Privacy And Minimum Aggregation

Why aggregation, not geometry, is the privacy boundary

A polygon or an H3 cell is not private or unsafe by itself; the risk is a function of how many distinct people or devices are represented inside it. A precisely drawn, geometrically exact 50 m cell around a single-family home is a privacy failure at any exactness level, while a coarse, approximate 5 km cell over a stadium during an event is not. Every conversion in this knowledge base that terminates in an audience count or a device set must therefore carry a minimum aggregation rule alongside its containment rule — the two are independent constraints and a page that documents one without the other is incomplete.

Small-cell re-identification

A cell reporting an audience count of one to a small number of digits allows an observer with any side information (a home address, a workplace, a schedule) to re-identify the specific person or household the count refers to. This risk exists at every resolution: a coarse cell with a sparse population (a rural R5 cell with three households) is exactly as exposed as a fine cell in a dense city, because the risk is driven by population count inside the cell, not cell area.

k-anonymity thresholds and sparse-audience suppression

The standard mitigation is a k-anonymity threshold: no reported cell may represent fewer than k distinct people or devices, for a k set by policy (commonly 5–50 depending on jurisdiction and data sensitivity). Enforcement has two mechanisms, and most production systems use both:

• Suppression — drop cells below the threshold from the output entirely, accepting a coverage gap.
• Roll-up — merge a below-threshold cell with its parent (coarser resolution) or with adjacent cells until the merged population clears k, accepting a resolution loss for that region only.

sparse-audience-suppression is the general term for both mechanisms. Suppression is preferred when a coverage gap is disclosable and acceptable; roll-up is preferred when a caller needs a value for every requested cell and can tolerate uneven resolution across the response.

Differential privacy and temporal leakage

Threshold suppression alone is defeated by repeated queries: an attacker who queries the same region across multiple time windows, or across overlapping cell sets, can reconstruct a below-threshold value by subtraction (query region A, query region A plus one household, take the difference). Differential privacy mitigates this by adding calibrated noise to every released count, bounding the information any single query — or any combination of queries — can reveal about one individual, regardless of how many times the same underlying population is queried. Threshold suppression without noise is a necessary but not sufficient control; a system exposed to repeated or overlapping queries needs differential privacy or an equivalent query-budget mechanism on top of it.

Temporal leakage is the time-axis version of the same problem: a cell that clears k-anonymity when aggregated over a month can fall below k when sliced to a single hour of a single day. The minimum aggregation window is the smallest time bucket at which the population/audience floor still holds, and it must be enforced as a floor on query granularity, not just on spatial resolution.

Household-level targeting risk and device trajectory exposure

Home-location and household-graph targeting (see advertising-geographic-matching-semantics) concentrates risk because the geometry — a single parcel or a fine H3 cell — is drawn specifically to isolate one household by construction, not as a side effect of a coarse aggregation. This is a distinct risk class from cell-count suppression and requires a minimum-parcel or minimum-radius floor independent of any population threshold.

Device trajectories carry a related but separate risk: an ordered sequence of high-resolution location points is frequently uniquely identifying even when no single point in the sequence would be, because the sequence itself (home, then a specific workplace, then a specific gym, in that order) is a fingerprint. The mitigation is not point-level suppression but sequence-level treatment — dropping temporal order, aggregating to origin-destination pairs without intermediate points, or coarsening both the spatial and temporal grain of the trajectory before it is stored or joined to any other dataset.

Resolution degradation and regional restrictions

Consent state and jurisdiction both function as external inputs to the aggregation floor, not as geometry inputs: a user who has not granted precise-location consent must have their location coarsened to the platform's declared reduced-precision tier before any cell assignment, and a region under a stricter regional privacy regime may carry a higher k or a coarser minimum resolution than the platform's global default. Both must be applied before polyfilling, never after — coarsening a value after it has already been assigned to a fine cell does not undo the exposure that fine assignment already created if the fine-grained intermediate was persisted or logged anywhere in the pipeline.

The privacy_safe profile

The privacy_safe conversion profile (conversion-profiles) codifies these rules as defaults: center containment (a single deterministic assignment per device, avoiding fractional double-counting across cells), a resolution policy that enforces both a minimum physical cell size and a minimum audience threshold, and suppression of any cell that does not clear the configured threshold after both are applied. Its stated guarantee is that no cell is reported below the configured audience/area threshold; its stated tradeoff is that resolution degradation and suppression reduce granularity in exactly the sparse regions where a naive system would be most exposed. Any pipeline reporting physical_presence or home_location audiences at H3 resolution 8 or finer without an explicit reference to this profile should be treated as unaudited.