Data Privacy: The Netflix Challenge

Concept. "Anonymized" data rarely stays anonymous. Removing names leaves quasi-identifiers. Rare combinations of attributes let a linkage attack join the dataset against public data and recover identities. k-anonymity and differential privacy give formal privacy guarantees by trading accuracy for privacy.

Intuition. Netflix released 100M "anonymized" ratings for a $1M prize in 2006. Researchers joined those ratings to public IMDB reviews on shared (movie, rating, date) pairs and re-identified users in 2007. About 8 ratings with dates make you roughly 99% unique, so the ratings acted as identifiers.

Anonymous Is Not Private

Netflix had three options for the prize dataset: release it with names (an obvious breach), keep it private (safe, but no competition), or release it with random IDs in place of names. They chose the random IDs and assumed that broke the link to real people. It did not.

Anonymized Netflix rows (user A7X9B2 rated Shrek and Matrix on specific dates) joined to public IMDB reviews carrying the same movie/rating/date pairs under the name Alice Smith, yielding the re-identification A7X9B2 = Alice Smith.

Figure 1. A join on (movie, rating, date) can map an anonymous ID to a real name. A user's ratings form a rare pattern across movies, scores, and dates. The same user can publish some of those ratings on IMDB under a real name. The join links the random Netflix ID to that name and reveals the rest of the Netflix history under the same ID.

Privacy Attacks

Attack How it works Example Prevention
Linkage Join anonymous data with public data Netflix + IMDB Do not release individual records
Inference Unique attribute combinations DOB + gender + ZIP = 87% unique Generalize attributes
Location Unique movement patterns 4 locations = 95% unique Aggregate or add noise
Temporal Timing patterns reveal identity login and activity times Round timestamps

Legal Requirements

Regulation Scope Key requirement Penalty
GDPR EU citizens Data stays in the EU or adequate countries Up to 4% of revenue
CCPA California Right to delete personal data $7,500 per violation
HIPAA Healthcare Protect electronic health records (ePHI) $2M + criminal charges

Defense Methods

Synthetic data. Generate fake records that match the statistical shape of the real data without containing any real individual. Good for development, testing, and early ML.

Differential privacy. Add calibrated noise to query results so no single person changes the answer much, while aggregate trends stay accurate. The privacy budget epsilon sets the trade-off: lower means more noise and more privacy.

Epsilon (ε) Privacy Noise Use case
10 Low ±1-2% Internal analytics
1.0 Balanced ±10% Research datasets
0.1 High ±100% Public release
0.01 Maximum ±1000% Highly sensitive 
-- BigQuery differential privacy
SELECT WITH DIFFERENTIAL_PRIVACY
  OPTIONS(
    epsilon = 1.0,              -- privacy budget (lower = more private)
    delta = 1e-5,               -- probability bound
    max_groups_contributed = 1  -- limit each user's contribution
  )
  diagnosis,
  COUNT(*) AS noisy_count
FROM medical_records
GROUP BY diagnosis;

-- k-anonymity: generalize, then require a minimum group size
SELECT
  age_group,   -- not exact age
  zip_prefix,  -- first 3 digits only
  COUNT(*) AS COUNT
FROM users
GROUP BY age_group, zip_prefix
HAVING COUNT(*) >= 5;

Key Takeaways

  1. Your data is a fingerprint. About 8 movie ratings can uniquely identify you.

  2. Anonymous is not private. Public data sources enable re-identification.

  3. Combinations matter. DOB + gender + ZIP identifies 87% of Americans.

  4. Math protects privacy. Differential privacy gives a provable guarantee.

  5. It is always a trade-off. More privacy means less accuracy; the epsilon budget makes the choice explicit.