Why location is different
Most personal data describes you. Location data describes you, everyone you meet, and the pattern of your life at once. Where you sleep and where you spend the working day are together enough to name most people, and studies of mobility traces have repeatedly found that a few timestamped points identify an individual within a large population.
It is also the data a service genuinely needs. A map cannot route you without knowing where you are, and a crowd-sensing application — measuring air quality, traffic, network coverage from thousands of phones — is worthless without positions attached. So blanket refusal is not an engineering answer.
Blurring, and its limits
The first family of defences reduces precision. Report a cell rather than a point. Report a region containing at least k other users, the spatial version of k-anonymity. Or, in the more modern formulation called geo-indistinguishability, add noise drawn so that nearby locations are provably hard to tell apart — the same shape of guarantee as differential privacy, applied to a map.
These work against a single snapshot and much less well against a trace. Blur each point independently and the path still shows the route, because the points are not independent. Anyone designing this for the first time underestimates how much correlation leaks.
What a ledger is actually for
The other half of the problem is not the data but the arrangement. In crowd-sensing, one server typically collects the readings, decides whether they are any good, and pays for them — so it has to know who to pay, which means it holds identity and position together, permanently, by design.
A distributed ledger is useful here for a narrow and unglamorous reason: it lets those roles be split. Contributions and payments can be recorded and verified without a single party holding the link between a contributor and their readings, and the record of what was agreed is auditable afterwards by anyone. That is the idea behind the crowd-sensing work in this thread.
It is worth saying plainly what a blockchain does not do. It does not make data private — a public ledger is the most durable publication mechanism ever built, and anything written to it is written forever. Privacy comes from what you choose not to put on it. That is also why permissioned designs are interesting for business settings: in R3 Corda, which the trade-management work here builds on, a transaction is shared only with its counterparties rather than broadcast, which is the property a trade record actually needs.
- Ensuring Location Privacy in Crowdsensing System Using BlockchainInternational Conference on Futuristic Communication and Network, 2021
- Trade management system using R3 Corda blockchainInternational Conference on Intelligent Systems Design and Applications, pp. 257-275, 2022
- Trade Management System Using R3 CordaIntelligent Systems Design and Applications: 22nd International Conference, 2023
What to read next
Outside work, not mine. Each title links to a Google Scholar search, which will find you whichever version is open access.