Case Study: Google COVID Reports (Differential Privacy)

Concept. Removing names does not make data anonymous: a few quasi-identifiers, like a sensitive place visited on a known day, can re-identify a person. Privacy is engineered with math (k-anonymity, differential privacy), not by deleting columns.

Intuition. During COVID, Google published mobility reports (visits to hospitals and testing centers) to help public health. Even "anonymized," a single testing-center visit on a day a known colleague was off work could pinpoint them. Google added differential-privacy noise so the trends stayed useful while no individual stood out.

Reading Time: 8 mins

This is a lens on the intersection of data and policy, not an endorsement of Google's methods.

During the COVID-19 pandemic, tech giants like Google and Apple rolled out anonymized mobility reports to assist public health authorities in tracking movement trends. These reports shed light on visits to sensitive spots like hospitals or testing centers.

Even anonymized, the data carried the risk of re-identification attacks. Google tackled this with three key strategies:

  1. Informed Consent: Clear opt-in/opt-out options.

  2. Data Security: Tight control over raw data.

  3. Aggregation and Anonymization: Advanced mathematics to obscure individual identities.

Re-identification Attacks: The "Bob" Example

Imagine an attacker curious about whether Bob, a colleague, visited a COVID-19 testing center.

  • The attacker knows Bob was off work one day.

  • A single visit to a nearby testing center on that day appears in the "anonymized" dataset.

  • If unique, the attacker has pinpointed Bob.

This breach of privacy underscores the need for caution when handling data that can be "triangulated" to an individual.

How Google Protected the Reports

The previous page covers k-anonymity and differential privacy in general. For the mobility reports Google leaned on differential privacy: by adding calibrated noise to the location counts, it published useful movement trends without exposing any individual. (Zero-knowledge training, learning on encrypted data without ever seeing raw values, is a newer option for the same goal.)

Example: Generating Mobility Reports in SQL

First, the report you would normally write: a plain count of visits per location on the user_location_activity table. The numbers come back exact, and that is the whole problem. An exact count at one testing center, on one day, is what can finger Bob.

-- Count visits per location
SELECT 
    location_id, 
    location_type, 
    COUNT(user_id) AS visit_count
FROM user_location_activity
WHERE activity_date BETWEEN '2020-03-01' AND '2020-03-31'
GROUP BY location_id, location_type;

Adding Privacy with Noise

To safeguard privacy, use tools like Google's PYDP (Python Differential Privacy). Instead of an "Exact" count, it delivers a "Noisy" count.

Three panels: an exact SQL COUNT returns 100 true visits (identifying); a slate 'add noise' step applies Laplace noise at privacy budget epsilon=1; the released count comes back as 98, 103, or 101, a little different each run, so the trend holds but Bob stays hidden.

Figure 1. Differential privacy protects the released report. The exact query returns a true count (say 100 visits at the center Bob went to), which on its own can identify him. Differential privacy adds calibrated Laplace noise, sized by a privacy budget (ε = 1), so the published number comes back a little different each run (98, 103, 101). The trend across locations stays accurate, but Bob's single visit can never move the answer.

# Conceptual PYDP logic
import pydp as dp

# Raw result from SQL: 100 visits
raw_count = 100 
epsilon = 1.0 # The "Privacy Budget"

# Add Laplacian noise
noisy_count = dp.add_noise(raw_count, epsilon) 
# Results might be 98, 103, 101...

Note: Each execution yields slightly different results due to random noise, yet the aggregate trend across locations remains accurate.

Core Ethical Principles for Data Apps

  1. Privacy and Anonymity: Use Differential Privacy for aggregate statistics.

  2. Informed Consent: Ensure terms are clear and offer detailed opt-out options.

  3. Bias Awareness: Monitor algorithms to prevent unfair demographic targeting.

  4. Security and Breaches: Strip PII and apply strong encryption before data exits your servers.

  5. Legal Compliance: Follow GDPR (Europe), CCPA (California), and HIPAA (Health data).

Takeaway: Privacy is more than deleting names. It is using math, like differential privacy, so no individual stands out.

Next

Modern Big Data Economics → A short, optional look at what all this scale actually costs, and the industry trends shaping how teams pay for it.