Spatial aggregation: exposure, unstable cells and location privacy

Last updated: 5 Oct 20265 min read

tutorial

A location heatmap should distinguish opportunity from count and avoid disclosing sensitive patterns through tiny cells.

Choose the aggregation unit

A delivery count by grid cell is not a service-rate measure if cells contain different numbers of active customers. Include exposure such as eligible orders or active sites when interpreting rates. Preserve event identity before assigning cells so retries do not inflate hot spots. Distribution displays should show counts and rate denominators alongside color.

Handle sparse cells

One delayed delivery in a cell with two orders yields a 50 percent delay rate, but that number is unstable. Show support and uncertainty or aggregate to a broader region when the task allows it. Do not smooth a sparse cell into a confident local estimate without showing the smoothing rule. A cell with no observed events can mean zero activity or missing telemetry.

Protect location traces

Fine-grained repeated coordinates can reveal a person’s routine even without a name. Limit precision and retention to the task, apply access controls, and review whether public aggregate releases need a formal privacy mechanism. A privacy threat model must identify who can see the map and how repeated releases combine. A minimum-count rule alone is not a complete guarantee.

Test a release

Build cells A and B with 47 and 3 eligible orders. Give B one delayed delivery and a sensitive single address. A public report should not present B’s exact point or 33.3 percent rate as a stable neighborhood fact. Record the aggregation and suppression decision, plus whether the same individual could be isolated across weekly map releases.

Implementation

def cell_delay_rates(cell_rows):
    rates = {}
    for row in cell_rows:
        if row["eligible_orders"] > 0:
            rates[row["cell_id"]] = row["delayed_orders"] / row["eligible_orders"]
    return rates

Performance and operating cost

Computing C cell rates costs O(C) time and O(C) output space. Rendering many spatial cells adds map and query cost; privacy review also needs to account for repeated releases, not only one static map.

Common Mistakes

Do not compare raw counts when cell exposure differs sharply.
Do not interpret a tiny denominator as a stable rate.
Do not claim coarse cells or a count threshold alone guarantee privacy.