We are creating a website that will collect location information (points) from users. We are exploring techniques to preserve users' location privacy (e.g., often users will share their home address, which is sensitive). One option that came to mind is to obfuscate or "hash" the points before storing them in the database, eliminating the need to store these sensitive data at all.

Our basic requirements are, I believe:

1. Given a single obfuscated point, it is not possible to derive the original point within (say) a kilometer or so, even given all the metadata associated with the point (i.e., assume the entire database is compromised).

2. Given an arbitrarily large set of obfuscated points corresponding to the same original point, it is still not possible to derive the original point. (For example, an easy technique would be to add a random vector to the original point, but if you do this enough times, the obfuscated points will cluster around the original point.)

It would be nice if various statistical properties were preserved, though I don't know which properties are important at this stage. For example, I'd rather that obfuscated points scatter in a "natural" way rather than accumulating into a grid. However, privacy is more important than this.

p.s. I think the tag "privacy" would be appropriate for this question, but as a n00b, I can't create it. Perhaps someone with more familiarity with this community could consider that.

We are creating a website that will collect location information (points) from users. We are exploring techniques to preserve users' location privacy (e.g., often users will share their home address, which is sensitive). One option that came to mind is to obfuscate or "hash" the points before storing them in the database, eliminating the need to store these sensitive data at all.

Our basic requirements are, I believe:

1. Given a single obfuscated point, it is not possible to derive the original point within (say) a kilometer or so, even given all the metadata associated with the point (i.e., assume the entire database is compromised).

2. Given an arbitrarily large set of obfuscated points corresponding to the same original point, it is still not possible to derive the original point. (For example, an easy technique would be to add a random vector to the original point, but if you do this enough times, the obfuscated points will cluster around the original point.)

It would be nice if various statistical properties were preserved, though I don't know which properties are important at this stage. For example, I'd rather that obfuscated points scatter in a "natural" way rather than accumulating into a grid. However, privacy is more important than this.