacks easily reconnect de-identified records.
• "The U.S. Census Bureau Adopts Differential Privacy" (2018, 1-page presentation abstract) — DOI: 10.1145/3219819.3226070 — Internal research confirms severe vulnerabilities revealed by database reconstruction theorems in the public protection mechanisms of the 2000 and 2010 censuses, leading to the design of a differential privacy release framework.
• "Confidentiality Protection in the 2020 US Census of Population and Housing" (2022) — DOI: 10.1146/annurev-statistics-010422-034226 — In an era where external data and computing power surpass institutional boundaries, existing disclosure limitation methods are too fragile. Deploys a differential privacy framework for the 2020 census.
• "The use of differential privacy for census data and its impact on redistricting: The case of the 2020 U.S. Census" (2021) — DOI: 10.1126/sciadv.abk3283 — Differential privacy adds noise to summary tables. Skews local data through undercounts, but does not prevent individual race prediction. The difficulty of balancing accuracy and privacy.
• "The Algorithmic Foundations of Differential Privacy" (2014) — DOI: 10.1561/0400000042 — Differential privacy is a rigorous privacy definition. Almost all algorithms hold against attackers with arbitrary computing power. However, fundamental limits apply to any method.
• "RAPPOR" (2014) — DOI: 10.1145/2660267.2660348 — Collects statistics from user software via randomized response while ensuring individual reports cannot be linked. "See the forest, not the trees."
• "Differential Privacy in the 2020 Census Will Distort COVID-19 Rates" (2021) — DOI: 10.1177/2378023121994014 — Noisy denominators heavily distort COVID-19 mortality rates, sometimes exceeding 100%. Particularly large in groups under 1,000 people (county age/gender bundles 40%, race bundles 60%). Considers larger privacy budgets and data grouping.
• "Impacts of census differential privacy for small-area disease mapping to monitor health inequities." (2023) — PMID 37595037 — Overall patterns of premature mortality disparities in Massachusetts and Georgia are preserved. Black error magnification in early editions improved in new editions.
• "Issues Encountered Deploying Differential Privacy" (2018) — DOI: 10.1145/3267323.3268949 — Challenges faced by the Census Bureau: lack of personnel and computing environments, accounting for all uses of confidential data, setting privacy loss values, and a shortage of implementation verification tools and personnel.
• "Statistical Data Privacy: A Song of Privacy and Utility" (2022) — DOI: 10.1146/annurev-statistics-033121-112921 — The trade-off between public demand and exposure concerns. Sanitization mechanisms introduce bias and variance, requiring the reflection of uncertainty.
• "Ten quick tips for protecting health data using de-identification and perturbation of structured datasets." (2025) — PMID 40986522 — Practical recommendations based on the data minimization principle (rounding, ranges, perturbation, aggregation, dates, separating sensitive items). No universal standard exists.
• "Addressing the Personalization–Privacy Paradox: An Empirical Assessment from a Field Experiment on Smartphone Users" (2013) — DOI: 10.25300/misq/2013/37.4.07 — Personalization apps that keep information inside the smartphone reduce feelings of information boundary intrusion and increase message saving (field experiment).
• "Differential privacy for public health data: An innovative tool to optimize information sharing while protecting data confidentiality." (2021) — PMID 34909703 — Differential privacy is a rigorous definition targeting all possible attackers. Simply put, it mixes statistical noise to describe overall patterns while making it difficult to extract individual data.
• "Differential privacy in health research: A scoping review." (2021) — PMID 34333623 — Scoping review of 54 health studies. Still in early stages, actual application cases are rare, and loss of accuracy in small data is a problem.
• "User Tracking in the Post-cookie Era: How Websites Bypass GDPR Consent to Track Users" (2021) — DOI: 10.1145/3442381.3450056 — Cookie consent windows have spread, but websites do not increasingly respect user choices, and cookie-less tracking is projected to emerge.