Skip to content
SwissAnon
Contact
Menu
Back to blog
2026 agentic AI PSD

Agentic AI-powered re-identification presented at PSD 2026 in Cádiz

Oscar Thees and Roman Müller at PSD 2026 in Cádiz.

At Privacy in Statistical Databases (PSD 2026) in Cádiz, Spain (30 September – 2 October 2026), Oscar Thees and Roman Müller presented our paper Agentic AI-Powered Re-identification: An Emerging, Scalable Threat to Mobility Microdata Privacy, published in the conference proceedings (Springer, Lecture Notes in Computer Science).

Mobility traces are known to be highly unique, and it has long been clear that a handful of spatio-temporal points can identify a person in principle. In practice, however, such attacks required substantial manual effort by skilled analysts, which limited their scale. Our feasibility study shows that agentic AI changes this threat model. An end-to-end pipeline of large-language-model agents autonomously analyses raw coordinate sequences, derives likely home and work locations, searches the open web, cross-references public records and social media, and resolves the traces to candidate identities without human intervention.

We evaluated the pipeline on simulated location data anchored at and around the true home and work addresses of consenting participants. From the spatio-temporal data and public sources alone, the agents re-identified 18 of 43 individuals, at a cost of minutes and a few dollars per target.

For statistical disclosure control this matters directly. De facto anonymity, an implicit foundation of SDC practice, is shifting: agentic AI strengthens the case that re-identification is “reasonably likely” under the GDPR’s Recital 26 standard. Data custodians and regulators should anticipate this escalation now.

The paper is co-authored by Oscar Thees, Roman Müller and Matthias Templ. It also received wide attention beyond the research community, including an article in the NZZ.