How Four Clues Can Reveal Your Identity When You Shop

The most counterintuitive, surprising, and impactful new stories delivered to your inbox every Thursday.

The internet is perhaps one of the most freeing and invasive places you could ever visit. On one hand you can browse unlimited amounts of information, but while doing so your movements will be tracked by the government, corporations, and any third-party that may see fit to track your movements. But even with the Edward Snowden revelations, most consumers still shop with a credit card, type in personal information and submit it to a website, and use sites like Google to do their searches.

Yes, companies anonymize consumer data, but some may be surprised how many crumbs they drop along the way and how just four pieces of information are all it takes to link a person to a credit card number.

Yves-Alexandre de Montjoye from the Massachusetts Institute of Technology in Cambridge and his team wanted to see how much effort it would take to match a person with their purchases. The group looked at three months’ worth of credit card records from 1.1 million people from an unidentified location, scrubbed of personal information. The researchers were able to pick out 90 percent of the people through just four pieces of information, and one of the four clues had nothing to do with what had been purchased. New Scientist‘s Aviva Rutkin spoke to de Montjoye in an interview, explaining:

“We’re building this body of evidence showing how hard it actually is to anonymize large sets of data like credit cards, mobile phones, and browsing information. We really need to think about what it means to be make data truly anonymous and whether it’s even possible.”

While retail sites do make an effort to anonymize consumer data, the metadata still exists, which is plenty—with enough datapoints—to connect that card with an identity. AOL ran into just this incident when it released search queries (all associated with randomized numbers) back in 2006. However, the internet was easily able to track down some of these “anonymous” users by looking at just a few searches.

Anyone wanting to start a journey to anonymize themselves can start with projects, such as the Tor browser and The Guardian Project. Also, the Electronic Frontier Foundation has built a secure messaging scorecard. Of course, it’s difficult to completely anonymize data, even if the data itself is encrypted. Where it’s going and where it’s come from are still traceable. But the best place to start anonymizing that data is to start with the Tor browser and start purchasing things with cash. However, this amount of effort is beyond what most are willing to go through for the sake of avoiding data collection.

What efforts are you willing to go through to protect your personal data?