The Feasibility of Location Anonymity: An Empirical Study towards a Real-world Location Privacy Protection System in Takeout Services

Various anonymity methods have been proposed to safeguard the privacy of human mobility trajectories, ranging from trajectory anonymity that uses a fixed pseudonym to location anonymity which involves using different pseudonyms for each location. While location anonymity appears to offer robust privacy protection, there is growing concern that trajectories can still be reconstructed even if this method is deployed. Due to the lack of evaluations on real-world systems utilizing location anonymity, its practical effectiveness remains uncertain. Two popular takeout platforms, Ele.me and Meituan, which have adopted location anonymity to protect riders' trajectories, provide a suitable environment for such real-world evaluations. We design a large-scale data collection system to gather anonymized location data of riders, creating two anonymized datasets containing millions of riders' locations. Then we propose an innovative multi-stage trajectory inference framework specifically tailored to location anonymity, containing location linking stage for short-term tracking and segment matching stage for long-term tracking. Extensive evaluations refute the effectiveness of location anonymity for short-term tracking (achieving 83.4% and 74.5% inference accuracy on Ele.me and Meituan) but confirm its utility for long-term tracking. Analysis highlights the crucial role of strong aggregation properties of riders, previously deemed unrealistic across multiple scenarios, in thwarting long-term tracking.