The Data Exhaust: What Everyday Digital Activities Reveal About Us

Author

Smita Mangesh Junnarkar, MV Tamil Eelan

Abstract

 Every search, tap, payment, and journey made with a digital device leaves behind a trace that the person never set out to create. This by-product, commonly called data exhaust, is collected to keep services running, yet it can later be reused to describe who a person is, what they believe, where they go, and what they are likely to do next. This paper examines what everyday digital activities reveal. It follows a trace from generation through logging, linkage, modelling, and use, and it classifies eight families of activity: web browsing and search, location and movement, social media, shopping and payments, streaming, smart homes and wearables, smartphone apps and sensors, and device and interaction behaviour. For each family the paper explains what is recorded, what can be inferred, and why the trace is revealing. An assessment framework is then proposed, with an activity inventory, an information-based measure of identifiability, and metrics for inference, linkage, and retention, followed by safeguards at the personal, organisational, technical, and legal levels. The work is analytical and reports no new empirical results. Its purpose is to help students, researchers, and developers judge digital exposure and design services that respect the people who use them.

Keywords

Data exhaust, digital footprint, behavioural data, privacy, re-identification, inference, metadata, data protection, surveillance

Full Text:

Download Paper PDF

References

[1] V. Mayer-Schönberger and K. Cukier, Big Data: A Revolution That Will Transform How We Live, Work, and Think. Boston, MA, USA: Houghton Mifflin Harcourt, 2013.

[2] S. Zuboff, The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power. New York, NY, USA: PublicAffairs, 2019.

[3] M. Kosinski, D. Stillwell, and T. Graepel, “Private traits and attributes are predictable from digital records of human behavior,” Proceedings of the National Academy of Sciences, vol. 110, no. 15, pp. 5802–5805, 2013.

[4] Y.-A. de Montjoye, C. A. Hidalgo, M. Verleysen, and V. D. Blondel, “Unique in the crowd: The privacy bounds of human mobility,” Scientific Reports, vol. 3, art. 1376, 2013.

[5] J. Mayer, P. Mutchler, and J. C. Mitchell, “Evaluating the privacy properties of telephone metadata,” Proceedings of the National Academy of Sciences, vol. 113, no. 20, pp. 5536–5541, 2016.

[6] W. Youyou, M. Kosinski, and D. Stillwell, “Computer-based personality judgments are more accurate than those made by humans,” Proceedings of the National Academy of Sciences, vol. 112, no. 4, pp. 1036–1040, 2015.

[7] J.-P. Onnela and S. L. Rauch, “Harnessing smartphone-based digital phenotyping to enhance behavioral and mental health,” Neuropsychopharmacology, vol. 41, no. 7, pp. 1691–1696, 2016.

[8] L. Sweeney, “Simple demographics often identify people uniquely,” Carnegie Mellon University, Data Privacy Working Paper 3, 2000.

[9] A. Narayanan and V. Shmatikov, “Robust de-anonymization of large sparse datasets,” in Proc. IEEE Symposium on Security and Privacy, 2008, pp. 111–125.

[10] Y.-A. de Montjoye, L. Radaelli, V. K. Singh, and A. Pentland, “Unique in the shopping mall: On the reidentifiability of credit card metadata,” Science, vol. 347, no. 6221, pp. 536–539, 2015.

[11] L. Rocher, J. M. Hendrickx, and Y.-A. de Montjoye, “Estimating the success of re-identifications in incomplete datasets using generative models,” Nature Communications, vol. 10, art. 3069, 2019.

[12] P. Ohm, “Broken promises of privacy: Responding to the surprising failure of anonymization,” UCLA Law Review, vol. 57, no. 6, pp. 1701–1777, 2010.

[13] D. J. Solove, “A taxonomy of privacy,” University of Pennsylvania Law Review, vol. 154, no. 3, pp. 477–564, 2006.

[14] H. Nissenbaum, “Privacy as contextual integrity,” Washington Law Review, vol. 79, no. 1, pp. 119–157, 2004.

[15] A. Acquisti, L. Brandimarte, and G. Loewenstein, “Privacy and human behavior in the age of information,” Science, vol. 347, no. 6221, pp. 509–514, 2015.

[16] S. Barocas and A. D. Selbst, “Big data’s disparate impact,” California Law Review, vol. 104, no. 3, pp. 671–732, 2016.

[17] European Parliament and Council of the European Union, “Regulation (EU) 2016/679 (General Data Protection Regulation),” Official Journal of the European Union, L 119, pp. 1–88, 2016.

[18] Government of India, “The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023),” 2023.

[19] S. Englehardt and A. Narayanan, “Online tracking: A 1-million-site measurement and analysis,” in Proc. ACM Conf. Computer and Communications Security (CCS), 2016, pp. 1388–1401.

[20] P. Eckersley, “How unique is your web browser?” in Privacy Enhancing Technologies (PETS), Lecture Notes in Computer Science, vol. 6205, 2010, pp. 1–18.

[21] A. D. I. Kramer, J. E. Guillory, and J. T. Hancock, “Experimental evidence of massive-scale emotional contagion through social networks,” Proceedings of the National Academy of Sciences, vol. 111, no. 24, pp. 8788–8790, 2014.

[22] C. Song, Z. Qu, N. Blumm, and A.-L. Barabási, “Limits of predictability in human mobility,” Science, vol. 327, no. 5968, pp. 1018–1021, 2010.

[23] M. C. González, C. A. Hidalgo, and A.-L. Barabási, “Understanding individual human mobility patterns,” Nature, vol. 453, pp. 779–782, 2008.

[24] N. Apthorpe, D. Reisman, S. Sundaresan, A. Narayanan, and N. Feamster, “Spying on the smart home: Privacy attacks and defenses on encrypted IoT traffic,” arXiv preprint arXiv:1708.05044, 2017.

[25] F. Monrose and A. Rubin, “Authentication via keystroke dynamics,” in Proc. ACM Conf. Computer and Communications Security (CCS), 1997, pp. 48–56.

[26] L. Sweeney, “k-anonymity: A model for protecting privacy,” International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, vol. 10, no. 5, pp. 557–570, 2002.

[27] C. Dwork, “Differential privacy,” in Proc. International Colloquium on Automata, Languages and Programming (ICALP), 2006, pp. 1–12.

[28] C. Dwork and A. Roth, “The algorithmic foundations of differential privacy,” Foundations and Trends in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014.

[29] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” Proceedings of Machine Learning Research, vol. 54, pp. 1273–1282, 2017.

Share your valuable work from Social Media Buttons