The amount of time a person spends on different smartphone apps is enough to identify them among a larger group in more than one in three cases, the researchers say, who warn of security and privacy implications.
Researchers from the universities of Lancaster and Bath analyzed smartphone data from 780 people.
They fed 4,680 days of app usage data into statistical models. Each of these days was associated with one of 780 users, so the models learned daily app usage patterns.
The researchers then tested whether the models could identify an individual when they only had a single day of anonymous smartphone activity not yet associated with a user.
“Our models, which were trained on just six days of app usage data per person, were able to identify the right person from a day of anonymized data a third of the time,” said David Ellis of the University of Bath.
While that might not seem like much, when models predicted who the data belonged to, it could also provide a list of most likely to least likely candidates.
Findings published in the journal Psychological Science showed that it was possible to see the 10 individuals most likely to belong on a specific day of data.
About 75% of the time, the right user would be among the 10 most likely candidates.
“In practice, a law enforcement investigation to identify a criminal’s new phone from knowledge of their historical phone usage could reduce a candidate pool from approximately 1,000 phones to 10 phones, with a 25% chance of missing them,” Professor Paul said. Taylor from Lancaster University.
As a result, the researchers warn that software allowed access to standard smartphone activity logging could provide a reasonable prediction about a user’s identity even when logged out of their account.
Identification is possible without monitoring conversations or behaviors within the apps themselves.
“We found that people displayed consistent patterns in their day-to-day app usage behaviors, such as Facebook most used and Calculator app least. In support of this, we We also showed that two days of smartphone data from the same person showed greater similarity in app usage patterns than two days of data from different people,” explained Heather Shaw of Lancaster University.
Therefore, it is important to recognize that app usage data alone, which is often collected automatically by a smartphone, can potentially reveal a person’s identity.
While providing new opportunities for law enforcement, it also poses privacy risks if this type of data is misused, the researchers said.