Associating anonymous information with personally identifiable information in a non-identifiable manner
The present disclosure provides a detailed description of techniques used in methods, systems, and computer program products for associating anonymous information with personally identifiable information without sharing any personally identifiable information. A method receives a specification record comprising one or more specified demographic attributes to be used in user record selection operations, the results of which operations include user records that comprise a user identifier and at least some non-personally-identifiable information. A candidate group is formed by applying a set of rules over the retrieved user records to selectively exclude one or more user records that comprise mutually-exclusive characteristics with respect to the other user records in the candidate group. An anonymity measure is calculated over the candidate group to satisfy a threshold of anonymity. If needed to satisfy the threshold of anonymity, additional user records are added to the group before any sharing operations. Anonymity of the users is preserved.
1. A computer-implemented method, comprising:
retrieving a first group of user records, each user record in the first group of user records including a first demographic attribute, wherein each user record of a subset of user records of the first group of user records further includes a second demographic attribute in addition to the first demographic attribute;
forming a second group of user records, the second group of user records comprising a first user record of the first group of user records and excluding a second user record of the first group of user records, wherein the formation of the second group of user records is based at least in part on a determination that: the first user record has a first value of the first demographic attribute in common with one or more other user records of the second group, and the first value of the first demographic attribute included in the first user record is mutually exclusive with a second value of the first demographic attribute included in the second user record;
modifying the second group of user records to obfuscate a correspondence of non-personally-identifiable information to personally-identifiable information in the second group of user records, wherein the modifying comprises:
grouping the first user record with one or more added user records that have a value of the second demographic attribute in common with the first user record but are not included in the one or more other user records; and
based on and after the modifying, determining whether an anonymity measure of the modified second group of user records exceeds a threshold of anonymity, wherein the anonymity measure is derived in part from a minimum quantity of user records included in the modified second group of user records, and
wherein:
a data set representing the modified second group of user records is transmitted to a recipient based on determining that the anonymity measure exceeds the threshold of anonymity.
2. The method of claim 1 , further comprising:
receiving one or more user identifiers, each of the one or more user identifiers obfuscating the personally-identifiable information associated with a specific user device; and
collecting user data identifying a plurality of user records, each user record of the plurality of user records including a user identifier of the one or more user identifiers and the first demographic attribute.
3. The method of claim 1 , further comprising receiving a specification record comprising the first demographic attribute to be used in a user record selection operation, the specification record corresponding to a request for non-personally-identifiable information, wherein the user record selection operation causes retrieving the first group of user records.
4. The method of claim 1 , further comprising applying a set of rules over the first group of user records, the application of the set of rules causing inclusion of at least one new user record into the modified second group of user records, the at least one new user record comprising the first value of the first demographic attribute.
5. The method of claim 1 , further comprising receiving a user identifier from a requestor, wherein the user identifier is an obfuscated ID and the first group of user records is retrieved based on the user identifier.
6. The method of claim 5 , wherein the obfuscated ID is a hashed ID.
7. The method of claim 6 , further comprising transmitting one or more hashed IDs from a data management server to another server.
8. The method of claim 1 , wherein the transmitting further comprises transmitting the modified second group of user records from a data management server to another server.
9. The method of claim 1 , wherein the formation of the second group of user records is based on (a) inclusion of a first set of user records that include one or more demographic attributes in common with the first user record, the one or more demographic attributes in common including at least the first value of the first demographic attribute, and (b) exclusion of a second set of user records that include one or more demographic attributes not in common with the first user record, the one or more demographic attributes not in common including at least the second value of the first demographic attribute included in the second user record.
10. The method of claim 1 , wherein the modifying further comprises:
grouping the first user record with one or more second added user records that have a value of the second demographic attribute in common with the first user record but do not have the first value of the first demographic attribute in common.
11. A non-transitory computer readable medium having stored thereon a sequence of instructions which, when stored in memory and executed by a processor, causes the processor to perform a set of acts, the acts comprising:
retrieving a first group of user records, each user record in the first group of user records including a first demographic attribute, wherein each user record of a subset of user records of the first group of user records further includes a second demographic attribute in addition to the first demographic attribute;
forming a second group of user records, the second group of user records comprising a first user record of the first group of user records and excluding a second user record of the first group of user records, wherein the formation of the second group of user records is based at least in part on a determination that: the first user record has a first value of the first demographic attribute in common with one or more other user records of the second group, and the first value of the first demographic attribute included in the first user record is mutually exclusive with a second value of the first demographic attribute included in the second user record;
modifying the second group of user records to obfuscate a correspondence of non-personally-identifiable information to personally-identifiable information in the second group of user records, wherein the modifying comprises:
grouping the first user record with one or more added user records that have a value of the second demographic attribute in common with the first user record but are not included in the one or more other user records; and
based on and after the modifying, determining whether an anonymity measure of the modified second group of user records exceeds a threshold of anonymity, wherein the anonymity measure is derived in part from a minimum quantity of user records included in the modified second group of user records, and
wherein:
a data set representing the modified second group of user records is transmitted to a recipient based on determining that the anonymity measure exceeds the threshold of anonymity.
12. The computer readable medium of claim 11 , further storing instructions configured to cause the processor to perform acts comprising:
receiving one or more user identifiers, each of the one or more user identifiers obfuscating the personally-identifiable information associated with a specific user device; and
collecting user data identifying a plurality of user records, each user record of the plurality of user records including a user identifier of the one or more user identifiers and the first demographic attribute.
13. The computer readable medium of claim 11 , further storing instructions configured to cause the processor to perform an act of receiving a specification record comprising the first demographic attribute to be used in a user record selection operation, the specification record corresponding to a request for non-personally-identifiable information, wherein the user record selection operation causes retrieving the first group of user records.
14. The computer readable medium of claim 11 , further storing instructions configured to cause the processor to perform an act of applying a set of rules over the first group of user records, the application of the set of rules causing inclusion of at least one new user record into the modified second group of user records, the at least one new user record comprising the first value of the first demographic attribute.
15. The computer readable medium of claim 11 , further storing instructions configured to cause the processor to perform an act of receiving a user identifier from a requestor, wherein the user identifier is an obfuscated ID and the first group of user records is retrieved based on the user identifier.
16. The computer readable medium of claim 11 , wherein the formation of the second group of user records is based on (a) inclusion of a first set of user records that include one or more demographic attributes in common with the first user record, the one or more demographic attributes in common including at least the first value of the first demographic attribute, and (b) exclusion of a second set of user records that include one or more demographic attributes not in common with the first user record, the one or more demographic attributes not in common including at least the second value of the first demographic attribute included in the second user record.
17. The computer readable medium of claim 11 , wherein the modification further comprises:
grouping the first user record with one or more second added user records that have a value of the second demographic attribute in common with the first user record but do not have the first value of the first demographic attribute in common.
18. A system comprising:
one or more processors; and
a non-transitory computer-readable storage medium containing instructions configured to cause the one or more processors to perform operations including:
retrieving a first group of user records, each user record in the first group of user records including a first demographic attribute, wherein each user record of a subset of user records of the first group of user records further includes a second demographic attribute in addition to the first demographic attribute;
forming a second group of user records, the second group of user records comprising a first user record of the first group of user records and excluding a second user record of the first group of user records, wherein the formation of the second group of user records is based at least in part on a determination that: the first user record has a first value of the first demographic attribute in common with one or more other user records of the second group, and the first value of the first demographic attribute included in the first user record is mutually exclusive with a second value of the first demographic attribute included in the second user record;
modifying the second group of user records to obfuscate a correspondence of non-personally-identifiable information to personally-identifiable information in the second group of user records, wherein the modifying comprises:
grouping the first user record with one or more added user records that have a value of the second demographic attribute in common with the first user record but are not included in the one or more other user records; and
based on and after the modifying, determining whether an anonymity measure of the modified second group of user records exceeds a threshold of anonymity, wherein the anonymity measure is derived in part from a minimum quantity of user records included in the modified second group of user records, and
wherein:
a data set representing the modified second group of user records is transmitted to a recipient based on determining that the anonymity measure exceeds the threshold of anonymity.
19. The system of claim 18 , wherein the operations further comprise:
receiving one or more user identifiers, each of the one or more user identifiers obfuscating the personally-identifiable information associated with a specific user device; and
collecting user data identifying a plurality of user records, each user record of the plurality of user records including a user identifier of the one or more user identifiers and the first demographic attribute.
20. The system of claim 18 , wherein the operations further comprise receiving a specification record comprising the first demographic attribute to be used in a user record selection operation, the specification record corresponding to a request for non-personally-identifiable information, wherein the user record selection operation causes retrieving the first group of user records.
21. The system of claim 18 , wherein the operations further comprise applying a set of rules over the first group of user records, the application of the set of rules causing inclusion of at least one new user record into the modified second group of user records after the modifying, the at least one new user record comprising the first value of the first demographic attribute.
22. The system of claim 18 , wherein the operations further comprise receiving a user identifier from a requestor, wherein the user identifier is an obfuscated ID and the first group of user records is retrieved based on the user identifier.
23. The system of claim 16 , wherein the formation of the second group of user records is based on (a) inclusion of a first set of user records that include one or more demographic attributes in common with the first user record, the one or more demographic attributes in common including at least the first value of the first demographic attribute, and (b) exclusion of a second set of user records that include one or more demographic attributes not in common with the first user record, the one or more demographic attributes not in common including at least the second value of the first demographic attribute included in the second user record.
24. The system of claim 18 , wherein the modification further comprises:
grouping the first user record with one or more second added user records that have a value of the second demographic attribute in common with the first user record but do not have the first value of the first demographic attribute in common.