AI-based Re-identification of Behavioral Clickstream Data

TL;DR

This paper shows that AI techniques can re-identify individuals from behavioral clickstream data without data overlap, challenging privacy protections and suggesting synthetic data as a safer alternative.

Contribution

It introduces AI-based re-identification methods for behavioral data, demonstrating their effectiveness and limitations, and discusses implications for privacy and data sharing.

Findings

Behavioral patterns can re-identify individuals without data overlap.

Data perturbation does not prevent re-identification unless utility is heavily compromised.

Synthetic data resists AI-based re-identification attacks.

Abstract

AI-based face recognition, i.e., the re-identification of individuals within images, is an already well established technology for video surveillance, for user authentication, for tagging photos of friends, etc. This paper demonstrates that similar techniques can be applied to successfully re-identify individuals purely based on their behavioral patterns. In contrast to de-anonymization attacks based on record linkage, these methods do not require any overlap in data points between a released dataset and an identified auxiliary dataset. The mere resemblance of behavioral patterns between records is sufficient to correctly attribute behavioral data to identified individuals. Further, we can demonstrate that data perturbation does not provide protection, unless a significant share of data utility is being destroyed. These findings call for sincere cautions when sharing actual behavioral data with third parties, as modern-day privacy regulations, like the GDPR, define their scope based on the ability to re-identify. This has also strong implications for the Marketing domain, when dealing with potentially re-identify-able data sources like shopping behavior, clickstream data or cockies. We also demonstrate how synthetic data can offer a viable alternative, that is shown to be resilient against our introduced AI-based re-identification attacks.