# Perturbation Methods for Protection of Sensitive Location Data: Smartphone Travel Survey Case Study

## TL;DR

This paper evaluates geographic random perturbation methods, Geo-indistinguishability and Donut geomask, for protecting sensitive residential location data in smartphone travel surveys, balancing privacy with data utility.

## Contribution

It provides a comparative analysis of two privacy-preserving methods, highlighting their effectiveness and limitations in real-world travel survey data.

## Key findings

- Both methods produce perturbation distributions close to common probability models.
- Original locations can often be inferred with high accuracy despite perturbations.
- Geo-Indistinguishability's privacy guarantees depend heavily on its epsilon parameter.

## Abstract

Smartphone based travel data collection has become an important tool for the analysis of transportation systems. Interest in sharing travel survey data has gained popularity in recent years as "Open Data Initiatives" by governments seek to allow the public to use these data, and hopefully be able to contribute their findings and analysis to the public sphere. The public release of such precise information, particularly location data such as place of residence, opens the risk of privacy violation. At the same time, in order for such data to be useful, as much spatial resolution as possible is desirable for utility in transportation applications and travel demand modeling. This paper evaluates geographic random perturbation methods (i.e. Geo-indistinguishability and the Donut geomask) in protecting the privacy of respondents whose residential location may be published. We measure the performance of location privacy methods, preservation of utility and randomness in the distribution of perturbation distances with varying parameters. It is found that both methods produce distributions of spatial perturbations that conform closely to common probability distributions and as a result, that the original locations can be inferred with little information and a high degree of precision. It is also found that while Achieved K-estimate anonymity increases linearly with desired anonymity for the Donut geomask, Geo-Indistinguishability is highly dependent upon its privacy budget factor (epsilon) and is not very effective at assuring desired Achieved K-estimate anonymity.