The amount of time a person spends on different smartphone apps is enough to identify them among a larger group in more than one in three cases, the researchers say, who warn of security and privacy implications.
They fed 4,680 days of app usage data into statistical models. Each of these days was associated with one of 780 users, so the models learned daily app usage patterns.
The researchers then tested whether the models could identify an individual when they only had a single day of anonymous smartphone activity not yet associated with a user.
Dr Ellis from the University of Bath said: “Our models, which were trained on just six days of app usage data per person, were able to identify the right person from one day of anonymized data. a third of the time.”
It may not seem like much, but when the models predicted who the data belonged to, it could also provide a list of most likely to least likely candidates. It was possible to see the 10 people most likely to belong to a specific day of data. About 75% of the time, the right user would be among the 10 most likely candidates.
Smartphone apps could identify a person even when offline
Professor Taylor of Lancaster University added: “In practical terms, a law enforcement investigation aimed at identifying a criminal’s new phone from knowledge of their historical phone usage could narrow a pool of candidates from around 1,000 phones to 10 phones, with a 25% risk of their missing.”
Therefore, the researchers warn that software allowed to access a smartphone’s standard activity record could provide a reasonable prediction about a user’s identity even when logged out of their account. Identification is possible without monitoring conversations or behaviors within the apps themselves.
Dr Shaw from Lancaster University said: “We found that people displayed consistent patterns in their day-to-day app usage behaviors, such as most frequent use of Facebook and least use of the app. In support of this, we also showed that two days of smartphone data from the same person exhibited greater similarity in app usage patterns than two days of data from different people.
Therefore, it is important to recognize that app usage data alone, which is often collected automatically by a smartphone, can potentially reveal a person’s identity.
While providing new opportunities for law enforcement, it also poses privacy risks if this type of data is misused.