Source-linked AI summary
Google COVID-19 Community Mobility Reports: Anonymization Process Description (version 1.1)
Ahmet Aktay, Shailesh Bavadekar, Gwen Cossoul, John Davis, Damien Desfontaines, Alex Fabrikant, Evgeniy Gabrilovich, Krishna Gadepalli, Bryant Gipson, Miguel Guevara, Chaitanya Kamath, Mansi Kansal, Ali Lange, Chinmoy Mandayam, Andrew Oplinger, Christopher Pluntke, Thomas Roessler, Arran Schlosberg, Tomer Shekel, Swapnil Vispute, Mia Vu, Gregory Wellenius, Brian Williams, Royce J Wilson
TL;DR
The report addresses how to publish mobility changes while preventing personal location, movement, or contact data from being derived. It aggregates opted-in Location History data with differential privacy, releases reliable percentage changes against a historical baseline, and provides formal privacy guarantees.
Problem
The report addresses how to publish mobility changes from Location History data without exposing individuals’ location, movement, or contacts.
Method
It aggregates opted-in users’ metrics, adds Laplace noise for differential privacy, computes baseline percentage changes, and suppresses unreliable or insufficiently supported metrics.
Results
ε = 1.76 maximum daily user contribution and δ = 0 provide the stated differential privacy guarantee for the released metric set.
Takeaways & Limitations
The process supports publicly comparing mobility metrics with a private historical baseline while withholding changes whose uncertainty exceeds the reporting threshold.
Takeaways & Limitations
Metrics are withheld when uncertainty gives at least a 5% chance that the percentage change is wrong by more than ±10 absolute percentage points.
Abstract
from arXiv · showhide
This document describes the aggregation and anonymization process applied to the initial version of Google COVID-19 Community Mobility Reports (published at http://google.com/covid19/mobility on April 2, 2020), a publicly available resource intended to help public health authorities understand what has changed in response to work-from-home, shelter-in-place, and other recommended policies aimed at flattening the curve of the COVID-19 pandemic. Our anonymization process is designed to ensure that no personal data, including an individual's location, movement, or contacts, can be derived from the resulting metrics. The high-level description of the procedure is as follows: we first generate a set of anonymized metrics from the data of Google users who opted in to Location History. Then, we compute percentage changes of these metrics from a baseline based on the historical part of the anonymized metrics. We then discard a subset which does not meet our bar for statistical reliability, and release the rest publicly in a format that compares the result to the private baseline.
1 Definitions
The reports use data from users who opted in to Location History, which is off by default. Metrics are aggregated daily across three geographic granularity levels, with higher levels representing smaller areas and no published regions below 3 km^2.
- Location History users: Metrics are based on Google users who opted in to Location History, a feature that is off by default.
- Differential Privacy: Differential privacy is defined relative to datasets differing by one user’s data on one day, using a randomized metric algorithm [3].
- Granularity levels: Metrics are aggregated per day and geographic area across three granularity levels: countries or regions, top-level geopolitical subdivisions, and higher-resolution areas such as U.S. counties.
- Granularity levels: Granularity levels 1 and 2 vary by country to reflect local public-health needs, generally represent smaller areas at higher levels, and exclude regions smaller than 3 km^2.
2 Generating anonymized metrics
The metrics are generated from aggregated Location History data using differential privacy, with Laplace noise and contribution limits designed to prevent deriving personal location, movement, or contact data. Public-place, residential, and workplace metrics apply bounded user contributions and explicit privacy budgets.
- Privacy framework: Differential privacy adds Laplace noise to aggregated metrics, protecting against deriving individuals’ locations, movements, or contacts from released data.The procedure uses Google’s open-source differential privacy library and Laplace noise.
- Public-place metrics: Public-place metrics count unique Location History users visiting seven categories daily, with each user contributing at most once per category and four category-location pairs per day and geographic level.The categories are retail, recreation, eateries, groceries, pharmacies, transit, and parks; excess contributions are randomly reduced to four.
- Public-place metrics: 99% of U.S. county-level users contribute three or fewer daily category-place pairs on average; each daily place visit has ε = 0.44 and total daily user contribution has ε = 1.76.These privacy guarantees use standard composition because the multiple metrics share the same dataset.
- Residential metrics: Residential metrics estimate daily average hours at residences by adding noise to bounded per-user time sums and unique-user counts, then forming and clamping their adjusted ratio.Individual residence-time values are offset into [−12; 12], and the final estimate is constrained to [0, 24] hours/day.
- Workplace metrics: Workplace metrics count users spending more than one hour at work locations by day and geographic area, adding Laplace noise while aggregating each user to at most one region per granularity.These metrics are protected by differential privacy with ε = 0.44.
3 Generating the report from the anonymized metrics
The report generates daily anonymized metrics, converts them to weekday-baseline percentage changes, and suppresses results that lack sufficient geographic, user-count, or statistical reliability.
- 3 Generating the report from the anonymized metrics: Daily metrics are generated from 2020-01-01 onward, and all subsequent operations use only differentially private outputs without consuming additional privacy budget.
- 3 Generating the report from the anonymized metrics: Geographic regions smaller than 3km^2 or with fewer than 100 differentially private contributing users are discarded, although small regions may be merged above 3km^2 without crossing country boundaries except Vatican City–Italy.
- 3 Generating the report from the anonymized metrics: Each day’s metric is reported as a percentage ratio to a baseline defined by the median differentially private metric across the five same-weekday observations in the fixed 5-week period from 2020-01-03 through 2020-02-06.
- 3 Generating the report from the anonymized metrics: Percentage changes are withheld when differential-privacy noise makes them likely to be wrong by more than ±10 absolute percentage points, specifically when that error has at least a 5% chance.The decision uses 97.5% confidence intervals for the metric and baseline; if the resulting ratio bounds differ from the private ratio by more than 10 absolute percentage points, the change is not published.
4 Note on δ
The process is ε-differentially private with δ = 0 because it generates a fixed set of metrics and adds noise to zero-valued metrics.
- 4 Note on δ: The procedure achieves ε-differential privacy with δ = 0 by generating all combinations of geographic regions, days within periods, and public place categories, while adding noise to zero-valued metrics.
5 Improving the accuracy of metrics over time
The metric computation is continuously improved, but updates can shift values and distort comparisons with the unchanged baseline. Scaling factors correct these shifts while limiting additional privacy-budget use by grouping metrics and reusing previously generated noisy metrics.
- Scaling factors correct shifts from computation updates that would otherwise skew comparisons with the unchanged baseline period.The baseline is not recomputed to avoid republishing data.
- Metrics are grouped so each group shares a uniform update effect, such as a metric across dates or weekdays within a period.Examples include Parks on Tuesdays in June or Workplaces on weekends in August.
- For each group, the method sums previously generated noisy metrics as s_g and recomputed metrics with smaller-budget noise as s_n.The additional noise typically uses 10% of the privacy budget proportional to the corresponding region granularity.
- Future metrics are multiplied by s_n/s_g when scaling the baseline, or by s_g/s_n when scaling daily counts.Grouping enables the smaller step-3 privacy budget and reuse of already generated metrics.