IoT Interfaces, Location and Privacy · Study deck
Location Privacy: Failures and Trade-offs
The proposed controls look sound on paper, but failures often appear when data is combined, retained, or reused.
UX Uma is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- analyze real location privacy failures
- balance operational accuracy with user autonomy
- calculate a suppression share for a stated k-anonymity rule and explain why that share alone does not measure re-identification probability
- Explain: Server knows driver reached Stop 17 but never sees GPS trail between stops.
Major section
Privacy-Preserving Fleet Tracking
Server knows driver reached Stop 17 but never sees GPS trail between stops.
- Scenario: A logistics company operates 200 delivery trucks.
- 200 trucks, 8-hour shifts, 50 delivery stops per day.
- Management dashboard shows live driver locations on map.
- Historical "breadcrumb trail" shows everywhere driver went.
Major section
Privacy-Preserving Fleet Tracking (continued)
Privacy-preserving: 200 trucks × 50 stops/day × 365 days = 3.65 million geofence events/year.
- Truck device preloads 50 delivery stop locations (lat/lon + 100m radius).
- Collected: Geofence events ("entered delivery zone"), stop confirmations, emergency SOS coordinates.
- Management wants "How long do drivers typically spend at Stop 17?".
Major section
Privacy-Preserving Fleet Tracking (continued)
Drivers' union demands privacy protections to prevent surveillance during breaks and off-hours.
- Driver can view/export their own zone events (GDPR access right).
- Key Insight: Privacy-preserving design meets business needs while respecting driver autonomy.
- Collecting less data reduces storage costs, reduces GDPR liability, and improves labor relations.
Major section
Checkpoint: Operational Tradeoffs
You now know how failures emerge from stored trails, weak access controls, and purpose creep.
- You now know how a fleet product can meet ETA and delivery-confirmation needs without break or off-duty surveillance.
- You now know why storage reduction is also a privacy and governance win.
- The next section generalizes that tradeoff across common IoT location use cases.
Major section
Re-ID Risk in Anonymous Data
Mobility-trip records can expose riders when linked with outside information.
- The Mistake: Publishing "anonymized" location datasets by removing user IDs and names, assuming this protects privacy.
- Location data is a quasi-identifier—even without names, movement patterns are highly unique and re-identifiable.
- Financial: Re-identification enables targeted phishing, stalking, discrimination.
Major section
Re-ID Risk in Anonymous Data (continued)
K-anonymity without noise: Requiring 5+ people per location-time bin fails when combined with rare locations.
- Netflix Prize (2007): "Anonymous" movie ratings were re-identified by correlating with public IMDB reviews.
- Example: "~42 people" instead of exact count, noise prevents individual inference.
- Key Insight: Location traces are often highly identifying.
Major section
Checkpoint: Re-Identification Risk
You now know why location history remains personal even after names and ids are removed.
- You now know how home, work, rare visits, and repeated timing can identify a person.
- You now know why suppression, generalization, differential privacy, and purpose-specific aggregates are safer than raw trail release.
- With the major design risks in place, use the interactive checks to test whether the same principles transfer to matching, sequencing, labels, code, and numeric tradeoffs.
Major section
For Kids: Meet the Sensor Squad!
The Sensor Squad learns that knowing WHERE someone is can be a big responsibility!: For a porch light, HOME or AWAY can be enough.
- A room-by-room trail would expose a secret reading nook and reveal when the house is empty, so the Squad should keep only the detail needed for the decision.
- the battery gasped. "Wait -- my reading nook is supposed to be SECRET!
- I go there when I need quiet time.
Major section
For Kids: Meet the Sensor Squad! (continued)
If everyone knows where I am all the time, I can never have privacy!".
- That's enough to turn on the porch light when someone arrives.".
- If a bad person got hold of Sammy's data, they'd know when our house is empty!".
- Privacy means respecting people's right to have their own space!".
- What if we just know whether someone is HOME or AWAY? That's enough to turn on the porch light when someone arrives.
Major section
Putting Numbers to It
Most IoT applications don't need continuous coordinate trails—zone events suffice.
- In this scenario, the chosen percentage of records in small bins is suppressed; actual loss and re-identification risk depend on the dataset and release design.
- Key Understanding: Differential privacy adds calibrated noise under a stated mechanism and neighboring relation.
- For fixed sensitivity, a smaller ε means more Laplace noise and a stronger formal privacy bound; composition across queries adds the ε values.
Major section
Concept Relationships
De-identification: Privacy Engineering differential privacy and k-anonymity techniques prevent re-identification.
- Legal framework: GDPR Compliance and Data Protection provide regulatory context.
- E911 mandate: Smart City Systems must balance emergency accuracy requirements with privacy.
- Ethical design: The Consent Change Review balances safety monitoring with autonomy for children, elderly users, employees, drivers, and patients.
Deck summary
Key takeaways
Server knows driver reached Stop 17 but never sees GPS trail between stops.
- Privacy-preserving: 200 trucks × 50 stops/day × 365 days = 3.65 million geofence events/year.
- Drivers' union demands privacy protections to prevent surveillance during breaks and off-hours.
- You now know how failures emerge from stored trails, weak access controls, and purpose creep.
- Mobility-trip records can expose riders when linked with outside information.
Retrieval practice
Recall check 1 of 5
UX Uma says: answer from memory, then check your reasoning.
Q1Your smart building uses occupancy detection to control lighting and HVAC. Privacy regulations prohibit tracking individual people. Which location awareness technique respects privacy while achieving energy efficiency?
Show answer
Answer: C Privacy-preserving occupancy detection uses sensors that detect presence without identifying individuals: PIR motion sensors detect movement (someone is present), not identity.
Retrieval practice
Recall check 2 of 5
UX Uma says: answer from memory, then check your reasoning.
Q2An elderly care IoT system uses location tracking for fall detection and wandering alerts. Family members want real-time location access, but the elderly person wants privacy. What is the most ethical design approach?
Show answer
Answer: C see answers page
Retrieval practice
Recall check 3 of 5
UX Uma says: answer from memory, then check your reasoning.
Q3A smart retail store uses BLE beacons to send personalized offers to shoppers' phones based on their location in the store. Shoppers must install an app and grant location permissions. What privacy concern does this raise?
Show answer
Answer: A Location-based retail analytics create detailed surveillance profiles: time spent in each aisle, products examined, visit frequency, and comparison shopping patterns.
Retrieval practice
Recall check 4 of 5
UX Uma says: answer from memory, then check your reasoning.
Q4What proves who used location data and that it can expire or be deleted?
Show answer
Answer: C Accountable access closes the lifecycle by proving who used location data and ensuring it can actually expire or be deleted.
Q5Complete the IoT notification toast component:
Show answer
Answer: A classList.add() adds multiple CSS classes. appendChild() inserts the element into the DOM. setTimeout auto-dismisses the toast.
Retrieval practice
Recall check 5 of 5
UX Uma says: answer from memory, then check your reasoning.
Q6A location release has 100 area bins; 20 fall below the chosen group-size rule. What fraction of bins must be suppressed, and what does it mean?
Show answer
Answer: A 20 of 100 bins is 20%; this is an exposure-control measure, not a person-level risk estimate.
Print reference
Answers 1 of 2
Answer key.
- C · Privacy-preserving occupancy detection uses sensors that detect presence without identifying individuals: PIR motion sensors detect movement (someone is present), not identity.
- C · Ethical IoT location tracking balances safety and autonomy: (1) Informed consent: Elderly person must understand and agree to tracking, (2) Tiered disclosure: Normal activity is private; only emergencies (fall detected, left safe zone, panic button) trigger location alerts, (3) Transparency: Elderly person knows when location is shared, (4) Control: Ability to disable tracking temporarily.
Print reference
Answers 2 of 2
Answer key.
- A · Location-based retail analytics create detailed surveillance profiles: time spent in each aisle, products examined, visit frequency, and comparison shopping patterns.
- C · Accountable access closes the lifecycle by proving who used location data and ensuring it can actually expire or be deleted.
- A · classList.add() adds multiple CSS classes. appendChild() inserts the element into the DOM. setTimeout auto-dismisses the toast.
- A · 20 of 100 bins is 20%; this is an exposure-control measure, not a person-level risk estimate.