Let's say "you speak Luxembourgish and ask where you can buy a Mercedes for driving your kids to school" You think it violates your privacy that I might be able to guess where you live, your gender, and your income from that? Did I miss when the world made Bayes theorem illegal?
Applying Bayes' theorem isn't illegal but making interference from other public information then de-anonymising other data based on cross-matching is an entirely different act, regulated by privacy laws.
Privacy isn't only about the method, it's also about scale and intent. See CCTV which can individually be dumped the footage from and rewatched to identify criminals vs. live feed surveillance with AI face detection to track everyone 24/7. Same data used but very different intents and outcomes.
I'm with you about the intent, but I don't follow the scale argument. It's not like it isn't a privacy violation if you only do it to one person.
However, it changes when you do that in an automated way, en masse, both ethically and legally.
I think only problematic ethically. From what i can see, there can't be anything illegal about collecting publicly available information and using any algorithm to analyse and deduce information from it.
For example, while they can't just divulge my name & age in the news, the captions under pictures in news articles can often still have people's names & ages under them without explicit user consent. Tabloids would likely cease to exist if it were any other way. ;-)
How would you feel if a browser plugin displayed these details next to every username on Hacker News?
I remember when store algorithms were identifying a teenage girl was pregnant before her family knew and offering her discounts on maternity stuff. That anecdote was from over a decade ago.
Today average users are worried their phone is listening to them because something in a conversation comes up in a targeted ad, clearly worried about the idea of "private voice data" being compromised, but somehow less weirded out by the fact that the end result is possible without listening to anything.
Our expectations of privacy in relation to our data need to change with the times, and research like this helps that slightly, though to be honest the real picture of what can be discerned from data isn't reflected in public research but is enshrined in private practice, and having seen some of that side of things this paper's 'discovery' is a giant yawn.
People should begin to prepare for a future where your anonymous activities online (esp images and text) are cross correlated to your public activities trivially by any interested party.
And where your deep dark secrets aren't so secret or where truth and lies can reasonably be revealed as such. Cheating in a relationship? Are you unique enough that a multimodal model fed all public social media data can't identify matching patterns in online behavior changes from early in a relationship to later for profiles where the SO later posted about infidelity and compare to your activity?
When switching from scented candles to unscented can tell a store's algorithm with access to broad data that you are pregnant before you've told anyone, we really can't yet imagine just what much larger models trained on much more massive data may yet reveal in the smallest actions and nuances.
The claim is birthdate+zip+gender could uniquely identify 87% of the US population, and there are respectable studies to back this stuff up (https://groups.csail.mit.edu/mac/classes/6.805/articles/priv...). There aren't a lot of days where there's only one person celebrating their birthday in an entire zip code.
Even factoring in birth year and gender, I struggle with this a bit, because I know that in densely populated areas of the country, where more and more of the population lives (upwards of 80% of the US lives in urban environments), you'll find multiple babies with the same gender being born in the same hospital on any given day... and there are often multiple hospitals servicing the same zip code!
Despite all this, your point still stands: it doesn't take much data to deanonymize someone.