Large-scale collection of human behavioral data by companies raises serious privacy concerns. We show that behavior captured in the form of application usage data collected from smartphones is highly unique even in very large datasets encompassing millions of individuals. This makes behavior-based re-identification of users across datasets possible. We study 12 months of data from 3.5 million users and show that four apps are enough to uniquely re-identify 91.2% of users using a simple strategy based on public information. Furthermore, we show that there is seasonal variability in uniqueness and that application usage fingerprints drift over time at an average constant rate.
@article{arxiv.1806.03615,
title = {Temporal Limits of Privacy in Human Behavior},
author = {Vedran Sekara and Enys Mones and Håkan Jonsson},
journal= {arXiv preprint arXiv:1806.03615},
year = {2021}
}