Agentic AI-Powered Re-Identification: An Emerging, Scalable Threat to Mobility Microdata Privacy
Abstract
The widespread collection of fine-grained location data by commercial data brokers creates a re-identification risk that is not widely recognised by the public. While prior research has established that mobility traces are highly unique and that individuals can, in principle, be identified from a handful of spatio-temporal points, such attacks have historically required significant manual effort from skilled analysts, limiting their practical scale. In this feasibility study, we demonstrate in a real world setting that agentic AI fundamentally changes this threat model. We present an end-to-end pipeline in which large language model agents autonomously search the open web, cross-reference public records and social media, and resolve raw coordinate sequences to candidate identities - without human intervention. We evaluate the pipeline on a spatio-temporal dataset containing simulated location points anchored at and around true home and work addresses, focusing on a high-risk disclosure scenario. Our results demonstrate that, from spatio-temporal data and public sources alone, our agentic AI successfully re-identified 18 of the 25 re-identifiable individuals (72%) and 18 of 43 cases overall (41.9%). We discuss implications for Statistical Disclosure Control (SDC) practice and outline the near-future escalation that data custodians and regulators must anticipate. De facto anonymity - an implicit foundation of SDC practice - is shifting. Agentic AI strengthens the case that re-identification is reasonably likely by any means under the GDPR Recital-26 standard, at costs of minutes-and-dollars per target.
Versions
Related
- Scalable Identification of Physics-Based and Neural Dynamics from Partial Measurements
- Reconstructing the Human Development Index at the Individual Level from Survey Microdata: Development and Validation of a Methodology
- Don't mind the gap: Absolutely Continuous Edge Spectrum in a Mobility Gap
- Conditional-Coverage Contributor Selection for Regional Digital Twins Under Mobility
- Mobility-Gap Robustness and Středa-Hall Separation in Disordered Axion Pumping
BibTeX
@misc{thees2026agentic,
title = {{Agentic AI-Powered Re-Identification: An Emerging, Scalable Threat to Mobility Microdata Privacy}},
author = {Oscar Thees and Roman Müller and Matthias Templ},
howpublished = {arXiv},
year = {2026},
month = jun,
doi = {10.48550/arxiv.2606.27936},
eprint = {2606.27936},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2606.27936},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - Agentic AI-Powered Re-Identification: An Emerging, Scalable Threat to Mobility Microdata Privacy
AU - Oscar Thees
AU - Roman Müller
AU - Matthias Templ
PY - 2026
DA - 2026/06/26
PB - arXiv
DO - 10.48550/arxiv.2606.27936
UR - https://arxiv.org/abs/2606.27936
AB - The widespread collection of fine-grained location data by commercial data brokers creates a re-identification risk that is not widely recognised by the public. While prior research has established that mobility traces are highly unique and that individuals can, in principle, be identified from a handful of spatio-temporal points, such attacks have historically required significant manual effort from skilled analysts, limiting their practical scale. In this feasibility study, we demonstrate in a real world setting that agentic AI fundamentally changes this threat model. We present an end-to-end pipeline in which large language model agents autonomously search the open web, cross-reference public records and social media, and resolve raw coordinate sequences to candidate identities - without human intervention. We evaluate the pipeline on a spatio-temporal dataset containing simulated location points anchored at and around true home and work addresses, focusing on a high-risk disclosure scenario. Our results demonstrate that, from spatio-temporal data and public sources alone, our agentic AI successfully re-identified 18 of the 25 re-identifiable individuals (72%) and 18 of 43 cases overall (41.9%). We discuss implications for Statistical Disclosure Control (SDC) practice and outline the near-future escalation that data custodians and regulators must anticipate. De facto anonymity - an implicit foundation of SDC practice - is shifting. Agentic AI strengthens the case that re-identification is reasonably likely by any means under the GDPR Recital-26 standard, at costs of minutes-and-dollars per target.
ER -