Case Study: Google COVID Reports (Differential Privacy)

Concept. Removing names does not make data anonymous. A small set of quasi-identifiers, such as a sensitive place visited on a known day, can re-identify a person. k-anonymity and differential privacy provide mathematical privacy guarantees. Deleting columns can leave people identifiable.

Intuition. During COVID, Google published regional movement trends from users who had enabled Location History. The reports showed changes for broad categories, not individual trips or absolute visit counts. A hypothetical row-level release could expose a unique visit. Aggregation and differential privacy let Google publish trends while limiting what the release revealed about any one person.

Reading Time: 8 mins

During the COVID-19 pandemic, Google's Community Mobility Reports used opted-in Location History data to publish regional movement trends. The reports grouped activity into broad categories such as workplaces, parks, and grocery stores. They did not expose individual paths or absolute visit counts.

Producing those reports still required sensitive raw location data. Google combined aggregation, anonymization, minimum-data thresholds, and differential privacy before publishing the results.

Re-identification Attacks: The "Bob" Example

Imagine that an organization released a row-level location table after removing everyone's name. An attacker wants to know whether Bob, a colleague, visited a COVID-19 testing center.

  • The attacker knows Bob was off work one day.

  • A single visit to a nearby testing center on that day appears in the "anonymized" dataset.

  • If unique, the attacker has pinpointed Bob.

The table contains no names, but the date and location can still identify Bob. Removing direct identifiers does not prevent a linkage attack.

How Google Protected the Reports

The previous page covers k-anonymity and differential privacy in general. Google built the mobility reports from aggregated, anonymized data and applied differential privacy before release. The published values described regional percentage changes, and Google withheld results when it lacked enough data to report them safely.

A Hypothetical Exact Report

Suppose an organization starts with a private table of individual visits. A plain SQL query returns exact counts. Small groups and comparisons between related results can reveal whether one person contributed. This is a teaching example, not the schema or output Google published.

-- Count visits per location
SELECT 
    location_id, 
    location_type, 
    COUNT(user_id) AS visit_count
FROM user_location_activity
WHERE activity_date BETWEEN '2020-03-01' AND '2020-03-31'
GROUP BY location_id, location_type;

Adding Privacy with Noise

To protect an aggregate release, first bound how much each person can contribute. Then add noise calibrated to that bound and the privacy budget. The code below shows the mechanism. laplace_noise is a conceptual placeholder rather than a library call.

Three panels: an exact SQL count returns 100, differential privacy adds Laplace noise calibrated to sensitivity at epsilon 1, and possible released counts include 98, 103, and 101.

Figure 1. The exact query returns a true count of 100. After bounding each person's contribution, differential privacy adds noise calibrated to the query's sensitivity and privacy budget. Repeated runs might release 98, 103, or 101. One person can still affect the result, but the mechanism limits how much that person changes the distribution of possible answers.

# Conceptual mechanism, not a library API
raw_count = 100
epsilon = 1.0
sensitivity = 1  # after bounding each person's contribution

noise = laplace_noise(scale=sensitivity / epsilon)
released_count = raw_count + noise

Repeated executions may return different values because the mechanism samples random noise.

What Protected the Release

  1. Consent: Google used data from people who had enabled Location History, which was off by default.

  2. Aggregation: The reports showed regional changes for broad place categories.

  3. Suppression: Google left gaps when it could not estimate a trend safely.

  4. Differential privacy: Artificial noise limited what the released statistics revealed about one person.

Takeaway: Google protected its mobility reports through consent, aggregation, suppression, and differential privacy. Privacy came from the release mechanism, not from deleting names.