Is Geo-Indistinguishability What You Are Looking for?

TL;DR

This paper critically examines geo-indistinguishability, revealing that its privacy guarantees may lead to poorer utility and potential location exposure, challenging its effectiveness as a location privacy measure.

Contribution

It offers an alternative formulation of geo-indistinguishability as an adversary error, highlighting limitations in privacy-utility trade-offs and exposing potential flaws in existing assumptions.

Findings

Geo-indistinguishability provides a lower bound on adversary error.

Achieving privacy guarantees can result in poorer utility.

Potential exposure of useless obfuscated locations.

Abstract

Since its proposal in 2013, geo-indistinguishability has been consolidated as a formal notion of location privacy, generating a rich body of literature building on this idea. A problem with most of these follow-up works is that they blindly rely on geo-indistinguishability to provide location privacy, ignoring the numerical interpretation of this privacy guarantee. In this paper, we provide an alternative formulation of geo-indistinguishability as an adversary error, and use it to show that the privacy vs.~utility trade-off that can be obtained is not as appealing as implied by the literature. We also show that although geo-indistinguishability guarantees a lower bound on the adversary's error, this comes at the cost of achieving poorer performance than other noise generation mechanisms in terms of average error, and enabling the possibility of exposing obfuscated locations that are useless from the quality of service point of view.