The emptiest grid square sets the rules for location data

For six years I ran a business that sold insights from a mobile network. Municipalities used them to plan bus routes and school catchments, a regional transport authority used them to time its services, and a handful of retailers used them to compare high streets. The product was described, accurately, as anonymised and aggregated. Our sales material showed heat maps of city centres at noon, glowing with thousands of devices. Those maps were the least interesting part of the data. The decisions that mattered, about privacy and about accuracy, were all made in the dark corners of the map.

Location data from a mobile network is generated whenever a phone connects to a cell. Aggregated with care, it shows how many devices were in an area during an hour, roughly where they had come from and how flows change across a day. It is valuable because it covers nearly everyone, unlike a survey, and because it arrives continuously. It is also among the most identifying data an organisation can hold. Published research has shown that a handful of time-stamped locations is enough to single out most people in a large dataset, and that coarsening the data helps less than intuition suggests. Removing names does not remove the person. A device that spends every night in one house and every working day in one office is a person, whatever the database calls it.

Averages hide the night shift

The first lesson I learnt was that privacy risk and statistical error grow in the same places. A grid square in central Copenhagen at noon holds thousands of devices; its count is reliable and reveals nothing about anyone. The same square at four in the morning might hold eleven. So might a farm road in western Jutland at any hour. Those small counts are where a determined person could begin to infer who was where, and they are also where the estimate is least accurate, because a few devices switching cells, or a coach of roaming visitors, can double or halve the figure.

Most discussion of anonymisation concentrates on the busy average. A safe product is designed around the emptiest cell it will ever report. At Brosund Mobil we set a floor: no count below fifty devices for any grid square and hour. Below the floor we suppressed the number entirely, or aggregated across adjacent hours or days until it rose above fifty. We applied the floor after every other transformation, including the scaling we used to estimate total population from our own customers, because a scaled number can look large while resting on a few real devices.

Fifty was a judgement, not a law. We chose it after testing how often small cells could be linked across days with other public information, and after asking what our customers actually needed. A bus planner does not need to know that seven devices crossed a bridge at three in the morning. A hospital's planner of night shifts might want exactly that, and we told her we could offer only a weekly aggregate for her area.

Publish what you suppress

Suppression creates a danger of its own. A map with blank squares invites the reader to assume that nobody was there. For a planner deciding whether a rural stop deserves an evening bus, a suppressed cell and an empty one mean very different things, and the difference falls on precisely the people with fewest alternatives: shift workers, older residents without cars, teenagers in villages.

We therefore stated, with every delivery, the share of cells and hours we had suppressed and the areas where suppression was concentrated. Rural municipalities sometimes found that a third of their map was blank at night. That was uncomfortable to show, and one customer asked us to fill the gaps with modelled estimates. We declined to present models as observations, but we offered to supply modelled figures labelled separately, which was both more honest and more useful.

I think every seller of location insights should publish its suppression rate in the way a survey publishes its response rate. It tells the buyer how much of the picture is missing and where. It also exposes products that report small counts without saying so, which is the clearest sign that a provider has chosen sales over safety.

Questions a buyer should be refused

The harder discipline concerns questions a product will not answer, however well the data could answer them. We refused three kinds. We would not sell movement paths, meaning sequences of locations attributed to one device, even under a rotating identifier, because a path is a profile in all but name. We would not report repeat visits, such as how many visitors to a shop came back within a month, because answering requires following a device through time. And we would not combine location counts with other attributes finely enough to describe small groups, such as the home districts of visitors to a single clinic.

These refusals cost business. The largest was a shopping-centre owner's contract worth DKK 9 million, which asked for counts at each entrance every fifteen minutes and the share of returning visitors. We offered hourly counts with our floor, and the company bought elsewhere. Our revenue plan for 2014 was missed, and I spent two quarterly reviews explaining why.

Today I am chief data officer of a news publisher, and our location data is modest: subscribers' delivery addresses and postcodes, and approximate locations from our apps when readers allow it. The same rules apply. We use postcodes to run regional editions and deliveries, and we neither sell nor model anything finer for advertising. When a colleague proposes a new use of location, I ask what the emptiest cell would look like.

For boards of companies that sell or buy location insights, the questions are simple to put. What is the smallest count the product will ever report? Is that floor applied after scaling? What share of the map is suppressed, and is that share published? Which questions does the product refuse, and were those refusals written down before a large customer asked? A provider that answers clearly has designed for the quiet hours. One that shows only the noon heat map has not yet looked.