Browsing behavior exposes identities on the Web (www.nature.com)

Researchers analyzed web-tracking data from 2,148 German users (9.15M visits across ~49.9K domains) and found that simple “behavioral fingerprints” made from users’ most-visited sites uniquely identify people at scale. By representing each user as an n-tuple of their top-n domains, the team showed that the four most-visited domains uniquely identify 95% of individuals; on average only 2.45 domain choices are needed to isolate a user. Fingerprints are stable across age, gender and income groups, and even sparse signals (few domains) or short observation windows suffice: two least-visited domains are already highly distinctive, and splitting contiguous browsing into halves yields 60% re-identification with n=5, ~80% with n=10 and ~90% with n=15. For the AI/ML community this is consequential: routine behavioral data—often considered less sensitive than explicit identifiers—can deanonymize users with minimal information, undermining naive anonymization and raising risks for datasets used to train models, evaluate personalization, or share with third parties. The findings imply that data minimization, stronger aggregation or differential privacy, stricter retention/collection limits, and robust threat models are necessary when working with browsing traces or behavior-derived features. They also underline that behavioral uniqueness is a stable signal that adversaries (or models) can exploit, so consent, regulation, and technical safeguards must account for re-identification risk even under sparse tracking.